One read of Claude Documentationclaude-docs-20260814T092040Z
213 pages moved out of 213 read.
Pages moved
213
significant first
Pages read
213
in this capture
Captured
09:20 UTC
Corpus hash
dfa3e64bc187
full baseline · baseline
What this read moved
51-75 of 213, page 3 of 9This capture is too large to show at once. Changes 51-75 of 213 are below, significant first; the rest are on the following screens.
claude-tag/admins/connections/vercel First recorded · 44 lines, first recorded
# Connect Vercel ## Create the credential in Vercel ## Add the connection to a bundle ## Verify the connection ## Related resources
The first capture of this source. The page was already there, and this is what it said.
# Connect Vercel
> Connect Vercel to Claude Tag so it can check deployment status and logs. Covers the dedicated account to create, the token fields, and the URL to allow.
export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
<BetaNote />
<Note>Connections are added inside an [Access bundle](/docs/claude-tag/admins/add-connections#your-first-access-bundle). At [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), open **Access bundles** in the left navigation, click into a bundle (or **Create** one), and go to its **Credentials** tab.</Note>
Connecting Vercel lets Claude check deployment status and logs from any channel under the bundle's scope. You add it as a connection inside an [Access bundle](/docs/claude-tag/admins/add-connections); the credential belongs to the agent, not to any person.
Pair this connection with the Vercel plugin from Anthropic's plugin marketplace so Claude knows how to call the API; see [Attach plugins](/docs/claude-tag/admins/add-connections#attach-plugins). This is an HTTP API connection, not an MCP server or a personal claude.ai connector.
## Create the credential in Vercel
Create the token from a dedicated team member seat, scoped to the team rather than your personal account.
Vercel's own guide for creating the credential is at [vercel.com](https://vercel.com/kb/guide/how-do-i-use-a-vercel-api-access-token).
## Add the connection to a bundle
In the bundle, click **Connect** next to **Vercel**.
| Field | Value |
| :-------------------- | :--------------------------- |
| Claude's access token | The access token from Vercel |
| Allowed websites | `api.vercel.com` |
The Agent Proxy injects the credential at the network boundary; the model and the sandbox are not given the key. See [how Agent Proxy works](/docs/claude-tag/concepts/agent-identity#agent-proxy).
## Verify the connection
In a channel under the bundle's scope, in a new thread:
```text wrap theme={null}
@Claude what can you access from this channel?
```
Vercel appears in the list once the connection is live. New threads pick up the connection on their own; in an existing thread, ask Claude to use the service by name.
## Related resources
* [Give Claude access](/docs/claude-tag/admins/add-connections): the full credential-type and allowed-hosts reference
claude-tag/admins/customize First recorded · 103 lines, first recorded
# Customize Claude Tag ## Settings admins control ### Channel connections are separate from personal connectors ## Change behavior from the channel ## Choose the model for a scope ### Models your organization allows ## Auto mode allow rules ## Settings no one can change ## Related resources
The first capture of this source. The page was already there, and this is what it said.
# Customize Claude Tag > Claude Tag is customized per channel and workspace (a scope), not per user. See what admins set in claude.ai, what anyone can change from the channel, and what stays fixed. export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>; <BetaNote /> Claude Tag's behavior is shaped by four layers, each set in a different place: | Layer | What it is | Who sets it | Where | | :---------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------- | | **Connections** | Credentials for the systems Claude can reach (GitHub, Drive, Datadog, your APIs) | Owner | [Access bundles](/docs/claude-tag/admins/add-connections) | | **Plugins and skills** | Instructions that teach Claude how to use a tool or follow a process. A plugin bundles one or more [skills](https://code.claude.com/docs/en/skills). | Owner | [Bundle Plugins tab](/docs/claude-tag/admins/add-connections#attach-plugins) or a [skills repository](/docs/claude-tag/admins/skills-repo) | | **Custom instructions** | Standing guidance read in every session at a scope (team conventions, output formats). Outranks channel memory. | Owner for any scope; channel members for the channel scope, from the [Configure page](/docs/claude-tag/users/good-habits#configure-claude-for-a-channel) | [Per-scope instructions](/docs/claude-tag/admins/attach-to-scope#add-custom-instructions) | | **Channel memory** | Facts Claude saves while working in a channel | Anyone in the channel | By [telling Claude](/docs/claude-tag/users/memory) | Connections and plugins decide what Claude *can do*; instructions and memory shape *how it does it*. ## Settings admins control Access and organization-wide behavior are set at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), per scope (a scope is a channel, a workspace, or your whole organization), so the same agent can work differently in different channels. Most controls below are Owner-only. | Setting | What it does | More | | :-------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | :--------------------------------------------------------------------------------------------------------------------------------------------- | | Custom instructions | Standing guidance read in every session on a scope, like team conventions. Outranks channel memory. | [Add custom instructions](/docs/claude-tag/admins/attach-to-scope#add-custom-instructions) | | Respond automatically | Whether Claude replies to a channel's messages without an @-mention. Channel members can change it too, from Slack or the channel's Configure page. | [Turn automatic replies on or off](/docs/claude-tag/users/when-claude-responds#turn-automatic-replies-on-or-off) | | Plugins | Bundles of skills that teach Claude how to use a specific tool | [Attach plugins](/docs/claude-tag/admins/add-connections#attach-plugins) | | Connections | Which systems it can reach from each channel | [Add connections](/docs/claude-tag/admins/add-connections) | | Default model | Which Claude model handles sessions in a scope | [Choose the model for a scope](#choose-the-model-for-a-scope) | | Auto mode allow rules | Actions pre-approved in a scope's sessions that Claude's permission checker would otherwise flag or stop | [Auto mode allow rules](#auto-mode-allow-rules) | | Environment | Which cloud environment a scope's sessions run in. Only [organization-shared environments](https://code.claude.com/docs/en/cloud-environments#organization-shared-environments) appear in the picker, because Claude runs channel sessions with no user account attached. | [Channel environment troubleshooting](/docs/claude-tag/admins/troubleshooting#channel-sessions-use-the-wrong-environment-or-can%E2%80%99t-find-one) | | Claude Tag version | Which generation answers (New, Legacy, or Off) in a scope | [Migrate from the earlier Claude in Slack](/docs/claude-tag/admins/restrict-access#migrate-from-the-earlier-claude-in-slack) | ### Channel connections are separate from personal connectors An Owner configures Claude's connections, plugins, and skills, and they apply per scope. They are separate from the connectors, skills, or MCP servers an individual user has set up in their own claude.ai or Claude Desktop account. A user's personal connectors are not available to Claude in a channel, and the channel's connections are not listed among that user's personal connectors in claude.ai. To give Claude access to a tool that is not in the built-in connection list, including a custom MCP server, see [add a custom connection](/docs/claude-tag/admins/connections/custom). ## Change behavior from the channel Everything in the table below is open to channel members, with no admin involved. | To change | Say something like | More | | :----------------------------- | :--------------------------------------------------------- | :------------------------------------------------------------------------- | | How Claude formats output | "remember for this channel: post reports as a table" | [Memory](/docs/claude-tag/users/memory) | | How chatty Claude is | "ask before posting anything longer than a screen" | [Memory](/docs/claude-tag/users/memory) | | When Claude follows a thread | "stay quiet in this thread unless someone tags you" | [Control when Claude Tag responds](/docs/claude-tag/users/when-claude-responds) | | What Claude does on a schedule | "every morning at 9, post a digest of open threads" | [Set up routines](/docs/claude-tag/users/proactivity) | | What Claude remembers | "what do you remember about this channel?" then correct it | [Memory](/docs/claude-tag/users/memory) | Changes in the table above are saved to channel memory; verify one stuck by asking what it remembers. Members can also tailor how Claude works in the channel from the **Configure** link in the footer of any Claude reply. The link opens a claude.ai page where anyone in the channel who is also a member of your Claude organization can edit settings for that channel, unless an admin has [restricted editing to admins](/docs/claude-tag/admins/attach-to-scope#restrict-who-can-set-channel-instructions). The **Channel instructions** field on that page holds standing guidance that outranks memory. See [configure Claude for a channel](/docs/claude-tag/users/good-habits#configure-claude-for-a-channel). ## Choose the model for a scope Each scope carries a **Default model** setting in its **Advanced** section, alongside the [environment](/docs/claude-tag/concepts/glossary#environment) and guest controls. It sets the model new channel sessions in that scope start on; the options are drawn from the models available to your organization, such as Opus and Sonnet models. A scope without its own setting inherits from its parent, and a channel's setting overrides its workspace's. The **Inherit** option shows which model the scope resolves to. To keep sessions on a model you chose, set a specific model at the organization scope rather than leaving the setting unset; every scope without an override then follows it. The setting applies to new sessions; threads already underway keep the model they started with. The footer of each Claude reply in Slack names the model that handled it, so you can confirm what a scope is running. Channel members can also change the model from Slack, with no admin involved. Asking Claude in a thread switches that thread, and asking it to make a model the channel default changes what new threads in the channel start on. See [choose the model Claude Tag uses](/docs/claude-tag/users/models). ### Models your organization allows Claude Tag's model lists come from the models your organization makes available for Claude Code, set in the Claude admin console, leaving out any that Claude Tag doesn't support. A model you see in Claude Code can be absent in Slack for that reason. The allowed list applies in two places. * **Model lists in Slack.** The models Claude offers when someone asks it to switch, and the model selector for direct messages, show only allowed models. Claude declines a request to switch to a model outside the list. * **Configured defaults.** If your organization also enforces the policy on defaults and a workspace or channel's **Default model** isn't allowed by your organization's Claude Code model policy, Claude declines to start the session and posts a notice in the thread asking the requester to contact an admin. A model excluded by your organization's plan entitlements works differently. Claude starts the session on a fallback model the plan includes, and declines only when the plan excludes every fallback. The footer of the first reply names the model that served it, so check there to see which model the session started on. A change to the allowed list applies to new sessions, like a change to the **Default model**; a thread already underway keeps its model until someone in it asks Claude to switch. ## Auto mode allow rules Sessions run in [auto mode](https://code.claude.com/docs/en/permission-modes#eliminate-prompts-with-auto-mode), where Claude's permission checker reviews each action Claude is about to take and can flag or stop it. When you add an auto mode allow rule to a scope, you pre-approve one action in that scope's sessions, so Claude runs it there without the checker stopping it. The checker keeps reviewing every other action. A rule is a plain sentence that describes work you approve in the scope, such as "Deploying to our staging cluster from a session in this channel is a normal, approved workflow." To add one: 1. On [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), open the **Slack** tab under **Claude Tag's access** and find the scope you want to change (the organization-wide **Slack** row, a workspace, or a channel). The **Slack** row opens as **Default Slack access**. 2. Open the scope's **Advanced** section and find **Auto mode allow rules**, below the [**Default model**](#choose-the-model-for-a-scope) setting. 3. Select **Add rule** and write the rule as one plain sentence. The rules list has three properties: * **Limits:** a scope holds up to 50 rules, and each rule can be up to 1,024 characters * **Inheritance:** rules you set on a workspace or on [Default Slack access](/docs/claude-tag/admins/attach-to-scope#how-scopes-inherit) (the organization-wide root) carry down to the channels beneath, the way [custom instructions](/docs/claude-tag/admins/attach-to-scope#custom-instructions) stack. A channel's own rules add to those and never replace them, so put a rule on a single channel's scope to pre-approve an action there without changing any other channel. * **Access:** you edit the list with the same admin access as the scope's other **Advanced** settings <Warning>Once you add an allow rule, Claude runs the actions it names in every channel the scope covers without anyone approving them in the moment. Keep each rule narrow: name the tool, the action, and the environment it allows, and put rules that unlock sensitive systems on the narrowest scope that needs them.</Warning> ## Settings no one can change * The Claude app's name, @-handle, and avatar in Slack are the same in every workspace; there is no rename or rebrand setting. ## Related resources * [Settings map](/docs/claude-tag/concepts/settings-map): every settings surface, including spend limits and personal connectors * [What Claude Tag remembers](/docs/claude-tag/users/memory): how channel instructions are stored, shared, and corrected * [Good habits for working with Claude Tag](/docs/claude-tag/users/good-habits): phrasings that make recurring output consistent * [How agent identity works](/docs/claude-tag/concepts/agent-identity): why access is set per channel
claude-tag/admins/for-slack-admins First recorded · 50 lines, first recorded
# What the Claude Slack app can access ## Where Claude reads and posts ## Requested scopes ## What installing does not grant ## After you install ## Related resources
The first capture of this source. The page was already there, and this is what it said.
# What the Claude Slack app can access > What the Claude app reads and posts in Slack, the OAuth scopes it requests, and what installing it does not grant. Written for the Slack admin approving the install. export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>; <BetaNote /> You're approving the Claude app install for someone who's setting up Claude Tag. This page covers what the app can do in your Slack workspace. The rest of setup happens on their side, in the Claude console; you don't need a Claude account. ## Where Claude reads and posts Claude reads and posts only in channels a workspace member has added it to, and in direct messages. Any workspace member who opens a direct message with Claude receives its welcome message, whether or not they've linked a Claude account. Installing the app does not add it to any channel. A member can add Claude to a channel in one of two ways: * Invite it with `/invite @Claude` in the channel * Select **Add to channel** on a channel Claude suggests in a direct message. Claude's welcome message, the introduction it posts when a member first opens a direct message with it, suggests public channels this way. When a member selects **Add to channel**, Claude adds itself to that channel using its `channels:join` scope. Slack's audit log records the join as the Claude app, with no inviter shown; the member's selection is not visible in Slack's log. If you see a join in the audit log that no one can explain, a member selected one of these buttons. Claude does not join channels on its own. Reading a channel's full history requires being added there. Workspace search can surface public-channel content, the same as any app with the search scope. Slack Connect channels (shared with another company) are always excluded, regardless of configuration. ## Requested scopes The app requests bot scopes for reading and posting in channels it's a member of, reactions, files, canvases, user lookup, and public-channel search. Slack's install consent screen shows the full current list; treat that as the canonical reference, since the set can change between releases. Two scopes a Slack admin commonly asks about: * `channels:join` lets Claude add itself to a public channel when a member selects one of its suggested-channel buttons. It cannot join private channels this way. * `users:read.email` lets Claude match a Slack member to their Claude account by email, so a person who DMs Claude is recognized without a separate linking step. ## What installing does not grant Credentials for GitHub, Google Drive, a data warehouse, or anything else are provisioned separately by a Claude organization Owner and live on Anthropic's side rather than in Slack. It responds when @-mentioned, and may respond to other messages it judges warrant a reply. ## After you install Post `@Claude connect` in any channel with no other text, or send `connect` on its own in a direct message with Claude, and give the code it returns to whoever asked you to install. That code is what pairs your workspace to their Claude organization; it expires after 15 minutes. Pick a channel that belongs to just your workspace. Claude can decline to reply in [guest and shared channels](/docs/claude-tag/admins/troubleshooting#guest-and-shared-channels). ## Related resources * [Security and data handling](/docs/claude-tag/concepts/security-and-data): where credentials are stored and what leaves your workspace * [Pair your Slack workspace](/docs/claude-tag/admins/pair-workspace): what the Claude Owner does with the code you send
claude-tag/admins/migrate-from-earlier First recorded · 75 lines, first recorded
# Migrate from the earlier Claude in Slack ## Switch your workspace to Claude Tag ### If `@Claude` doesn't respond at all ## What stays the same ## How Claude Tag differs from the earlier app ## What existing users notice after the switch ## Related resources
The first capture of this source. The page was already there, and this is what it said.
