What are good options to implement a devops chatbot for Slack?
I have found StackStorm to be the most fully-featured ChatOps product.
It satisfies your requirements:

Authz, RBAC, ACL ✔
Extensible in Python ✔

See below.

StackStorm is marketed as a

Robust If This, Then That Platform

(but for DevOps)
StackStorm consists of a few components, beyond it's chatops capability:


Sensors:
Sensors are Python plugins for either inbound or outbound integration that receives or watches for events respectively. When an event from external systems occurs and is processed by a sensor, a StackStorm trigger will be emitted into the system.

Triggers
Triggers are StackStorm representations of external events. There are generic triggers (e.g. timers, webhooks) and integration triggers (e.g. Sensu alert, JIRA issue updated). A new trigger type can be defined by writing a sensor plugin.

Actions
Actions are StackStorm outbound integrations. There are generic actions (ssh, REST call), integrations (OpenStack, Docker, Puppet), or custom actions. Actions are either Python plugins, or any scripts, consumed into StackStorm by adding a few lines of metadata. Actions can be invoked directly by user via CLI or API, or used and called as part of rules and workflows.

Rules:
Rules map triggers to actions (or to workflows), applying matching criteria and mapping trigger payload to action inputs.

Workflows
Workflows stitch actions together into “uber-actions”, defining the order, transition conditions, and passing the data. Most automations are more than one-step and thus need more than one action. Workflows, just like “atomic” actions, are available in the Action library, and can be invoked manually or triggered by rules.
Packs
Packs are the units of content deployment. They simplify the management and sharing of StackStorm pluggable content by grouping integrations (triggers and actions) and automations (rules and workflows). A growing number of packs are available on StackStorm Exchange. Users can create their own packs, share them on Github, or submit to the StackStorm Exchange.

Audits
Audit trail of action executions, manual or automated, is recorded and stored with full details of triggering context and execution results. It is also captured in audit logs for integrating with external logging and analytical tools: LogStash, Splunk, statsd, syslog.



StackStorm's ChatOps is built into it's other components:

ChatOps leverages two components within StackStorm in order to provide a fluid user experience. These subsystems are the Action Aliases and Notifications subsystems. You can learn more about each of these individual components in their corresponding sub-sections.

but you can also use your own:

If you already have a Hubot instance, you’ll need the hubot-stackstorm module installed and the following environment variables set up:

Authentication can be done by StackStorm itself, or delegated to a proxy authentication system:

The service can be configured with different backends (i.e. PAM, LDAP, etc.) to handle the authentication. If a backend is not specified, an htpasswd-compatible flat file authentication backend is used. To use a different backend, select and install the appropriate python package from the StackStorm community repos and configure st2auth accordingly.

It also supports API keys.
As for RBAC, they claim that it is supported in their &quot;Extreme Workflow Composer&quot;

Role Based Access Control (RBAC) is only available in Extreme Workflow Composer. For information about Extreme Workflow Composer and the differences between StackStorm and Extreme Workflow Composer, please see stackstorm.com/product.

More at https://docs.stackstorm.com/install/ewc.html
StackStorm has &quot;packs&quot; which are predefined workflows, similar to IFTT or Zapier, which are sets of triggers, rules and actions. You can extend it with your own actions:

An action is composed of two parts:

A YAML metadata file which describes the action, and its inputs.
A script file which implements the action logic

As noted above, an action script can be written in an arbitrary programming language, as long as it follows these conventions:

Script should exit with 0 status code on success and non-zero on error (e.g. 1)
All log messages should be printed to standard error