# Migrate from the earlier Claude in Slack
> Claude Tag replaces the earlier per-user Claude in Slack app in place. See what changes, what stays, how the version is chosen per channel, and what existing users notice.
export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
<BetaNote />
If your organization already used the earlier Claude in Slack, including [Claude Code in Slack](https://code.claude.com/docs/en/slack), Claude Tag replaces it. Your existing Slack app and `@Claude` handle stay, and no data migrates. What changes is who Claude acts as and who sets it up.
## Switch your workspace to Claude Tag
<Steps>
<Step title="Connect the workspace in the Claude console">
Open [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag). If your workspace isn't paired, run [setup](/docs/claude-tag/admins/setup-overview); otherwise you're already on Claude Tag. Once paired, channels and linked-user DMs answer with the New version by default; no per-channel action is needed.
</Step>
<Step title="Check for channels still on Legacy">
In the **Claude Tag's access** section, look at the **Claude Tag version** on each scope. Pairing defaults every scope to New, so this is usually empty; set any showing **Legacy** to **New**.
</Step>
<Step title="Give Claude its connections">
The New version starts with no access of its own. GitHub repositories and other connections do not carry over from individual users' linked accounts, so code requests in a switched channel have nothing to clone until you configure them. Follow the [setup overview](/docs/claude-tag/admins/setup-overview) to add connections, and [GitHub access](/docs/claude-tag/admins/configure-github) for code work specifically.
If your teams keep custom skills in a repository's `.claude/skills/` folder, those skills apply only in threads that have the repository. Grant the repository in an [Access bundle](/docs/claude-tag/admins/add-connections#your-first-access-bundle) and have users name it in the first message. To give skills to every channel under a scope, add them through a [skills repository](/docs/claude-tag/admins/skills-repo).
</Step>
<Step title="Tell your users">
Send them [Get started](/docs/claude-tag/users/getting-started). The visible change is that work now belongs to the channel; see [What existing users notice after the switch](#what-existing-users-notice-after-the-switch) below.
</Step>
</Steps>
**You'll see:** the workspace appears under **Where Claude Tag works**, and the **Claude Tag version** on each scope shows **New**.
### If `@Claude` doesn't respond at all
On Enterprise Grid, an earlier install can lose its connection and stop responding in every workspace. Don't uninstall the app. Have a Slack Org Owner or Org Admin, while signed in to one of the workspaces (not the org-level admin page), open [claude.com/claude-for-slack](https://claude.com/claude-for-slack), select **Add to Slack**, and choose **Install to entire organization**. This refreshes the connection in place. Then send `@Claude connect` again in a channel of that workspace and continue with step 1 above.
<Warning>The earlier Claude in Slack app, shown as **Legacy** in admin settings, is being deprecated; check with your account team for the cutover date. After that date, channels still set to Legacy stop responding until the scope's Claude Tag version is set to New.</Warning>
## What stays the same
* The Slack app and the `@Claude` handle. Your existing Claude in Slack settings (allowed users, verified-domain restriction) carry over. If your earlier install predates a permission Claude now uses, `@Claude connect` says so when you pair; a Slack admin clicks the install link in that reply and approves the consent screen, which installs over the existing app. Otherwise no app-side action is needed.
* Direct messages still run on the user's own claude.ai account, the same way they did before. The shift to a shared identity applies to channels.
* Users who already linked their claude.ai account keep that connection. It is what powers their DMs.
## How Claude Tag differs from the earlier app
The earlier app linked each user's own claude.ai account, so it answered as that person and used their connectors. Claude Tag has one identity for the team, provisioned by an admin who also sets what it can reach in each channel.
| | Legacy (the earlier Claude in Slack) | New (Claude Tag) |
| :------------- | :------------------------------------------ | :--------------------------------------------------------- |
| Identity | Each user links their own claude.ai account | One agent identity with org-level service credentials |
| Sessions | Spawned per request | One persistent session per thread, shared with the channel |
| Memory | None | Shared workspace memory plus private-channel memory |
| Standing work | None | Routines and channel watching |
| Who sets it up | Each user, individually | An Owner, once |
The **Claude Tag version** setting on each scope lets you pin a channel or workspace to **Off**, **Legacy**, or **New**, or **Inherit** the organization default. Use it to hold specific channels on the Legacy behavior while you finish provisioning, then switch them when ready. Access bundles only apply where the New version answers. See [the version setting](/docs/claude-tag/admins/restrict-access#migrate-from-the-earlier-claude-in-slack) for the control.
Both versions answer through the same @Claude app, so setting a scope to **Off** turns off the earlier version there too. To opt out of Claude Tag while keeping the earlier behavior, set the scope to **Legacy**, not **Off**.
## What existing users notice after the switch
In channels, the visible difference is that work belongs to the channel, not to whoever asked. Anyone can reply in a thread to steer it, and the result stays where the team can see and pick it up. Code work is authored by the Claude GitHub App rather than as the requesting user.
A user who never linked a claude.ai account can now hand Claude work in channels, by default. Whether that stays open or narrows to organization members is the admin's [access restriction](/docs/claude-tag/admins/restrict-access#members) setting.
If `@Claude` in a channel still opens pull requests under the asker's name, that channel is answering with the Legacy version; check the scope's Claude Tag version setting.
## Related resources
* [Glossary: the earlier Claude in Slack](/docs/claude-tag/concepts/glossary#the-earlier-claude-in-slack): what each term meant in the old app versus now
* [Set up Claude Tag](/docs/claude-tag/admins/setup-overview): the new admin-side setup, since per-user setup no longer applies
* [Restrict where Claude Tag operates](/docs/claude-tag/admins/restrict-access): keep specific channels on the old version during a phased switch
claude-tag/admins/network-requirements First recorded · 49 lines, first recorded
# Network requirements ## Add Anthropic's egress range to your allowlist ## Internet reachability ## IP allowlist vs. allowed websites ## Events and webhooks ## Related resources
The first capture of this source. The page was already there, and this is what it said.
# Network requirements
> Claude Tag reaches your services from a published egress range, over HTTP and HTTPS only. See the IP block to allowlist and how the allowlist relates to the allowed-websites setting on a connection.
export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
<BetaNote />
If a service you want to connect (a data warehouse, an internal API, a GitHub organization with an IP allow list) restricts access by source IP, add Anthropic's egress range to its allowlist. Hand this page to the team that manages it.
## Add Anthropic's egress range to your allowlist
Requests from Claude to your services originate from Anthropic's network. To let them through, add Anthropic's published egress range to the service's allowlist:
```text wrap theme={null}
160.79.104.0/21
```
The authoritative list is [Anthropic's published IP addresses](https://platform.claude.com/docs/en/api/ip-addresses); check it when you create the rule.
The range is shared across Anthropic services, and dedicated per-organization egress addresses aren't available, so the allowlist entry admits Anthropic's infrastructure as a whole. Your credential's [allowed websites](/docs/claude-tag/admins/add-connections#set-allowed-websites) are what scope which of *your* systems Claude can call.
Allowlist changes on enterprise systems can take days to take effect, which is why the [setup overview](/docs/claude-tag/admins/setup-overview#before-you-start) sends you here before you start setup.
## Internet reachability
<Warning>A connected service must accept traffic from the internet (restricted by IP allowlist if you like). A service reachable only inside your private network can't be connected; private networking such as PrivateLink or VPC peering is not supported.</Warning>
Every request from a channel's sandbox to your service passes through [Agent Proxy](/docs/claude-tag/concepts/agent-identity#agent-proxy), which carries HTTP and HTTPS only. A service reachable only over another protocol, such as SSH or a database's native wire protocol, can't be connected; put an HTTP API in front of it instead.
## IP allowlist vs. allowed websites
The IP allowlist on your service and the [allowed websites](/docs/claude-tag/admins/add-connections#set-allowed-websites) on a connection are opposite sides of the same boundary:
| | IP allowlist | Allowed websites |
| :-------------------- | :----------------------------------- | :-------------------------------------- |
| **Who configures it** | Your team, on your service | You, on the connection in Claude |
| **What it decides** | Which networks may reach the service | Which hosts a credential may be sent to |
## Events and webhooks
Events from connected services, like GitHub activity, are delivered directly to Anthropic, so there is no inbound listener to configure on your side.
## Related resources
* [Add connections](/docs/claude-tag/admins/add-connections#set-allowed-websites): the allowed-websites setting (the other direction: what Claude is allowed to reach)
* [Allow a host without a credential](/docs/claude-tag/admins/add-connections#allow-a-host-without-a-credential): how hosts become reachable from a channel, including [allow-all egress](/docs/claude-tag/admins/add-connections#allow-all-hosts)
* [How agent identity works](/docs/claude-tag/concepts/agent-identity): how credentials are injected at the network boundary
* [Setup overview](/docs/claude-tag/admins/setup-overview): back to the console flow once the allowlist is in place
claude-tag/admins/pair-workspace First recorded · 106 lines, first recorded
# Pair your Slack workspace ## Install and pair ## Send the install request to your Slack admin ### If `@Claude` doesn't respond at all ### If `@Claude connect` says the installation is out of date ### If Claude says Claude in Slack is not available for your organization ### If the console says "already connected to a different organization" ### If the console says "claim code is invalid, expired, or already used" ### If DMs never respond on Enterprise Grid ## After pairing: where Claude is enabled ## Related resources
The first capture of this source. The page was already there, and this is what it said.
# Pair your Slack workspace
> Connect your Slack workspace to your Claude organization. See what to send your Slack admin, where to paste the pairing code, and whether to enable the entire workspace or specific channels first.
export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
<BetaNote />
<div className="tm-stepbar">
<a className="tm-stepbar-seg tm-current" href="/docs/docs/claude-tag/admins/pair-workspace">1 · Pair workspace</a>
<a className="tm-stepbar-seg" href="/docs/docs/claude-tag/admins/add-connections">2 · Give access</a>
<a className="tm-stepbar-seg" href="/docs/docs/claude-tag/admins/set-spend-limit">3 · Spend limit</a>
<a className="tm-stepbar-seg" href="/docs/docs/claude-tag/admins/test-it">4 · See it work</a>
</div>
<div className="tm-stepmeta">
<div className="tm-stepmeta-row"><span className="tm-stepmeta-label">Role you need</span><span>Owner in your Claude organization, plus a Slack workspace admin to install the app and generate the pairing code. These can be the same person or two people.</span></div>
<div className="tm-stepmeta-row"><span className="tm-stepmeta-label">Before this step</span><span>The <a href="/docs/docs/claude-tag/admins/setup-overview#before-you-start">prerequisites</a>: confirm your role and decide where you'll pilot</span></div>
<div className="tm-stepmeta-row"><span className="tm-stepmeta-label">Do I need this?</span><span><span className="tm-meta-pill tm-meta-pill-req">Required</span>Nothing else in setup works until a workspace is paired.</span></div>
</div>
## Install and pair
Pairing has three parts: install the app in Slack, get a code from Slack, and paste it in the Claude console.
<Steps>
<Step title="Install the Claude app in Slack">
Open [claude.com/claude-for-slack](https://claude.com/claude-for-slack), click **Add to Slack**, and approve the permissions Slack shows. Skip if the app is already installed.
</Step>
<Step title="Run @Claude connect in Slack">
Send `@Claude connect` in any channel, with no other text, as a new top-level message or in a thread where Claude isn't already working. Claude replies with a pairing code valid for 15 minutes. In a thread where Claude is already working, it treats the message as a normal request instead.
Pick a channel that belongs to just your workspace. Claude can decline to reply in [guest and shared channels](/docs/claude-tag/admins/troubleshooting#guest-and-shared-channels).
In a DM with Claude, send `connect` on its own. Sending `link` works in place of `connect` in both cases.
Only a Slack workspace admin (or Grid org admin) can run this command. If that's not you, [send them the install request](#send-the-install-request-to-your-slack-admin) and have them return the code.
If your install is missing a permission, the reply names it (and may still issue a code with a warning); see [the section below](#if-@claude-connect-says-the-installation-is-out-of-date).
</Step>
<Step title="In the console: complete the pairing step">
At [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), setup opens as a full page until your first workspace is paired; click **Start setup** to reach **Pair your Slack workspace**. Paste the code, choose where Claude can reply (**Entire workspace (recommended)** or **Specific channel**), and click **Pair workspace**. To pair a workspace after your first, select **+ Connect** next to **Where Claude Tag works** instead, as described in [Manage workspaces](/docs/claude-tag/admins/workspaces#pair-another-workspace).
</Step>
</Steps>
Setup confirms the pairing and moves on to choosing Claude's tools, so there's nothing to check at this point; continue with [Give Claude access](/docs/claude-tag/admins/add-connections). After setup finishes, the Slack row under **Where Claude Tag works** shows your workspace as connected, and a [scope](/docs/claude-tag/concepts/glossary#scope) for it (the entry where you'll bind tool access) appears on the **Slack** tab under **Claude Tag's access**.
## Send the install request to your Slack admin
Steps 1–2 above need a Slack workspace admin; step 3 needs an Owner in your Claude organization. If those are two people, send the Slack admin this and have them return the code:
```text wrap theme={null}
Please install the Claude app (https://claude.com/claude-for-slack) in [workspace]. When that's done, let me know a time that works for the next part: you post "@Claude connect" in any channel with no other text and send me the code it returns. Pick a channel that belongs to just [workspace]. The code expires 15 minutes after Claude posts it, so I'll redeem it right away. What it can access: https://claude.com/docs/claude-tag/admins/for-slack-admins
```
### If `@Claude` doesn't respond at all
On Enterprise Grid, an earlier install can lose its connection and stop responding in every workspace. Don't uninstall the app. Have a Slack Org Owner or Org Admin, while signed in to one of the workspaces (not the org-level admin page), open [claude.com/claude-for-slack](https://claude.com/claude-for-slack), select **Add to Slack**, and choose **Install to entire organization**. This refreshes the connection in place. Then send `@Claude connect` again in a channel of that workspace.
### If `@Claude connect` says the installation is out of date
Your Slack install predates a permission the app now requests. The workspace keeps its old grant until a Slack admin approves the update. Replies name the missing permissions until then. The reply links both remedies; either one clears the error.
* **Approve the updated permissions.** A Slack workspace admin opens Slack's installed-apps page, `https://app.slack.com/apps-manage/<team-id>/integrations/installed`, finds the Claude app, and approves its requested permissions. The **approves its updated permissions** link in the reply lands on that page directly. On Enterprise Grid with an org-wide install, a Slack org admin uses `https://app.slack.com/manage/<grid-id>/integrations/installed` instead.
* **Reinstall the app.** A Slack workspace admin clicks the **reinstalls the Claude app** link in the reply and approves the consent screen Slack shows. Opening [claude.com/claude-for-slack](https://claude.com/claude-for-slack) and clicking **Add to Slack** again does the same thing. This installs over the existing app with the current permissions; do not uninstall first.
Then run `@Claude connect` again. Slack's **Manage apps** page lists the scopes the app requests, not the scopes your workspace has granted. Seeing a permission listed there does not by itself mean it is approved. The grant happens when an admin approves the update or completes the consent screen.
### If Claude says Claude in Slack is not available for your organization
The reply "Claude in Slack is not available for your organization" means your Slack workspace is paired to a Claude organization with a restricted compliance configuration, such as Zero Data Retention (ZDR). Claude Tag retains channel memory and session transcripts, so it can't run under that configuration.
Check which Claude organization the workspace is paired to. If your company has more than one, for example a trial org alongside the main one, the workspace may be paired to the wrong one. An Owner in that organization can [revoke the pairing](/docs/claude-tag/admins/workspaces#revoke-a-pairing) so you can pair the workspace to the right one here.
If the pairing already points to the intended organization, no admin setting lifts the restriction; contact your account team.
If the reply instead says Claude Tag has been turned off for your Claude organization, the cause is the **Enable Claude Tag for your organization** toggle, and an Owner can turn it back on. See [Claude Tag is turned off for your organization](/docs/claude-tag/admins/troubleshooting#claude-tag-is-turned-off-for-your-organization).
### If the console says "already connected to a different organization"
A Slack workspace can pair with only one Claude organization at a time, and this one is already paired elsewhere. An Owner in the Claude organization that currently holds the pairing must [disconnect it](/docs/claude-tag/admins/workspaces#revoke-a-pairing) from their **Connected workspaces** list before your code can be redeemed here. If your company has more than one Claude organization, check the others; the existing pairing is often in a test or trial org.
### If the console says "claim code is invalid, expired, or already used"
Pairing codes are single-use and expire 15 minutes after they're issued. Ask the Slack admin to send `@Claude connect` again and paste the fresh code; reinstalling the app is not required. On Enterprise Grid, a Grid org admin's reply includes a Grid-wide code (starting with `enterprise_`) alongside the workspace code (starting with `workspace_`).
### If DMs never respond on Enterprise Grid
On Enterprise Grid, direct messages with Claude follow each user's home workspace, not the workspace you paired. When a user is homed in a grid workspace the pairing doesn't cover, their DMs answer with a redirect to setup instructions even after their account connects, while channels in the paired workspace work normally.
The fix is to pair the whole grid rather than one workspace. Claude's reply to a Grid Org Owner or Org Admin's `@Claude connect` includes two codes; redeem the one starting with `enterprise_` (not the `workspace_` one) in the pairing step to cover DMs for users in every workspace of the grid.
## After pairing: where Claude is enabled
Once a workspace is paired, where Claude responds depends on what you chose when pairing (entire workspace or specific channels), the **Enable Claude Tag for your organization** toggle, and your [access restriction](/docs/claude-tag/admins/restrict-access#members) setting.
* **What Claude can reach** in each channel depends on which Access bundles you bind; see [Configure per-channel access](/docs/claude-tag/admins/attach-to-scope).
* **Nothing runs until usage is funded** on Team plans; see [Set a spend limit](/docs/claude-tag/admins/set-spend-limit).
* **DMs work separately** from channels and run on each user's own claude.ai account. On Enterprise Grid, DMs follow each user's home workspace; see [If DMs never respond on Enterprise Grid](#if-dms-never-respond-on-enterprise-grid).
## Related resources
* [Give Claude access](/docs/claude-tag/admins/add-connections): create an Access bundle and add connections
* [What the Claude Slack app can access](/docs/claude-tag/admins/for-slack-admins): the page to send a Slack admin who's approving the install
claude-tag/admins/restrict-access First recorded · 185 lines, first recorded
# Restrict where Claude Tag operates ## Control who can invoke Claude Tag ### Restrict who can use Claude #### Restrict by role on Enterprise ## Control where Claude Tag operates ### Quiet or remove Claude Tag ### Limit Claude Tag to specific channels ### Restrict guest channels ### Externally shared channels ### Channels shared across workspaces in your Enterprise Grid ### Migrate from the earlier Claude in Slack ### Allow or disable direct messages ### Set spend limits ## Permissions by role ## Controls that aren't available ## Related resources
The first capture of this source. The page was already there, and this is what it said.
# Restrict where Claude Tag operates
> Claude Tag responds only where it has been added and addressed. See who can invoke it, guest and externally shared channel limits, the per-scope version setting, how to limit it to chosen channels, and how to quiet or remove it.
export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
<BetaNote />
In channels, Claude Tag responds only where it's been added and addressed, and the controls on this page narrow that further. DMs are a separate surface that runs on the user's own account; see [how DMs differ from channels](/docs/claude-tag/concepts/agent-identity#direct-message-channels).
<Note>Most controls on this page require the Owner role in your Claude organization; the [permissions table](#permissions-by-role) below lists which actions an Admin or a channel member can take.</Note>
## Control who can invoke Claude Tag
In channels where the app has been added, an @-mention guarantees a response; Claude may also respond to a message that doesn't mention it when it judges a reply is warranted, and once a thread is active it follows replies in that thread. By default, anyone in such a channel can address it. A single toggle narrows that to people in your Claude organization.
<a id="members" />
### Restrict who can use Claude
Open **Manage** on the Slack entry under **Where Claude Tag works** at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag). The dialog shows a toggle that controls who in your Slack workspace can use Claude at all; its label depends on your plan. You must be an Owner of your Claude organization to change it.
| Plan | Toggle | Off (default) | On |
| :--------- | :----------------------------------------- | :------------------------------------------------------------------------------------ | :----------------------------------------------------------------------------------- |
| Enterprise | **Restrict in your organization via RBAC** | Anyone in the connected Slack workspace can use Claude, even without a Claude account | Only members whose role grants the **Claude Tag in Slack** capability can use Claude |
| Team | **Restrict to your organization** | Anyone in the connected Slack workspace can use Claude, even without a Claude account | Only Slack users with a Claude account in your organization can use Claude |
The toggle applies to channels and DMs alike.
<Info>
You may see the earlier three-option **Members** dropdown instead of the toggle. The dialog keeps the dropdown while your organization's stored choice matches neither toggle state. That happens for an Enterprise organization that previously chose **Open to any organization member** (now marked deprecated), and for a Team organization still restricted by role from an earlier Enterprise plan. Switch to one of the toggle's two states. The dropdown is then replaced by the toggle, and the deprecated option is no longer offered.
</Info>
#### Restrict by role on Enterprise
Role restriction requires an Enterprise plan. Team plans don't have role-level control; turning on **Restrict to your organization** is the only restriction available there.
Restricting by role spans three console pages.
1. On [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), turn on **Restrict in your organization via RBAC**.
2. On [`claude.ai/admin-settings/groups`](https://claude.ai/admin-settings/groups), create groups and add the relevant members.
3. On [`claude.ai/admin-settings/roles`](https://claude.ai/admin-settings/roles), create a custom role with the **Claude Tag in Slack** capability turned on or off, and choose which groups hold the role in the role editor.
Three rules govern how role restrictions resolve.
* **The toggle gates the capability.** The **Claude Tag in Slack** capability on a role has no effect until **Restrict in your organization via RBAC** is on. While the toggle is off, every member can use Claude regardless of what their role grants.
* **Built-in roles always grant access.** Every built-in role, including User, Owner, and Primary owner, grants **Claude Tag in Slack** automatically, so the restriction only blocks members on a custom role that doesn't grant it.
* **Any grant wins.** A member in more than one group keeps access if any of their roles grants it.
A member whose roles don't grant the capability is excluded everywhere Claude works, in three ways:
* **@-mentions and DMs get a private notice.** Claude doesn't act on the request. The member sees a notice only they can see, saying their role doesn't allow Claude Tag and to ask their admin for access.
* **Automatic replies skip them.** In channels where Claude responds without being tagged, a restricted member's messages never trigger a response.
* **Their thread replies aren't read.** In a thread an allowed member started, a restricted member's replies don't reach Claude as content. Claude sees that a message arrived, but the message body is withheld.
<Warning>On a Slack Enterprise Grid whose workspaces are paired to different Claude organizations, one organization's access settings govern the entire grid, so your restrictions may not be enforced in your own workspaces.</Warning>
## Control where Claude Tag operates
The restriction toggle decides who can use Claude. The controls in this section decide where it works at all, from one channel up to a workspace, and which generation answers in each scope (a scope is a channel, a workspace, or your whole organization).
### Quiet or remove Claude Tag
Six ways to stop Claude Tag from responding, ordered from quietest to most complete:
1. **Ask it to stay quiet.** Saying "stay quiet in this thread unless tagged" stops Claude following an active thread.
2. **Remove it from the channel.** Run `/remove @Claude`. It can no longer read or post there.
3. **Set the scope's Claude Tag version to Off.** Claude stops responding in that scope even if someone invites it back; an @-mention gets a disabled notice instead of a reply. The control is on the scope's panel at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), and only an Owner can change it.
4. **Detach the scope.** The channel loses its elevated access and falls back to inherited baselines.
5. **Delete the bundle.** This revokes its credentials everywhere it was attached (the credentials are removed; memory, routines, and transcripts are not). Running sessions may keep a revoked credential for a short window before the change propagates.
6. **Uninstall the app.** This removes Claude from the workspace entirely.
Steps 1–4 and 6 do not delete any data. Step 5 (deleting a bundle) removes the credentials in that bundle; memory, routines, and session transcripts are unaffected by any of these steps. Removing Claude from a channel stops it responding there; the channel's memory and routines remain on record, and re-adding it restores them. Credentials are stored in Access bundles on the claude.ai side and persist independently of the Slack app installation. To delete data, use the dedicated controls at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag) rather than removal alone.
### Limit Claude Tag to specific channels
To let Claude respond only in channels you choose, for example during a pilot confined to one channel, turn the [version setting](/docs/claude-tag/admins/workspaces#set-the-version-for-a-scope) **Off** everywhere and switch the chosen channels back to **New**. Both changes happen in the **Claude Tag's access** section at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag). DMs, guest channels, and shared channels need more than the version setting; each gets its own treatment after the steps.
<Note>**Off** silences the earlier Claude in Slack too. If you're in the middle of migrating from the earlier app, decide which scopes stay on **Legacy** before you start; the earlier app keeps answering in those channels.</Note>
<Steps>
<Step title="Turn Claude Tag off everywhere">
Set the **Claude Tag version** on [**Default Slack access**](/docs/claude-tag/admins/attach-to-scope) to **Off**. Then set any workspace or channel scope whose version is something other than **Inherit** to **Off** or **Inherit** too, leaving alone the scopes you're keeping on **Legacy**.
</Step>
<Step title="Switch the chosen channels back on">
Set each chosen channel's version to **New**. A channel's own setting wins over the **Off** above it, so Claude responds in the chosen channels and nowhere else. Channels Claude was added to already appear in the **Claude Tag's access** section, and the version control is on each channel scope's panel; use **Search channels** to find each one. For a channel that isn't listed, create a scope with **Add channel** as described in [Attach to a channel](/docs/claude-tag/admins/attach-to-scope#attach-to-a-channel).
</Step>
</Steps>
If someone invites the app into another channel afterward, Claude stays silent there. Mentioning `@Claude` in that channel gets a notice that Claude is disabled in the channel, not a reply.
DMs, guest channels, and shared channels sit outside the version setting:
* **DMs.** The version setting doesn't cover them. To close those off too, turn off [Allow direct messages](#allow-or-disable-direct-messages).
* **Guest channels.** By default Claude is off in any channel that includes a Slack guest. If a chosen channel has guests, also set [Allow Claude to respond to guests](#restrict-guest-channels) to **Allow** on its scope.
* **Shared channels.** A [channel shared across workspaces in your Enterprise Grid](#channels-shared-across-workspaces-in-your-enterprise-grid) takes its settings from **Default Slack access** only, and Claude [doesn't operate in Slack Connect channels](#externally-shared-channels) at all; neither can serve as a chosen channel.
To control who can use Claude in the allowed channels, turn on the [restriction toggle](#restrict-who-can-use-claude); to cap what a channel spends, [set a per-channel spend limit](#set-spend-limits).
### Restrict guest channels
By default, Claude is disabled in any channel that includes a Slack guest. To allow it there, set **Allow Claude to respond to guests** to **Allow** for the scope covering the channel; **Restrict** (the default) keeps it off wherever a guest is present. The setting is at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), on the **Slack** tab under **Claude Tag's access**, in the scope's collapsed **Advanced** section.
**Allow** applies to every guest channel the scope covers, and guests in those channels can see Claude's replies and interact with it. To open one channel rather than a whole workspace, set it on the channel's own scope.
**Allow** controls whether Claude replies, not what it can search. Workspace search is unavailable in any channel that includes a guest, even when the setting is **Allow**. Search results could include content from channels the guests can't see, the same reason Claude doesn't search private channels. To run a search that covers the workspace, ask from a channel without guests.
### Externally shared channels
Claude doesn't operate in Slack Connect channels, the ones shared with another company. It's off in those channels regardless of scope or bundle, and this isn't configurable.
### Channels shared across workspaces in your Enterprise Grid
What happens in a channel shared across more than one workspace inside your Enterprise Grid depends on whether every workspace in it is connected to the same Claude organization.
When the workspaces all belong to your one Claude organization, Claude replies in the channel, but only with the access and settings on your organization's [Default Slack access](/docs/claude-tag/admins/attach-to-scope) scope. Bundles, instructions, and memory set on a workspace or on that channel don't reach it. Claude posts a notice in the thread explaining this, about once a month per channel at most rather than on every reply. Where guest access is at its default **Restrict**, the [guest check](#restrict-guest-channels) still runs first and can refuse the reply.
When the workspaces belong to different Claude organizations, each with its own settings and plan, Claude won't reply and posts a refusal message instead.
There is no per-channel override for either case.
### Migrate from the earlier Claude in Slack
If your organization used the earlier Claude in Slack app, you choose which generation answers `@Claude` per scope. The control is the **Claude Tag version** setting on each workspace or channel scope at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), with the choices **Off**, **Legacy**, **New**, and **Inherit**, plus the **Claude Tag version** row on the **Default Slack access** scope above them.
Both generations answer through the same @Claude app, so **Off** turns off both. To opt out of Claude Tag but keep the earlier app answering in a scope, choose **Legacy**.
Access bundles only apply where the New version answers. The [glossary](/docs/claude-tag/concepts/glossary#the-earlier-claude-in-slack) covers how the two differ.
### Allow or disable direct messages
The **Allow direct messages** toggle controls whether members can message Claude directly. When it's off, Claude is reachable only in channels. The default is on, and you must be an Owner of your Claude organization to change it.
On [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), the toggle appears in one of two places: directly on the Claude Tag settings page, or in the **Manage** dialog on the Slack entry under **Where Claude Tag works**, where the toggle is labeled **Allow direct messages with Claude**. If your organization still uses the earlier Claude in Slack settings page at [`claude.ai/admin-settings/claude-in-slack`](https://claude.ai/admin-settings/claude-in-slack), the toggle appears there too. It's the same setting in each place, so change it wherever it appears for your organization.
### Set spend limits
Spend limits and usage analytics live at [`claude.ai/admin-settings/usage/claude-tag`](https://claude.ai/admin-settings/usage/claude-tag), a different page than the main Claude Tag settings.
A spend limit is a cap on how much of your organization's usage balance Claude Tag can draw each billing period. Setting a limit doesn't fund the balance; on a Team plan, [fund the usage balance first](/docs/claude-tag/admins/set-spend-limit) or Claude won't respond in channels regardless of the limit.
* **Organization-wide limit.** Caps total Claude Tag spend across every channel.
* **Default spend limit.** A default limit applied to each channel that doesn't have its own.
* **Per-channel limits.** Set on any channel from its row in the per-channel spend table, in addition to the organization limit. A channel doesn't need its own scope to take a limit.
* **Usage analytics.** Per-channel spend breakdown on the same page.
Work that would exceed a limit is declined rather than silently truncated. A user blocked by a limit can request more usage from their admin in Slack, and the admin notification names whether the usage balance or the limit caused the block.
## Permissions by role
Creating bundles, binding them to scopes, and pairing workspaces need an Owner; an Admin can edit a bundle's Credentials and Domains tabs but not its other tabs. Everything else happens inside the channel and is open to its members. The table lists each action and who can take it.
| Action | Owner | Admin | Channel member |
| :--------------------------------------------------------- | :------------------ | :------------------ | :--------------------------------------------------------------------------------------------------------------------------------------------- |
| Pair a workspace | Yes | No | No |
| Create, rename, delete, or bind an Access bundle | Yes | No (view only) | No |
| Edit a bundle's Repositories, Plugins, or Instructions tab | Yes | No (view only) | No |
| Edit a bundle's Credentials or Domains tab | Yes | Yes | No |
| Write channel memory | Yes, in the channel | Yes, in the channel | Yes |
| Set channel instructions from the Configure link | Yes | Yes | Yes, unless the scope's [Channel member edits](/docs/claude-tag/admins/attach-to-scope#restrict-who-can-set-channel-instructions) setting blocks it |
| Create, list, or disable a scheduled job in the channel | Yes, in the channel | Yes, in the channel | Yes |
| Remove Claude from a channel | Yes | Yes | Yes, with `/remove`, unless your Slack admin restricts it |
Scheduled jobs run with the channel's credentials, so a member creating one can't reach anything the channel itself can't.
## Controls that aren't available
These are controls an admin might look for that Claude Tag doesn't have.
* **Third-party deployment.** Sessions run on Anthropic's first-party infrastructure; Claude Tag isn't available through third-party deployments.
* **Renaming or rebranding the app.** The Claude app's name, @-handle, and avatar in Slack are fixed; there is no per-workspace rename setting.
* **A pre-invite channel blocklist.** Once the app is installed in a workspace, anyone can `/invite @Claude` into a public channel; there's no list that prevents the invite itself. To keep Claude out of a channel after the fact, [set that scope's Claude Tag version to Off](#quiet-or-remove-claude-tag). To confine Claude to chosen channels instead, see [Limit Claude Tag to specific channels](#limit-claude-tag-to-specific-channels).
* **Per-user spend caps on channel work.** Spend limits apply at the organization and channel level. There's no way to cap what one member can spend in channels; DM usage bills to that member's own seat and follows the seat's usual limits.
* **Per-channel responder allowlist.** The restriction toggle governs who can invoke Claude across the workspace; you can't narrow it to a list of people for one channel only.
* **An open-internet switch in Claude Tag settings.** A channel sandbox reaches only allowed hosts. To let Claude reach a public site or API, an Owner or Admin adds that hostname on a [bundle's Domains tab](/docs/claude-tag/admins/add-connections#allow-a-host-without-a-credential); for broad web access, they pin an [environment](/docs/claude-tag/concepts/glossary#environment) whose network access level is Full access on the scope. [Allow-all egress](/docs/claude-tag/admins/add-connections#allow-all-hosts), a `*` entry on the Domains tab, is off by default and enabled per organization by Anthropic.
* **A web search toggle for channels.** No setting turns web search off for channel sessions; the web search capability setting in claude.ai admin settings governs claude.ai chat, not channels. Web search runs on Anthropic's servers rather than from the channel sandbox, so Domains entries and egress settings don't govern it, and a search opens no new path out of the sandbox; search requests travel to Anthropic the same way the session's model traffic already does. See [Web search vs. network requests](/docs/claude-tag/concepts/agent-identity#web-search-vs-network-requests).
* **Read-scope confinement.** Claude can search public channels by keyword the same way any Slack user can; it can't read a channel's full history unless it's been added there. There's no setting to disable workspace search, and no setting to enable it in [channels that include guests](#restrict-guest-channels), where search is unavailable.
* **Session length enforcement.** Your organization's Slack session-length policy is not enforced on this surface.
## Related resources
* [Configure per-channel access](/docs/claude-tag/admins/attach-to-scope): change the scopes these controls apply to
* [How agent identity works](/docs/claude-tag/concepts/agent-identity): the model these controls operate on
* [Security and data handling](/docs/claude-tag/concepts/security-and-data): what these controls don't cover (data flow, retention, where credentials are stored)
claude-tag/admins/set-spend-limit First recorded · 80 lines, first recorded
# Set a spend limit ## Whether this step is required depends on your plan ## Set the spend limit ## What happens when the spend limit is reached ### Rate limits versus the spend limit ## Per-channel limits ## Attribute costs by channel ## Related resources
The first capture of this source. The page was already there, and this is what it said.
# Set a spend limit
> Claude Tag draws from your organization's usage balance, not individual seats. See whether you need to fund usage, how to set the spend limit, and what happens when it's reached.
export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
<BetaNote />
<div className="tm-stepbar">
<a className="tm-stepbar-seg tm-done" href="/docs/docs/claude-tag/admins/pair-workspace">1 · Pair workspace</a>
<a className="tm-stepbar-seg tm-done" href="/docs/docs/claude-tag/admins/add-connections">2 · Give access</a>
<a className="tm-stepbar-seg tm-current" href="/docs/docs/claude-tag/admins/set-spend-limit">3 · Spend limit</a>
<a className="tm-stepbar-seg" href="/docs/docs/claude-tag/admins/test-it">4 · See it work</a>
</div>
Work Claude does in channels bills to your **organization's usage balance**, not to individual seats. The **spend limit** is a cap you set on how much of that balance Claude Tag can use each billing period.
| Work | Bills to | Capped by |
| :--------------- | :-------------------------------- | :-------------------------------------------------------------------------------------------------- |
| Channel work | Your organization's usage balance | The spend limit, plus any [per-channel limits](/docs/claude-tag/admins/restrict-access#set-spend-limits) |
| A DM with Claude | The sender's own seat | The seat's usual limits, not the spend limit |
## Whether this step is required depends on your plan
| Your plan | What you need to do here |
| :------------------------ | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Team** | **Required, before anything runs.** A Team plan has no usage balance until it's funded, and Claude won't respond in channels until it is. A [launch usage credit](https://support.claude.com/en/articles/15575654-claude-tag-launch-promo-for-claude-team-and-enterprise) counts as a funded balance, so check for one before buying credits. Then set a spend limit. |
| **Enterprise (invoiced)** | **Recommended.** Usage bills to your invoice with no upper bound until you set a spend limit. Set one to cap exposure during the pilot. |
## Set the spend limit
If your organization bills through a reseller, this page is not available and these steps don't apply; your organization's usage is funded through the reseller instead.
<Steps>
<Step title="Open the usage page">
Go to [`claude.ai/admin-settings/usage/claude-tag`](https://claude.ai/admin-settings/usage/claude-tag).
</Step>
<Step title="Enter an amount">
Enter an amount in your organization's billing currency. The spend limit resets at the start of each billing period and applies across every paired workspace. You can change it any time.
</Step>
</Steps>
There's no published per-task cost guidance. For a pilot, set a spend limit you're comfortable with for the first billing period, then watch the per-channel usage breakdown on the same page and adjust.
## What happens when the spend limit is reached
When usage reaches the spend limit, Claude stops and tells the requester in the thread that it couldn't finish. The requester can ask an admin to raise the limit.
The spend limit counts usage at list price. If your organization has a negotiated discount, that discount applies at invoice time, not to the cap.
### Rate limits versus the spend limit
The spend limit caps how much your organization is charged. It doesn't change how fast Claude can work. Claude Tag also applies its own throughput limits on how quickly threads can be started and messages delivered, and an organization with many busy channels can hit one while the spend limit still has plenty of room.
When that happens, Claude tells the requester in the thread that it hit a rate limit and names a short wait, usually a few seconds. Re-send the message after the wait. Raising the spend limit doesn't clear a rate limit, and a rate-limited request doesn't spend anything.
| Claude says | Limit reached | What to do |
| :--------------------------------------------------------------------- | :--------------- | :------------------------------------------------------------------------------------------------------------------- |
| The spend limit is reached | Spend limit | Raise it on the usage page above |
| It hit the session rate limit, or is rate limited delivering a message | Throughput limit | Wait the few seconds the reply names, then re-send. If your organization hits this often, contact your account team. |
## Per-channel limits
Per-channel limits and the per-channel spend breakdown are on the same usage page. See [Set spend limits](/docs/claude-tag/admins/restrict-access#set-spend-limits) for the full set of controls.
## Attribute costs by channel
Channel work can't be attributed to individual users. It bills to your organization's usage balance, not to any user's seat, and often has no single requesting user (several people contribute to one thread, and scheduled jobs run without anyone asking). The channel is the unit you can attribute.
The usage page at [`claude.ai/admin-settings/usage/claude-tag`](https://claude.ai/admin-settings/usage/claude-tag) shows spend broken down by channel.
To attribute spend to teams or departments for showback or chargeback reporting, structure channels so each maps to one team or department, and give those channels [their own scopes](/docs/claude-tag/admins/attach-to-scope). The per-channel breakdown then reads as your per-team report, and per-channel spend limits act as team-level budgets.
DMs are separate. A DM bills to the sender's own seat, not to the organization's usage balance.
## Related resources
* [See it work](/docs/claude-tag/admins/test-it): run a first task in the pilot channel
* [Restrict where Claude Tag operates](/docs/claude-tag/admins/restrict-access#set-spend-limits): per-channel limits and the usage page in full
claude-tag/admins/setup-overview First recorded · 198 lines, first recorded
# Set up Claude Tag ## Before you start ## Setup steps ### Pair your Slack workspace ### Choose Claude's first tools ### Connect GitHub ### Create accounts for the tools you chose ### Launch Claude Tag ## Change a setting after setup ## Test that setup worked ## After setup ## Common setup issues ## Related resources
The first capture of this source. The page was already there, and this is what it said.
# Set up Claude Tag
> Set up Claude Tag for your organization: pair your Slack workspace, give Claude access to your tools, set a spending limit, and launch. See prerequisites and each step in detail.
export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
<BetaNote />
Claude Tag is Claude working in your team's Slack channels, with its own accounts in your tools.
Open [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag). The page opens on setup until your first workspace is paired. It shows a step list, an FAQ, and a **Start setup** button (**Resume setup** if you started earlier without finishing). If you see **View setup guide** and **Go to chat** buttons instead, your signed-in account can't run setup; start at [Common setup issues](#common-setup-issues). Setup walks you through each step:
* **[Pair your Slack workspace](#pair-your-slack-workspace)**: install the Slack app and link it with a pairing code
* **[Choose Claude's first tools](#choose-claude%E2%80%99s-first-tools)**: pick two apps Claude will work in
* **[Connect GitHub](#connect-github)**: install the Claude GitHub App, or grant repositories if it's already linked
* **[Create accounts for Claude's other tools](#create-accounts-for-the-tools-you-chose)**: give Claude its own account in each tool you picked and connect the credentials
* **[Launch Claude Tag](#launch-claude-tag)**: set a spending limit and turn on Claude Tag
The rest of this page covers [what to have ready before you start](#before-you-start), [each step in detail](#setup-steps), and [common setup issues](#common-setup-issues).
<Note>If your team already uses the earlier Claude in Slack, the same steps apply and your existing app stays; see [Migrate from the earlier app](/docs/claude-tag/admins/migrate-from-earlier) for what changes.</Note>
## Before you start
| Prerequisite | Why you need it | If you don't have it |
| :------------------------------------------------------------------------ | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| A **Team or Enterprise plan** on claude.ai | Claude Tag is available on Team and Enterprise plans, on Anthropic's first-party service. It isn't available on individual plans (Free, Pro, or Max), or for third-party deployments. | Start a Team or Enterprise plan at [claude.com/pricing](https://claude.com/pricing) |
| A Claude organization **without Zero Data Retention (ZDR)** | Claude Tag stores channel memory and session transcripts, which ZDR doesn't permit. | Claude Tag isn't available to ZDR organizations |
| **Routines** enabled for your Claude organization | Claude Tag requires Routines to be enabled for your organization. Until it is, Claude answers every mention and DM with a reply that it's unavailable and does no work. | An admin enables Routines at [`claude.ai/admin-settings/claude-code`](https://claude.ai/admin-settings/claude-code) |
| **Owner** role in the Claude organization you're setting up | Pairing a workspace and creating Access bundles are Owner-only writes; an Admin can view settings but not complete setup. Roles are per organization, so being an Owner elsewhere doesn't carry over. | Ask an Owner to run setup, or have one promote you at [`claude.ai/admin-settings/members`](https://claude.ai/admin-settings/members) |
| A **Slack workspace admin** | Running `@Claude connect` requires a Slack workspace admin; installing the app usually does too (most workspaces require admin approval for new apps) | If that's someone else, [send them the install request](/docs/claude-tag/admins/pair-workspace#send-the-install-request-to-your-slack-admin) early (app approval can take time), and plan to be online together when you [pair your Slack workspace](#pair-your-slack-workspace); pairing codes expire 15 minutes after they're issued |
| **Usage credits** (Team plans) | Channel work draws from your organization's usage balance; on a Team plan nothing runs until credits are loaded | Check whether your organization has a [launch usage credit](https://support.claude.com/en/articles/15575654-claude-tag-launch-promo-for-claude-team-and-enterprise) before buying; otherwise, buy credits at [`claude.ai/admin-settings/usage`](https://claude.ai/admin-settings/usage) |
| *(Optional)* The **Claude GitHub App** linked to your Claude organization | Linking GitHub before you start turns setup's GitHub step into repository selection, so you can grant repositories there instead of installing the app mid-setup | [Link your GitHub organization](/docs/claude-tag/admins/configure-github#link-your-github-organization) first, or grant repository access after setup |
| *(Optional)* A **channel to test in** | You'll invite Claude to a channel to [test](#test-that-setup-worked) that setup worked | Create a private Slack channel for the pilot, or pick any existing one |
If any of your services restrict traffic by IP, file the [network requirements](/docs/claude-tag/admins/network-requirements) request with your network team early; in many organizations, IP allowlist changes take days to approve.
## Setup steps
All steps run on one page. Everything you set is saved automatically, so you can leave and resume setup later. Each section below shows what you'll see and what to do.
### Pair your Slack workspace
A Slack workspace is your team's space in Slack, at an address like `your-team.slack.com`; it contains all your channels. Pairing links one workspace to your Claude organization so `@Claude` can run in its channels and usage bills to your organization.
This step shows four numbered substeps. The code is created in Slack and redeemed back on this setup page:
<Steps>
<Step title="Add the Claude app to Slack">
Click **Add the Claude app** to open the Slack Marketplace listing, then click **Add to Slack** there and approve the permissions.
</Step>
<Step title="Send `@Claude connect` as a new channel message">
Copy the message shown and send it in any channel of the workspace you just installed in, with no other text, as a new top-level message or in a thread where Claude isn't already working. Claude replies with a pairing code valid for 15 minutes.
Pick a channel that belongs to just that workspace. Claude can decline to reply in [guest and shared channels](/docs/claude-tag/admins/troubleshooting#guest-and-shared-channels).
Only a Slack workspace admin (or Grid org admin) can run `@Claude connect`; anyone else gets a message naming who to ask. If that's not you, [send them the install request](/docs/claude-tag/admins/pair-workspace#send-the-install-request-to-your-slack-admin) and have them return the code.
</Step>
<Step title="Paste the pairing code">
Back on the setup page, paste the code into the input field (the placeholder reads `workspace_…`).
</Step>
<Step title="Choose where Claude runs">
Under **Choose where Claude can reply when tagged**, select **Entire workspace (recommended)** or **Specific channel** (which asks for channel IDs).
</Step>
</Steps>
Click **Pair workspace**. A confirmation screen shows the pairing worked; select **Next: Choose Claude's tools**.
See [Pair your Slack workspace](/docs/claude-tag/admins/pair-workspace) for the Slack-admin handoff template, what to do if `@Claude connect` fails, and pairing on Enterprise Grid.
### Choose Claude's first tools
Claude works in your tools with its own accounts, so everything it does is recorded under its own name. On this step you pick those tools; connecting them happens in a [later step](#create-accounts-for-the-tools-you-chose).
GitHub isn't in the list. You connect it in the [next step](#connect-github). The list suggests widely used tools; check the ones your team works in, or use **Search all tools** for a service that isn't shown. Pick two to unlock **Next: Connect GitHub**. You can add more at any time.
You can skip connecting the tools you pick and finish that after setup. Without any connected tools, Claude still works in Slack conversations and can use web search and a [default set of network hosts](/docs/claude-tag/admins/add-connections#allow-a-host-without-a-credential); it can't act in a tool until that tool is connected.
See [Give Claude access](/docs/claude-tag/admins/add-connections) for which services to connect first, and the [per-service connection guides](/docs/claude-tag/admins/connections/overview) for credential fields per tool.
### Connect GitHub
GitHub is managed through the Claude GitHub App rather than a credential, so it has its own step. What the step shows depends on whether the app is already linked to your Claude organization.
* **Not linked yet**: the step walks through installing the Claude GitHub App, with a message you can copy for the GitHub organization owner if that isn't you.
* **Already linked**: the step is titled **Choose your GitHub repos** and lists each installation, so you can grant every repository or only specific ones.
These grants apply to every channel Claude is in. You can [add repositories to specific channels later](/docs/claude-tag/admins/attach-to-scope), or skip this step and [configure GitHub access](/docs/claude-tag/admins/configure-github) after setup instead.
### Create accounts for the tools you chose
Claude needs its own account in each tool you picked, so you can always see what it did and limit what it reaches. [How agent identity works](/docs/claude-tag/concepts/agent-identity) explains this model.
<Steps>
<Step title="Set up an email for Claude">
Create an address like `[email protected]` with your email provider. Some tools support service accounts (tool-managed identities that don't need an email) instead.
</Step>
<Step title="Invite Claude to each tool">
In each tool you picked, create an account for that address, the same way you would for a new team member.
</Step>
<Step title="Connect each tool with Claude's credentials">
Each tool you picked is listed. Click **Connect** and enter the credential for the account you created (not your personal login).
</Step>
</Steps>
To finish this step later, select **Skip** and confirm past the warning that Claude won't be able to act in the unconnected tools.
See [Give Claude access](/docs/claude-tag/admins/add-connections) for how to create the accounts and what access to give them.
### Launch Claude Tag
Channel work draws from your organization's usage balance, not from individual seats; the spend limit you set here caps how much of that balance Claude Tag can use each billing period. (DMs run on the user's own claude.ai account and aren't capped by this limit.)
<Steps>
<Step title="Set monthly spend limits">
Choose from `$500`, `$1,000`, `$2,500` (the default), `$5,000`, **Unlimited**, or **Custom** (a US-dollar amount up to `$1,000,000`).
</Step>
<Step title="Let members know they can now tag Claude">
Choose whether Claude sends a DM to everyone in your Slack workspace after launch.
</Step>
<Step title="Click Launch Claude Tag">
Claude Tag turns on, and a confirmation screen summarizes what's connected. Claude is now reachable in the workspace you paired.
</Step>
</Steps>
To leave setup without turning Claude Tag on, select **Finish later**; everything you've set is saved, and the admin page shows a resume card that brings you back to where you left off.
If your organization buys usage credits by card in US dollars and has none loaded, a **Buy usage credits** step appears before launch instead of the spend limit picker; load credits, or select **Skip** to continue without. Invoiced organizations and those billing in other currencies get the spend limit picker regardless of balance.
See [Set a spend limit](/docs/claude-tag/admins/set-spend-limit) for what counts toward the cap, per-channel limits, and what users see when it's reached.
## Change a setting after setup
Everything you set during setup can be changed afterward on the [Claude Tag admin page](https://claude.ai/admin-settings/claude-tag).
| To change | Go to |
| :------------------------------------------------------------------------------ | :------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Pair another workspace, or disconnect one | The Slack row's **⋮** menu under **Where Claude Tag works** (**Disconnect** is under **Manage**); see [Manage workspaces](/docs/claude-tag/admins/workspaces) |
| The Access bundle's name, connections, domains, repos, plugins, or instructions | **Access bundles** in the left navigation, or any scope's panel on the **Slack** tab; see [Give Claude access](/docs/claude-tag/admins/add-connections) |
| The spending limit | [`claude.ai/admin-settings/usage/claude-tag`](https://claude.ai/admin-settings/usage/claude-tag); see [Set a spend limit](/docs/claude-tag/admins/set-spend-limit) |
| Whether Claude Tag is enabled at all | The **Enable Claude Tag for your organization** toggle at the top of the admin page |
## Test that setup worked
In Slack, in your pilot channel, run `/invite @Claude` and then `@Claude summarize this channel`.
An *is thinking…* status under your message means the app is installed and listening. A reply means the workspace is paired and the channel is on the new version. This task doesn't touch any connection, so it isolates pairing from credential issues.
The [See it work](/docs/claude-tag/admins/test-it) page has more prompts that run with no connections, and a per-connection test that proves each credential works.
## After setup
After your test passes, you can DM Claude in Slack with setup questions. These guides cover what's not part of initial setup:
| Guide | Do this when |
| :-------------------------------------------------------------------------------------------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------- |
| [Give Claude access](/docs/claude-tag/admins/add-connections) | You skipped connections during setup, or a team needs another tool connected |
| [Allow a host without a credential](/docs/claude-tag/admins/add-connections#allow-a-host-without-a-credential) | Claude reports a blocked host, or a channel needs to reach a site or API that doesn't take a credential |
| [Configure per-channel access](/docs/claude-tag/admins/attach-to-scope) | One channel needs more (or different) access than the default. Keep elevated credentials in private-channel scopes; the org baseline stays minimal. |
| [Configure GitHub access](/docs/claude-tag/admins/configure-github) | You didn't grant repository access during setup, or you need to add more repositories |
| [Restrict where Claude operates](/docs/claude-tag/admins/restrict-access) | Governance review: guest channels, member access, DM policy |
| [Customize](/docs/claude-tag/admins/customize) | Standing instructions, plugins, and what channel members can change |
There are two common ways to roll out from here:
| Pattern | What you do | What channel members experience |
| :----------------------- | :------------------------------------------------------------- | :--------------------------------------------------------------------------------------------- |
| Pilot first | One bundle on one workspace or channel; widen after validating | Claude appears in a few channels first, with capability growing as scopes are attached |
| Single bundle everywhere | One broad bundle at organization defaults | Every channel gets the same capability on day one. Fits orgs that already grant tools broadly. |
## Common setup issues
| You expected | But got | Do this |
| :----------------------------------------------------------------------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------ | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| The setup page at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag) | A page titled **Set up Claude Tag** with **View setup guide** and **Go to chat** buttons | Your signed-in account can't run setup, and **View setup guide** leads back to this guide. On a personal account (Free, Pro, or Max), [start a Team or Enterprise plan](https://claude.com/pricing) first. In a Team or Enterprise organization, ask an Owner to run setup. When the page shows a workspace switcher, your account also belongs to another Team or Enterprise organization; switch to it and retry. |
| A pairing code from `@Claude connect` | “Only Slack workspace admins (or Enterprise Grid org admins) can link this workspace to a Claude organization…” | The person who sent `@Claude connect` isn't a Slack workspace admin (or Grid org admin). [Send the request](/docs/claude-tag/admins/pair-workspace#send-the-install-request-to-your-slack-admin) to someone who is. |
| A pairing code | “…installation is out of date” | The app was updated with permissions your workspace hasn't approved yet. A Slack admin approves the update or reinstalls the app, then sends `@Claude connect` again. See [both remedies](/docs/claude-tag/admins/pair-workspace#if-@claude-connect-says-the-installation-is-out-of-date). |
| The Slack row under **Where Claude Tag works** to show your workspace as connected | It still shows **Not connected** | The code may have expired (codes last 15 minutes) or come from a different workspace. Send `@Claude connect` again for a fresh code. |
| A pairing code | A message about guests, or about the channel being shared across workspaces | Send `@Claude connect` again in a channel with no guests that belongs to a single workspace. Match the exact message in [Guest and shared channels](/docs/claude-tag/admins/troubleshooting#guest-and-shared-channels) for the fix that fits it. |
| A connected tool to work in your test | “I can't reach…” | Claude isn't told about a connection added after the thread started. Ask it to use the service by name, or start a fresh thread. |
| The **Where Claude Tag works** section with a **+ Connect** button | Only the legacy Claude in Slack toggles | Your organization isn't enabled for Claude Tag. Contact your account team. |
| Claude to respond in Slack | "Claude Tag has been turned off for your Claude organization…" | The **Enable Claude Tag for your organization** toggle is off. An Owner turns it on at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag). See [the troubleshooting entry](/docs/claude-tag/admins/troubleshooting#claude-tag-is-turned-off-for-your-organization). |
| Claude to respond in Slack | "Claude Tag is unavailable because Routines aren't enabled for your organization…" | Routines isn't enabled for your Claude organization, which Claude Tag requires. An admin enables Routines at [`claude.ai/admin-settings/claude-code`](https://claude.ai/admin-settings/claude-code), then anyone can mention `@Claude` again. See [the troubleshooting entry](/docs/claude-tag/admins/troubleshooting#claude-tag-is-unavailable-because-routines-are-not-enabled). |
| Claude to respond in Slack | "Claude in Slack is not available for your organization" or "Claude isn't available for organizations with restricted compliance settings." | The paired Claude organization has a restricted compliance configuration, such as Zero Data Retention (ZDR), that Claude Tag can't run under. No setting lifts this; contact your account team. See [the troubleshooting entry](/docs/claude-tag/admins/troubleshooting#restricted-compliance-settings-block-claude-tag). |
| The **Slack** tab to list your scopes | "Couldn't load Slack scopes. Reload the page to try again." | A page-load fetch failed; reload. Your configuration is intact. |
| A reply in your test channel | "Couldn't check this channel just now" | The pre-reply guest check briefly failed. Mention `@Claude` again. |
| A reply in your test channel | "Something went wrong starting a session" | Retry first. If it persists, see [the session-start entries](/docs/claude-tag/admins/troubleshooting#something-went-wrong-starting-a-session). |
## Related resources
* [Network requirements](/docs/claude-tag/admins/network-requirements): what your services must allowlist so Claude can reach them
claude-tag/admins/skills-repo First recorded · 81 lines, first recorded
# Set up a skills repository Claude can update ## Set up the skills repository ## How updates propagate ## Prompt Claude to propose updates ## Why a repository instead of uploading skills ## What belongs in the repository ## Related resources
The first capture of this source. The page was already there, and this is what it said.
# Set up a skills repository Claude can update
> Put your org's Claude Tag skills in a git repository with auto-sync, grant Claude write access, and Claude can open pull requests to improve its own skills from what it learns in channels.
export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
<BetaNote />
A **skill** is a set of instructions that teaches Claude how to use a specific tool or follow a specific process (for example, which Datadog endpoints answer which questions, or your org's incident-response runbook). Claude Tag uses the same [skills format as Claude Code](https://code.claude.com/docs/en/skills). A **plugin** bundles one or more skills together.
You can upload skills one at a time in the console, but putting them in a git repository means Claude can open pull requests to improve them from what it learns working in your channels. You review the PR; once merged, every channel picks up the update.
## Set up the skills repository
<Steps>
<Step title="Create the repository">
A new GitHub repository in your organization, with one folder per plugin. Each plugin bundles one or more skills.
</Step>
<Step title="Register the repository as a plugin marketplace">
On the **Plugins** page at [`claude.ai/admin-settings/plugins`](https://claude.ai/admin-settings/plugins), click **Add plugins** and choose **Sync from GitHub**. Select the repository, leave **Sync automatically** on (the default), and click **Create**.
</Step>
<Step title="Grant Claude write access to the repository">
Open an [Access bundle](/docs/claude-tag/admins/add-connections#your-first-access-bundle), go to its **Repositories** tab, and add the repository. The Claude GitHub App must already be linked to your GitHub organization; see [Configure GitHub access](/docs/claude-tag/admins/configure-github).
</Step>
<Step title="Attach the plugins to a scope">
In the same bundle's **Plugins** tab, toggle on the plugins from your new marketplace; each is off until you enable it. See [Attach plugins](/docs/claude-tag/admins/add-connections#attach-plugins).
</Step>
</Steps>
**You'll see:** the repository appears in the bundle's Repositories list, and the marketplace's plugins appear in the bundle's Plugins tab, each labeled with the marketplace name.
## How updates propagate
Once the repository is set up, Claude can propose changes and they reach channels automatically after you merge:
| Stage | What happens |
| :------------------------ | :----------------------------------------------------------------------------------------------------------------------------------- |
| Claude works in a channel | Using the skills currently attached to that scope |
| Claude proposes an update | Opens a pull request against the skills repository, under the Claude GitHub App identity, linked back to the thread that prompted it |
| You review and merge | The PR is yours to approve, edit, or close, like any contributor's |
| The marketplace syncs | On push to the default branch, the updated plugin syncs to your organization automatically |
| New threads pick it up | The next thread in any covered channel uses the updated skill |
Every skill change reaches channels only after a human approves the merge; Claude opens the PR, you merge it.
## Prompt Claude to propose updates
Claude won't open skill PRs unprompted. Ask in the channel when something it learned should stick:
```text wrap theme={null}
@Claude that worked. Open a PR to the skills repo so the Datadog skill includes that query pattern.
```
Or set a routine that sweeps a channel's corrections into proposed updates:
```text wrap theme={null}
@Claude every Friday, review what you got wrong in this channel this week and open one PR to the skills repo with the fixes.
```
## Why a repository instead of uploading skills
You can also upload individual skills in the console without a repository. The repository pattern is worth the setup because Claude can propose changes to it, every change goes through version control and code review, and you can attach the same skills to multiple bundles without uploading them again.
## What belongs in the repository
| Put in the skills repo | Put in channel memory instead |
| :------------------------------------------------------------ | :------------------------------------- |
| How to call a specific API correctly | This channel's preferred output format |
| A runbook that any team would reuse | A one-off decision this channel made |
| Tool-specific gotchas (auth headers, pagination, rate limits) | Who owns what in this team |
Skills in the repository reach every channel under the scope.
## Related resources
* [Attach plugins](/docs/claude-tag/admins/add-connections#attach-plugins): how plugins and skills load into a scope
* [Configure GitHub access](/docs/claude-tag/admins/configure-github): granting Claude write access to a repository
* [What Claude Tag remembers](/docs/claude-tag/users/memory): when channel memory is the right place instead
claude-tag/admins/test-it First recorded · 106 lines, first recorded
# See Claude Tag work ## Run tasks that need no connections ## Test the connections you added ## If a test fails ## Related resources
The first capture of this source. The page was already there, and this is what it said.
# See Claude Tag work
> Run Claude Tag's first tasks in a pilot channel before any connection exists. See copy-paste prompts that run on Slack content alone, per-connection checks, and what to do if a step fails.
export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
<BetaNote />
<div className="tm-stepbar">
<a className="tm-stepbar-seg tm-done" href="/docs/docs/claude-tag/admins/pair-workspace">1 · Pair workspace</a>
<a className="tm-stepbar-seg tm-done" href="/docs/docs/claude-tag/admins/add-connections">2 · Give access</a>
<a className="tm-stepbar-seg tm-done" href="/docs/docs/claude-tag/admins/set-spend-limit">3 · Spend limit</a>
<a className="tm-stepbar-seg tm-current" href="/docs/docs/claude-tag/admins/test-it">4 · See it work</a>
</div>
<div className="tm-stepmeta">
<div className="tm-stepmeta-row"><span className="tm-stepmeta-label">Role you need</span><span>Anyone in the pilot channel can run the prompts; you'll want Owner access handy to fix anything they surface</span></div>
<div className="tm-stepmeta-row"><span className="tm-stepmeta-label">Before this step</span><span>Workspace paired and a <a href="/docs/docs/claude-tag/admins/set-spend-limit">spend limit</a> set</span></div>
<div className="tm-stepmeta-row"><span className="tm-stepmeta-label">Do I need this?</span><span><span className="tm-meta-pill tm-meta-pill-req">Required</span>The only way to know the setup holds together before rolling out to more channels.</span></div>
</div>
Claude starts taking work the moment the workspace is paired, with or without connections. This step has two parts: tasks that run on the channel's own content, then a check for each connection you added.
## Run tasks that need no connections
Add Claude to the pilot channel:
```text wrap theme={null}
/invite @Claude
```
Then paste the recap task. It uses only the channel's history, so it confirms the app install, the scope, and the session machinery before any connection is in play.
```text wrap theme={null}
@Claude summarize what this channel decided this week and list any open questions
```
**Passed when:** an "is thinking…" line appears under the message, Claude posts its work in the thread, and delivers a summary.
The recap proves the setup; the prompts below preview the work your channels can hand Claude before anything is connected. Each links to a use case page with the full setup.
Roll up the channel's open requests, the one-off version of [Triage requests](/docs/claude-tag/users/use-cases/triage-requests):
```text wrap theme={null}
@Claude post a summary of this week's requests in this channel: how many, top themes, and anything still unrouted
```
Turn a settled discussion into a document, from [Turn threads into docs and tickets](/docs/claude-tag/users/use-cases/create-artifacts):
```text wrap theme={null}
@Claude turn this thread into a one-page decision doc: what we decided, the options we rejected, and why.
```
Ask for a personalized menu of next tasks, from the [prompt library](/docs/claude-tag/users/prompt-library):
```text wrap theme={null}
@Claude learn what you can about my role from this workspace, then tell me three tasks you could take off my plate this week.
```
## Test the connections you added
If you skipped connections during setup, you're done; come back to this section after you [add a connection](/docs/claude-tag/admins/add-connections). For each connection, run a task in a new thread.
<Steps>
<Step title="Ask what the channel can reach">
```text wrap theme={null}
@Claude what can you access from this channel?
```
Claude replies with the systems available there.
</Step>
<Step title="Ask for data from the connection">
Pick one connection and ask for something a read-only credential can do, like the latest items from an issue tracker or a single row count from a warehouse.
```text wrap theme={null}
@Claude pull the five most recent items from our issue tracker and post them here
```
For a GitHub repository grant, ask about pull request state:
```text wrap theme={null}
@Claude list the open pull requests in your-org/your-repo and who each one is waiting on
```
</Step>
<Step title="Check the service's own audit log">
Confirm the action appears in that service's audit log under the service account you provisioned. That entry proves the credential chain end to end and is the trail your security team reads later.
</Step>
</Steps>
**Passed when:** the connection responds, and the action shows in that service's audit log under your service account.
## If a test fails
Most first-task failures trace to one of three causes, in order of likelihood:
* **No response at all**: the channel isn't covered by any scope you've configured. Check the workspace appears under **Claude Tag's access** on the **Slack** tab in admin settings.
* **Claude responds but can't reach a service you connected**: Claude isn't told about a connection added after the thread started. Ask it to use the service by name, or start a fresh thread, before investigating anything else.
* **An error message**: the message text names what's missing (a connection, [a host on the allowlist](/docs/claude-tag/admins/add-connections#add-a-domain), or a permission). Fix that piece and try again.
## Related resources
* [Getting started for users](/docs/claude-tag/users/getting-started): what to send the first people in
* [Use case library](/docs/claude-tag/users/use-cases): tasks to hand the pilot channel, with the prompts to paste
* [Prompt library](/docs/claude-tag/users/prompt-library): every prompt on one page, each with why it works
claude-tag/admins/troubleshooting First recorded · 610 lines, first recorded
# Troubleshoot Claude Tag setup ## Slack app permissions ### This workspace's Claude app installation is out of date ### Unapproved permissions requested ### Only Slack workspace admins or Grid org admins can link this workspace ### Missing the required Slack permission (users:read) ### The audit log shows Claude joining channels no one invited it to ## Guest and shared channels ### Claude doesn't respond in channels that include guests ### Couldn't check this channel just now ### This channel is shared across multiple workspaces ### This channel is shared among several Claude workspaces ### This channel is shared across several Slack workspaces ### Claude isn't available in channels shared across your Enterprise Grid ### This channel is now shared across multiple workspaces ## Console errors ### Couldn't load Slack scopes ### The page shows your plan as Free ## Nothing responds ### Claude went silent in one thread, but responds elsewhere ### Claude is silent everywhere on Enterprise Grid ### This workspace isn't set up for Claude Tag yet ### Claude Tag is turned off for your organization ### Claude Tag is unavailable because Routines are not enabled ### Restricted compliance settings block Claude Tag ### Claude is disabled in this channel ## Access and connections ### Claude says a host isn't allowed or it can't reach the internet ### A connection works in one channel but not another ### GitHub doesn't work in this channel ### I hit an authentication error and couldn't finish this turn ### Your Claude account is connected, but it doesn't have access in this organization ## Session start errors ### Still waiting for available capacity ### Session failed to start: the session container never connected ### Something went wrong starting a session ### Channel sessions use the wrong environment, or can't find one ## Related resources
The first capture of this source. The page was already there, and this is what it said.
# Troubleshoot Claude Tag setup > Error messages from Claude Tag setup and what fixes each. Covers permission mismatches, GitHub access gaps, session start failures, and account errors. export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>; <BetaNote /> This page covers errors you might hit setting up and administering Claude Tag: Slack app permissions, guest and shared channels, console errors, channels and threads where nothing responds, access and connections, and session starts. Each entry has the same three parts: what you see, what it means, and how to resolve it. <Note>For problems people can resolve on their own in a channel, like a missing reply or a thread that lost its work, see [Troubleshoot Claude Tag in channels and DMs](/docs/claude-tag/users/troubleshooting).</Note> If someone reports that Claude can't reach a service you connected, check two things before anything else: * The connection is in a [bundle attached to that channel's scope](/docs/claude-tag/admins/attach-to-scope). * The test ran in a new thread; an existing thread isn't told about a connection added after it started, though the connection works there if the request names the service. ## Slack app permissions Most errors in this section appear when Claude needs a Slack permission that wasn't part of the app when your workspace approved it. For those, the fix is a Slack workspace admin re-approving the Claude app from [Claude for Slack](https://claude.com/claude-for-slack), which grants the current permission set. Nothing else changes, and existing settings carry over. ### This workspace's Claude app installation is out of date **What you see** Claude replies to `@Claude connect`: > This workspace's Claude app installation is out of date — it hasn't granted the \[permission name] permission(s). I can't create a link code until a Slack admin reinstalls the Claude app or approves its updated permissions. Once that's done, ask me to link again. Two phrases in the message are links: * **reinstalls the Claude app** opens the reinstall flow. The fix below starts from this link. * **approves its updated permissions** opens Slack's Manage apps page for the workspace. On Enterprise Grid the message names "this Slack organization's Claude app installation" and asks a Slack organization admin to reinstall the org-wide app. The org-wide reinstall works from inside one of the Grid's workspaces with **Install to entire organization**, following the steps in [Claude is silent everywhere on Enterprise Grid](#claude-is-silent-everywhere-on-enterprise-grid). Sometimes the reply issues a code anyway, with a footnote that the install "is out of date". The reinstall steps below clear the footnote too. **What it means** Claude needs a Slack permission that wasn't part of the app when your workspace approved it, so the app was never granted it. Claude can't issue a link code until the updated permission set is approved. **How to resolve** A Slack workspace admin runs these three steps: 1. Click the **reinstalls the Claude app** link in the reply, or open [Claude for Slack](https://claude.com/claude-for-slack) and click **Add to Slack**. Don't uninstall first; this installs over the existing app, so your settings carry over. 2. Approve the consent screen Slack shows; it lists each permission being added. If Slack shows **Unapproved permissions requested** instead of completing, see [Unapproved permissions requested](#unapproved-permissions-requested). 3. Run `@Claude connect` again. If the reinstall worked, the reply contains a pairing code (the link code the original message said it couldn't create) instead of this message. Send that pairing code to whoever runs Claude setup in the console; it expires after 15 minutes. Slack's **Manage apps** page lists the permissions the app requests, not the permissions your workspace has granted, so seeing the missing permission listed there doesn't mean it's approved. The grant happens on the consent screen. For the app's permissions in one place, see [What the Claude Slack app can access](/docs/claude-tag/admins/for-slack-admins). ### Unapproved permissions requested **What you see** **Unapproved permissions requested** is a message from Slack, not a Claude reply. It appears in either of two places: * On the consent screen after **Add to Slack**, including for a workspace admin who approved the app before * As the pending status on the Claude entry under **Settings & administration** → **Manage apps** → **App requests**, in workspaces that require admin approval for apps **What it means** The permissions the Claude app requests have changed since your workspace approved it, and Slack requires a fresh approval for the additions. The consent screen lists each permission being added, so you can review exactly what you're granting before approving; approval applies only to the Claude app already installed in your workspace. **How to resolve** A Slack workspace admin approves the Claude app's updated permissions in either place: * In Slack, go to **Settings & administration** → **Manage apps** → **App requests** and approve the Claude request. * Or open [Claude for Slack](https://claude.com/claude-for-slack), click **Add to Slack**, and approve the consent screen. Both paths grant the same permissions, and neither requires uninstalling first. If the approval worked, `@Claude connect` returns a pairing code without mentioning the installation again. ### Only Slack workspace admins or Grid org admins can link this workspace **What you see** Claude replies to `@Claude connect`: > Only Slack workspace admins (or Enterprise Grid org admins) can link this workspace to a Claude organization. Please ask a workspace admin to mention me with `@Claude connect`. **What it means** Slack reports that the person who ran `@Claude connect` doesn't hold the workspace admin role, so no pairing code was issued. This reply is itself the signal, and there's nothing else to check. The Claude Owner role doesn't satisfy the check; it's the Slack-side role that matters. **How to resolve** Have a Slack workspace admin run `@Claude connect` instead. On Enterprise Grid, a Grid organization admin works too. If the fix worked, their reply contains a pairing code. ### Missing the required Slack permission (users:read) **What you see** Claude replies in the channel: > Claude can't check this channel for guests because it's missing the required Slack permission (users:read). A workspace admin needs to reinstall Claude to grant it. If the failure happens while Claude is posting a message rather than replying, there's no fixed message; Claude describes the problem in its own words, and the underlying error it relays reads "message not delivered: Claude can't check this channel for guests because the Slack app is missing a permission (users:read); a workspace admin must reinstall Claude to grant it." **What it means** **Allow Claude to respond to guests** is set to **Restrict** for this channel's [scope](/docs/claude-tag/concepts/glossary#scope), so Claude checks the channel for guests before replying, and this install predates the `users:read` permission that check needs. **How to resolve** Re-approve the app from [Claude for Slack](https://claude.com/claude-for-slack). Don't uninstall first; the re-approval installs over the existing app. If the fix worked, a mention in the affected channel gets a reply instead of the permission message. ### The audit log shows Claude joining channels no one invited it to **What you see** Slack's audit log shows Claude joining a channel with no inviter recorded, and no one in the workspace remembers adding it. **What it means** A member selected **Add to channel** on a channel Claude suggested in a direct message. Claude's welcome message, the introduction it posts when a member first opens a direct message with it, suggests a few public channels, each with an **Add to channel** button. Selecting one directs Claude to add itself to that channel. Claude performs that join with its own `channels:join` permission, so Slack's audit log records the join as the Claude app and shows no inviter; the member's selection is not visible in Slack's log. Claude never joins a channel unprompted. [What the Claude Slack app can access](/docs/claude-tag/admins/for-slack-admins) covers how members add it. **How to resolve** Nothing is misconfigured, and no setting changed. If Claude shouldn't be in the channel, remove it with `/remove @Claude`, or [set the scope's Claude Tag version to Off](/docs/claude-tag/admins/restrict-access#quiet-or-remove-claude-tag) so it stops responding there even if it's added again. If you want every join in the audit log attributed to a person, ask members to add Claude with `/invite @Claude` rather than the buttons; Slack records an invite as the inviting member's action. ## Guest and shared channels Claude checks a channel for guests and for sharing across workspaces before it replies there. The messages those checks post look alike, but most are refusals and one is a notice on a reply Claude goes on to give. Match the exact message text before changing anything; each message has a different cause and a different fix. A channel created at the Enterprise Grid organization level rather than inside a single workspace counts as shared across workspaces even when it appears in only one workspace's sidebar, so a channel can hit the shared-channel messages below despite looking like an ordinary single-workspace channel. ### Claude doesn't respond in channels that include guests **What you see** Claude replies in the channel: > Claude doesn't respond in channels that include guests. You can remove the guests from this channel (Channel details -> Members -> filter by "guests"), or a claude.ai organization owner can allow it here. In the message, "here" is a link to the guest setting described below. The role it names is a claude.ai organization owner, not a Slack admin. **What it means** The channel includes at least one Slack guest account, and **Allow Claude to respond to guests** is set to **Restrict** for this channel's scope. **Restrict** is the default. **How to resolve** Either fix works: * Remove the guests from the channel, or move the conversation to a channel with no guests; this changes no settings, so no other channel is affected. * Or set **Allow Claude to respond to guests** to **Allow** for the scope covering this channel. The setting is at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), on the **Slack** tab under **Claude Tag's access**, in the scope's collapsed **Advanced** section. **Allow** applies to every guest channel that scope covers, and guests there can see Claude's replies and interact with it. To limit it to one channel, set it on the channel's own scope. See [restrict guest channels](/docs/claude-tag/admins/restrict-access#restrict-guest-channels) for the full exposure picture. **Allow** restores replies, not workspace search. Claude can't search the workspace from a channel that includes guests, even when the setting is **Allow**. Removing the guests restores search as well. If the fix worked, a mention in the channel gets a reply. ### Couldn't check this channel just now **What you see** Claude replies in the channel: > Couldn't check this channel just now. Please try again in a moment. **What it means** Claude couldn't complete its check for guests in this channel; either the guest-policy lookup or the Slack membership check briefly failed, so Claude declined this reply rather than risk posting where a guest might see it. This isn't a configuration error. **How to resolve** 1. Mention Claude again; the retry usually clears it. 2. If one channel hits this repeatedly, the membership check may be failing on an unusually large channel. Setting **Allow Claude to respond to guests** to **Allow** on the channel's scope removes the guest check for every channel that scope covers, which usually stops the message from recurring; weigh [what Allow exposes](#claude-doesn%E2%80%99t-respond-in-channels-that-include-guests) first. ### This channel is shared across multiple workspaces **What you see** Claude replies in the channel: > This channel is shared across multiple workspaces, and Claude can't verify whether it includes guests, so Claude can't respond here. The same check also refuses requests made from another conversation, such as asking Claude to post a message in the channel, with a message ending "shared across multiple workspaces and Claude can't verify whether it includes guests". **What it means** This message comes from the guest check, not from workspace sharing. **Allow Claude to respond to guests** is set to **Restrict** for this channel's scope, and the channel's membership can't be verified, most often because the channel is shared across an Enterprise Grid organization, so Claude declines. **How to resolve** Use a channel that belongs to a single workspace. Setting the scope's guest setting to **Allow** removes the guest check that posts this message, but a Grid-shared channel still doesn't behave like a single-workspace one. When its workspaces connect to different Claude organizations, Claude posts the refusal in [This channel is shared among several Claude workspaces](#this-channel-is-shared-among-several-claude-workspaces) instead of replying. When they all share your one Claude organization, Claude replies with only your organization's default access and settings, described in [This channel is shared across several Slack workspaces](#this-channel-is-shared-across-several-slack-workspaces). ### This channel is shared among several Claude workspaces **What you see** Claude replies in the channel: > This channel is shared among several Claude workspaces, so Claude cannot respond here. The reply appears only when someone mentions Claude directly, or addresses it in a thread it already joined. Other messages in the channel get no reply at all. **What it means** The channel is shared across more than one Slack workspace in your Enterprise Grid, and those workspaces are paired to different Claude organizations. No single organization's settings cover the channel, so Claude declines regardless of the guest policy or any scope setting. Claude also declines when it can't confirm that the workspaces share one Claude organization. Two similar messages come from different situations. [This channel is shared across multiple workspaces](#this-channel-is-shared-across-multiple-workspaces) is the guest case, and [This channel is shared across several Slack workspaces](#this-channel-is-shared-across-several-slack-workspaces) is the case where every workspace belongs to your one Claude organization, so Claude replies. **How to resolve** Move the conversation to a channel that belongs to a single workspace, or to a DM. ### This channel is shared across several Slack workspaces **What you see** Claude posts a notice in the thread, then answers the request: > This channel is shared across several Slack workspaces, so Claude is using only your organization's default Slack access and settings here — not any workspace- or channel-specific repos, instructions, or memory you've configured. **What it means** The channel is shared across more than one Slack workspace, and every one of those workspaces belongs to your Claude organization. Claude works there, but only with the access and settings on your [**Default Slack access**](/docs/claude-tag/admins/attach-to-scope) scope. Bundles, instructions, and memory attached to a workspace or to this channel don't apply. The notice posts at most about once a month per channel, so replies in this channel run under the same defaults even when no notice accompanies them. **How to resolve** Nothing is broken. To use a channel's own repositories, connections, or instructions, work in a channel that belongs to a single workspace, or add what the channel needs to the **Default Slack access** scope. In a single-workspace channel, requests use that channel's own configuration and the notice doesn't appear. ### Claude isn't available in channels shared across your Enterprise Grid **What you see** You ask Claude to do something that involves a channel shared across your Enterprise Grid, and the refusal names the request it declined and ends: > Claude isn't available in channels shared across your Enterprise Grid **What it means** The request needed Claude to act in a channel that's shared across more than one workspace in your Enterprise Grid. The message appears in whichever conversation you made the request; the entries above cover the replies Claude posts in the shared channel itself. This refusal covers both sharing cases. Even when the shared channel's workspaces all belong to your one Claude organization and Claude answers direct mentions there, Claude still declines requests made from another conversation. **How to resolve** Point the request at a channel that belongs to a single workspace, or move the conversation to one. ### This channel is now shared across multiple workspaces **What you see** Claude posts in the thread: > This channel is now shared across multiple workspaces, so this thread's earlier session can't continue here. Please @-mention me in a new thread. **What it means** The channel became shared after this thread's session started, so the session is still bound to one workspace's configuration and can't continue in front of every workspace that now sees the channel. **How to resolve** Mention Claude in a new thread; new threads start under the channel's current sharing. ## Console errors ### Couldn't load Slack scopes **What you see** A banner at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), on the **Slack** tab under **Claude Tag's access**, reads: > Couldn't load Slack scopes. Reload the page to try again. **What it means** The request that loads your scope list from Claude's backend failed; it isn't a Slack permissions problem, and your configuration is intact. The page shows the error instead of an empty list so that a failed load doesn't look like an unconfigured workspace. **How to resolve** 1. Reload the page. If the reload worked, the scope list renders. That's the usual outcome. 2. If the banner persists across reloads, check [`status.anthropic.com`](https://status.anthropic.com) for an active incident and try again in a few minutes. 3. If it continues with no incident posted, contact [Anthropic support](https://support.claude.com) with the time it occurred. ### The page shows your plan as Free **What you see** You open the admin console expecting your organization's settings and land on your personal account settings instead, showing the **Free plan** and no Claude Tag section anywhere. **What it means** You're signed into a personal claude.ai account, which is a separate workspace from your organization. claude.ai sends a personal account to its own settings page rather than to the admin console, so the **Free** you see is your personal account's plan, not a broken admin page. **How to resolve** Use the workspace switcher in claude.ai to switch to your organization, then reopen [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag). If the switch worked, the page shows your organization's plan and the Claude Tag settings. ## Nothing responds
Cut at 300 lines. The page has the rest.
claude-tag/admins/workspaces First recorded · 67 lines, first recorded
# Manage workspaces and versions ## Pair another workspace ### Pair an Enterprise Grid ## Set the version for a scope ## Revoke a pairing ## Related resources
The first capture of this source. The page was already there, and this is what it said.
# Manage workspaces and versions
> Connect more Slack workspaces or an Enterprise Grid to Claude Tag, choose which Claude version each channel uses, and disconnect a workspace.
export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
<BetaNote />
This page covers managing Slack workspace pairings after initial setup: adding more workspaces, choosing which Claude Tag version each one runs, and disconnecting one.
A workspace pairing links one Slack workspace (or Enterprise Grid) to your Claude organization so `@Claude` can run there. Your first pairing was created during [setup](/docs/claude-tag/admins/setup-overview). To add more, you must be an Owner in your Claude organization, and a Workspace Admin (or Grid Org Admin) in the Slack workspace you're adding.
## Pair another workspace
You can connect multiple Slack workspaces to one Claude organization. After the first pairing, the page no longer opens on setup, and the Slack row appears under **Where Claude Tag works**.
The reverse doesn't hold. A Slack workspace or Enterprise Grid pairs with one Claude organization at a time.
To move a pairing to a different Claude organization, an Owner in the organization that currently holds it must [disconnect it](#revoke-a-pairing) first. Until then, the console refuses the new pairing as [already connected to a different organization](/docs/claude-tag/admins/pair-workspace#if-the-console-says-“already-connected-to-a-different-organization”). Once the pairing moves, changes the previous organization's admins make in their settings no longer reach that workspace.
If your company has more than one Claude organization (a subsidiary with its own, for example), agree on which one holds the pairing before connecting.
<Steps>
<Step title="Open the pairing dialog">
At [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), under **Where Claude Tag works**, either select **+ Connect** at the top right, or open the **⋮** menu on the Slack row and select **+ Add workspace**.
</Step>
<Step title="Get a pairing code from Slack">
In any channel of the new workspace, send `@Claude connect` with no other text, as a new top-level message or in a thread where Claude isn't already working, then paste the code Claude sends you into the dialog.
Pick a channel that belongs to just the new workspace. Claude can decline to reply in [guest and shared channels](/docs/claude-tag/admins/troubleshooting#guest-and-shared-channels).
</Step>
</Steps>
<Note>If your organization used the earlier Claude in Slack app, the dialog header reads **Switch to Claude Tag** instead of **Set up Claude Tag for your workspace**. The steps are the same, and the new workspace is added alongside your existing one, not in place of it.</Note>
**You'll see:** the new workspace in the Slack row's connected list and as a scope in the **Claude Tag's access** section.
### Pair an Enterprise Grid
When a Grid Org Owner or Org Admin sends `@Claude connect`, the reply includes two codes. The `workspace_` code pairs only the workspace it was sent from. The `enterprise_` code pairs every workspace in the grid at once; redeem it when Claude should work across the grid.
The choice matters for direct messages. On Enterprise Grid, DMs follow each user's home workspace rather than the workspace you paired, so pairing a single workspace leaves DMs unanswered for users homed in the grid's other workspaces. The `enterprise_` code covers them all.
## Set the version for a scope
Every scope routes to one of four versions. In the **Claude Tag's access** section of admin settings, select the scope and use the **Claude Tag version** control. Channels Claude was added to appear in the section automatically, and the **Search channels** field finds a channel's scope by name or ID.
| Label | Effect |
| :---------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **New** | Claude Tag. Access bundles, skills, and custom instructions apply |
| **Legacy** | The earlier per-user Claude in Slack. Bundles and skills do not apply. Being deprecated; see [Migrate from the earlier app](/docs/claude-tag/admins/migrate-from-earlier) |
| **Off** | Neither version responds to channel mentions in this scope. Direct messages are unaffected |
| **Inherit** | Use the parent scope's value. Not shown at **Default Slack access** |
Both versions answer through the same @Claude app, so **Off** turns off the Legacy version too. To opt out of Claude Tag while keeping the earlier behavior, set the scope to **Legacy**, not **Off**.
Per-scope version changes (workspace and channel) are reversible; see [Migrate from the earlier app](/docs/claude-tag/admins/migrate-from-earlier).
## Revoke a pairing
In the **Connected workspaces** list, select **Disconnect** on the workspace's row. Disconnecting revokes the pairing so `@Claude` no longer runs in that workspace, but the workspace's scope and any bundles bound to it remain in the **Slack** tab; remove the scope separately if you want it gone. Claude stops responding in that workspace immediately. Its scopes remain in the Claude Tag's access section, so credentials and instructions are preserved, until you remove them.
## Related resources
* [Migrate from the earlier app](/docs/claude-tag/admins/migrate-from-earlier): the upgrade path and what changes for existing users
* [Pair your Slack workspace](/docs/claude-tag/admins/pair-workspace): the first pairing, with the Slack-admin handoff
claude-tag/concepts/agent-identity First recorded · 141 lines, first recorded
# How agent identity works ## Channel sessions ### Agent Proxy ### Web search vs. network requests ### Agent access ## Direct message channels ### Claude Tag versus Claude Code in Slack ## Related resources
The first capture of this source. The page was already there, and this is what it said.
# How agent identity works
> Claude Tag acts under its own service accounts in Slack channels, not as you. See how channel access is bounded, how credentials reach it, and why DMs differ.
export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
<BetaNote />
Claude Tag's identity depends on where you message it.
In Slack channels, Claude acts with its own service accounts, rather than as a specific user. An organization Owner [provisions this identity during setup](/docs/claude-tag/admins/setup-overview), so it arrives with its own account in each system it works in: the Claude app in Slack, the Claude GitHub App on GitHub, and a service account in every other connected tool. Actions it takes are attributed to those accounts; for example, posts come from the Claude app and pull requests show the Claude GitHub App as the author.
In direct messages (DMs) between a user and `@Claude`, the provisioned identity does not apply. DMs are one-to-one only; group DMs aren't supported. A DM has no channel to scope it to, so a DM session runs on [the individual's own claude.ai account](#direct-message-channels) instead, with their personal connectors. GitHub is the exception in attribution: a pull request opened from a DM is authored by the Claude GitHub App, the same as in channels, though the session can only work with repositories connected on that user's own account. Owners can disable DMs organization-wide; see [Allow or disable direct messages](/docs/claude-tag/admins/restrict-access#allow-or-disable-direct-messages).
<Note>
How Claude behaves in channels (its standing instructions, plugins, and channel memory) is configured separately from its identity; see [custom instructions](/docs/claude-tag/admins/attach-to-scope#add-custom-instructions), [plugins](/docs/claude-tag/admins/add-connections#attach-plugins), and [memory](/docs/claude-tag/users/memory) for more information.
</Note>
## Channel sessions
When Claude works on a channel task, three systems are involved:
* The ask happens in your Slack workspace, when a user tags Claude to do something or a scheduled task starts.
* The work Claude does runs in a sandbox on Anthropic's infrastructure, with nothing installed in your network.
* The agent's credentials for any additional connections, such as GitHub or a data warehouse, reach those systems to pull the required information. An organization Owner sets up those credentials as part of [provisioning the identity](/docs/claude-tag/admins/setup-overview#setup-steps).
The diagram below traces one request through this process.
<img className="block dark:hidden" src="https://mintcdn.com/claude-ai/5JFKyLlO7sHMMf5J/images/claude-tag/diagrams/request-path.svg?fit=max&auto=format&n=5JFKyLlO7sHMMf5J&q=85&s=e8776cf0edd1f3ec912b9b044c9cc838" alt="Diagram showing the request path across three zones. A task mentioned in your Slack workspace runs in a session sandbox on Anthropic's infrastructure, one sandbox per thread, holding no credentials. Outbound requests pass to Agent Proxy, which injects the credential drawn from the credential store; a request matching no rule is blocked. Credentialed requests reach your systems, like GitHub, a data warehouse, monitoring, or any HTTP API. A dashed return path shows results posting back in the thread, as Claude." width="1000" height="440" data-path="images/claude-tag/diagrams/request-path.svg" />
<img className="hidden dark:block" src="https://mintcdn.com/claude-ai/5JFKyLlO7sHMMf5J/images/claude-tag/diagrams/request-path-dark.svg?fit=max&auto=format&n=5JFKyLlO7sHMMf5J&q=85&s=a2ed5f3270989c3ed3d9b9a78a72bff0" alt="Diagram showing the request path across three zones. A task mentioned in your Slack workspace runs in a session sandbox on Anthropic's infrastructure, one sandbox per thread, holding no credentials. Outbound requests pass to Agent Proxy, which injects the credential drawn from the credential store; a request matching no rule is blocked. Credentialed requests reach your systems, like GitHub, a data warehouse, monitoring, or any HTTP API. A dashed return path shows results posting back in the thread, as Claude." width="1000" height="440" data-path="images/claude-tag/diagrams/request-path-dark.svg" />
<Steps>
<Step title="Tag Claude in a channel">
A user asks Claude to chart last week's signups or fix a deploy test. The request starts a new session.
</Step>
<Step title="The session sandbox starts">
Claude does the work in an isolated environment Anthropic builds for this thread, reading files, writing documents, and running code. The credentials you provision are not placed in the sandbox; they stay in the credential store and are injected at the proxy.
</Step>
<Step title="The request crosses Agent Proxy">
When the work needs something outside the sandbox, like calling the GitHub API or querying a warehouse, the request crosses Agent Proxy, the network boundary between the sandbox and everything else. Agent Proxy checks it against the rules an admin configured, and decides whether it proceeds and what credential, if any, travels with it.
</Step>
<Step title="Agent Proxy attaches a credential">
A matching credential comes from the credential store, where an admin's [connections](/docs/claude-tag/admins/add-connections) are kept. Once saved, a credential is never displayed again; Agent Proxy retrieves it only at the moment of injection and attaches it to the request at the boundary, so the model and the sandbox itself are not given the key.
</Step>
<Step title="The result posts back, as Claude">
The credentialed request reaches your system, like GitHub or the warehouse, and the result returns to the thread.
</Step>
</Steps>
### Agent Proxy
For each outbound request from the sandbox, Agent Proxy checks the destination against three allow layers. A request goes through if any one of them allows it; a host that none of them allows is blocked.
| When the destination | Result |
| :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------- |
| Matches a connection's rule, its [allowed websites](/docs/claude-tag/admins/add-connections#set-allowed-websites) | The proxy attaches that connection's credential and forwards the request. The credential stays at the proxy; the model and sandbox are not given it. |
| Is on the [bundle](/docs/claude-tag/concepts/glossary#access-bundle)'s [Domains list](/docs/claude-tag/admins/add-connections#allow-a-host-without-a-credential) but matches no connection | The proxy forwards the request without a credential. |
| Is allowed by the network access setting of the [environment](/docs/claude-tag/concepts/glossary#environment) the [scope](/docs/claude-tag/concepts/glossary#scope)'s sessions run on | The proxy forwards the request without a credential. |
| Matches none of these | The proxy blocks the request. |
A new environment's network access level defaults to Trusted access, so a fresh setup can reach a documented set of package registries and developer hosts before an admin has configured anything. The [cloud environments documentation](https://code.claude.com/docs/en/cloud-environments#default-allowed-domains) lists the covered hosts. To narrow that default, pin an environment with a stricter level, such as No access.
The same rules apply to code Claude runs in the sandbox, like `curl` or a `fetch` call: a request is blocked unless its host is allowed by one of the layers above.
Agent Proxy carries HTTP and HTTPS only. A protocol that isn't HTTP, such as SSH or a database's native wire protocol, can't cross the proxy even to an allowed host.
Nothing is installed inside your network. Your systems see only requests authenticated with the credentials Agent Proxy attached. For the endpoints and addresses your network team may need to allowlist, see [Network requirements](/docs/claude-tag/admins/network-requirements).
### Web search vs. network requests
Claude can search the web from a channel without any Domains entry. Web search is [Anthropic's built-in web search tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-search-tool), which runs on Anthropic's servers, not code running in the channel's sandbox.
The sandbox sends nothing new for a search. Search requests travel to Anthropic the same way the session's model traffic already does, and the searching happens server-side. The [Agent Proxy](#agent-proxy) rules don't apply to web search; fetching a page or calling a service from the sandbox is an outbound network request and follows them.
Searching and opening a page are different actions. A search returns content from the pages it matches, which Claude reads and cites, so it can answer from a page that search surfaced. Opening a URL, whether one you pasted or one a search returned, is a fetch from the sandbox, and the host needs an allow layer. That is why Claude can quote a page it found through search and still report that it can't open the same link.
The web search capability setting in your organization's claude.ai admin settings governs claude.ai chat; it doesn't govern Claude Tag sessions, in channels or DMs. If Claude reports that it can't reach a host from a channel, the fix is a [domain entry](/docs/claude-tag/admins/add-connections#add-a-domain) or the scope's [environment](/docs/claude-tag/concepts/glossary#environment), not that setting.
### Agent access
What Claude can reach in a channel comes from the [Access bundles](/docs/claude-tag/admins/add-connections) an admin attached to that channel's scope. Anyone in the channel gets the same capability, and the same request can do more in `#platform-eng` than in a general channel.
This design has four consequences.
* **Configure once.** Everyone in the scope can use it immediately.
* **Predictability.** What Claude can do never changes based on who asked.
* **Personal connectors apply in DMs.** A shared channel uses only the service-account connections an admin attached, not connectors on anyone's claude.ai account.
* **Clean audit.** Actions in connected tools show up under a service account your security team already knows how to reason about.
That service-account identity is also how Claude appears wherever it acts. In Slack, it posts as the Claude app. On GitHub, commits and pull requests show the Claude GitHub App, and pull requests link back to the Slack thread they came from. In every other connected service, actions appear under the service account an admin provisioned, in that service's audit log.
## Direct message channels
A DM with Claude works differently from a channel. There is no scope to attach an identity to, so a DM session runs with your own claude.ai account instead, the same way a Claude Code session on the web does, using your own connectors and credentials, with results attributed to you (pull requests excepted; the Claude GitHub App authors those from DMs too). The diagram contrasts with the channel path above; the sandbox is the same engine, but everything around it is yours.
<img className="block dark:hidden" src="https://mintcdn.com/claude-ai/5JFKyLlO7sHMMf5J/images/claude-tag/diagrams/dm-identity.svg?fit=max&auto=format&n=5JFKyLlO7sHMMf5J&q=85&s=d4089034f46e4a760f9fac9d36a689cc" alt="Diagram showing how a DM session reaches your systems. A message to Claude in a direct message runs in a session sandbox on Anthropic's infrastructure, the same engine as a channel session, but it runs with your identity. From there it reaches your systems through your own connectors and accounts, like GitHub or Drive, using your own credentials. A dashed return path shows results posting back in the DM, as Claude." width="1000" height="270" data-path="images/claude-tag/diagrams/dm-identity.svg" />
<img className="hidden dark:block" src="https://mintcdn.com/claude-ai/5JFKyLlO7sHMMf5J/images/claude-tag/diagrams/dm-identity-dark.svg?fit=max&auto=format&n=5JFKyLlO7sHMMf5J&q=85&s=a3ca3c8aa926704742402882f4345b1b" alt="Diagram showing how a DM session reaches your systems. A message to Claude in a direct message runs in a session sandbox on Anthropic's infrastructure, the same engine as a channel session, but it runs with your identity. From there it reaches your systems through your own connectors and accounts, like GitHub or Drive, using your own credentials. A dashed return path shows results posting back in the DM, as Claude." width="1000" height="270" data-path="images/claude-tag/diagrams/dm-identity-dark.svg" />
The table lines up the two paths on the four dimensions that differ.
| | In a channel | In a DM |
| :---------- | :--------------------------------------------- | :------------------------------------------------------------------- |
| Acts as | Its own service accounts | You |
| Access | The channel's Access bundles | Your personal connectors |
| Attribution | The agent's accounts, in each tool's audit log | Your name, except pull requests, which the Claude GitHub App authors |
| Billing | The organization | Your seat |
Three of those differences are worth spelling out.
* **Connectors.** The [connectors on your account](/docs/connectors/overview) are available, including MCP servers you've added.
* **Billing.** Usage bills to your seat rather than the organization's service key.
* **Channel-side configuration.** It doesn't follow you in; the agent's connections and repository grants don't apply in DMs.
DM work runs under your credentials, so most of it is attributed to you and can reach only what your own accounts can. Pull requests are the exception: Claude authors them as the Claude GitHub App from DMs too, so a repository's history shows the same author either way, while the repositories it can reach are still only the ones connected on your own account.
Use channels for shared work and DMs for personal tasks, or for data you'd rather access under your own authenticated identity than a shared channel credential.
### Claude Tag versus Claude Code in Slack
A DM with Claude Tag runs under your own account, which is also how [Claude Code in Slack](https://code.claude.com/docs/en/slack) works, routing a coding @-mention to a Claude Code session on the web under the requester's own account. The two can look identical. The table shows how to tell them apart.
| | Claude Tag in a channel | Claude Code in Slack |
| :------------- | :----------------------------------------------------- | :------------------------------------------------------------------------------ |
| **Runs under** | The agent identity an admin provisioned | Your own Claude account, linked in the Claude app |
| **GitHub** | The Claude GitHub App; pull requests belong to the app | Your GitHub connection on claude.ai/code; pull requests open under your account |
| **Access** | The Access bundles an admin attached to the channel | Your personal connectors |
| **Billing** | The organization | Your seat |
If `@Claude` in your workspace opens pull requests as you, you're seeing Claude Code in Slack, not a Claude Tag session.
## Related resources
* [Security and data handling](/docs/claude-tag/concepts/security-and-data): where credentials are stored, what leaves your tenant, and what runs unattended
* [Give Claude access](/docs/claude-tag/admins/add-connections): provision the access this page describes
* [Restrict where Claude Tag operates](/docs/claude-tag/admins/restrict-access): narrow where this agent identity is allowed to act
claude-tag/concepts/for-claude-code-users First recorded · 89 lines, first recorded
# Claude Tag for Claude Code users ## What happens when a session starts ### How hooks run in the sandbox ## Local settings versus admin settings ### Admin counterparts for local settings ## How Slack threads map to sessions ## Whose credentials a session uses ### In a channel ### In a direct message ## Steer a session in the thread ### Keep instructions in channel memory ## Related resources
The first capture of this source. The page was already there, and this is what it said.
# Claude Tag for Claude Code users
> Which parts of a Claude Code setup carry into Claude Tag, which move to admin settings, and how Slack threads map to sessions.
export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
<BetaNote />
Claude Tag runs the same engine as Claude Code. When you tag `@Claude` in Slack with a task, a session starts in a sandbox that Anthropic hosts and your organization configures, not on your machine. That sandbox is the same managed compute behind [Claude Code on the web](https://code.claude.com/docs/en/web-quickstart), described in [Compute and the sandbox](/docs/claude-tag/concepts/security-and-data#compute-and-the-sandbox).
If you use Claude Code on the web, a session works the way a web session does, from a fresh clone of your repository rather than from files on your machine. The configuration you checked into that repository, such as `CLAUDE.md`, hooks, and skills, applies in the session as it does in a web session.
If you run Claude Code in your terminal, the settings on your own machine don't reach a session, because the session runs in the sandbox and can't read your machine. For most of those settings, an admin sets a channel-wide counterpart instead, and a few have no counterpart at all. This page shows what happens when a session starts, which admin settings replace your local ones, and how Slack threads map to sessions.
## What happens when a session starts
A session begins with a fresh sandbox and no repository checked out. Your repository's Claude Code configuration takes effect only after Claude clones the repository, which happens when your message names a repository that an admin has [granted to the channel](/docs/claude-tag/admins/configure-github#grant-repository-access).
| Step | What applies |
| :-------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| You tag `@Claude` with a task | Your message is the task, and Claude starts work in a sandbox with no repository |
| Your message names a granted repository | Claude clones it into the sandbox |
| The clone completes | `CLAUDE.md`, `.claude/CLAUDE.md`, `.claude/rules/*.md`, and the skills in `.claude/skills/` [load into the session](/docs/claude-tag/admins/configure-github#what-loads-from-a-repository) |
| Claude works on the task | Hooks defined in the repository's `.claude/settings.json` run as they do under Claude Code |
### How hooks run in the sandbox
Hooks run inside the sandbox, and every session runs on the same standard sandbox image, no matter which repository it clones. If a hook calls a command that the image doesn't include, add an install step for it to the repository's `CLAUDE.md`, as described in [Install project dependencies](/docs/claude-tag/admins/configure-github#install-project-dependencies).
## Local settings versus admin settings
A session reads configuration from your repository, not from your machine. The `CLAUDE.md`, hooks, and skills you checked into the repository load when Claude clones it, as described in [What happens when a session starts](#what-happens-when-a-session-starts).
The settings on your machine never load into a session, because a session runs in the sandbox and can't read your machine. That includes your `~/.claude` directory, your personal `settings.json`, your shell environment, and the MCP servers you configured locally. They still apply when you run Claude Code in your terminal.
### Admin counterparts for local settings
The table shows what takes the place of each setting from your machine. Where a counterpart exists, an admin sets it for the whole channel.
| Claude Code setting on your machine | In Claude Tag |
| :--------------------------------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `/model` | An admin sets the [default model per channel](/docs/claude-tag/admins/customize#choose-the-model-for-a-scope), and you can [switch models in a thread](/docs/claude-tag/users/models) |
| Effort level | Not configurable. Sessions run at the model's default effort. |
| MCP servers in `.mcp.json` | Not loaded, even when `.mcp.json` is checked into the repository. A session reaches external services only through the [connections an admin set for the channel](/docs/claude-tag/admins/add-connections), and each connection holds that service's credentials. |
| Secrets and API keys in your environment | An admin provisions them as channel connections. The raw key never enters the sandbox. It is [added to requests at the network layer](/docs/claude-tag/concepts/agent-identity#agent-proxy). |
| Environment variables and a personal `settings.json` | No counterpart. Every session runs on the same standard sandbox image, so there is no per-person environment to customize. Put non-secret setup in `CLAUDE.md` as [install steps](/docs/claude-tag/admins/configure-github#install-project-dependencies), and ask an admin to add secrets as connections. |
| A setup script for your workspace | No counterpart. Use `CLAUDE.md` install steps instead. |
| Permission prompts | Sessions run in auto mode, where Claude's permission checker reviews each action and can stop it. An admin pre-approves routine actions with [auto mode allow rules](/docs/claude-tag/admins/customize#auto-mode-allow-rules) instead of you approving in the moment. |
To change what a session can reach, ask an admin to [add a connection](/docs/claude-tag/admins/add-connections). The change applies to every session in the channel.
## How Slack threads map to sessions
You start a session by tagging `@Claude` in a thread with a task, and that session gets its own sandbox. Each reply in the same thread continues the session, so there is no `--continue` or `/resume` to run, and a session stays attached to the thread it started in. See [the lifecycle of a request](/docs/claude-tag/concepts/how-it-works#lifecycle-of-a-request) for what happens between replies.
Each thread is its own session with its own sandbox, so run parallel tasks in separate threads the way you would in separate terminal tabs. The sandbox is released after a quiet period, but the conversation stays in the thread, and a later reply continues the session. See [what survives between replies](/docs/claude-tag/concepts/how-it-works#what-survives-between-replies).
## Whose credentials a session uses
Claude Code acts with your credentials. What a session acts with depends on whether you tag Claude in a channel or in a direct message.
### In a channel
In a channel, Claude acts with credentials of its own, service accounts that [an admin provisions](/docs/claude-tag/concepts/agent-identity#channel-sessions). A pull request comes from the Claude GitHub App rather than from you, and a query against a connected service runs with the channel's credentials no matter who asked. Access is set per channel, not per person.
### In a direct message
A [direct message](/docs/claude-tag/concepts/agent-identity#direct-message-channels) runs on your own claude.ai account, with the connectors you added to that account rather than the connections an admin set for the channel, so a DM is the closest match to a Claude Code session on your own credentials.
## Steer a session in the thread
Where you would interrupt Claude Code and edit a file or reprompt, [reply in the thread](/docs/claude-tag/concepts/how-it-works#reply-in-the-thread-to-steer). Corrections and added constraints land as messages, and Claude folds them into the running task.
### Keep instructions in channel memory
For instructions that should persist beyond one thread, use channel memory, the instructions Claude keeps for one channel and reads in every session there. Keep repository conventions in `CLAUDE.md`. Put channel conventions in memory by telling Claude to remember them:
```text theme={null}
@Claude remember for this channel: reports go out as tables
```
See [What Claude remembers](/docs/claude-tag/users/memory) for how memory is scoped and how to correct it.
## Related resources
* [How Claude Tag works](/docs/claude-tag/concepts/how-it-works): the session model this page maps your setup onto
* [How agent identity works](/docs/claude-tag/concepts/agent-identity): why a channel uses the agent's access and a DM uses yours
* [Claude Tag settings map](/docs/claude-tag/concepts/settings-map): where each setting your organization owns is set
* [Configure GitHub access](/docs/claude-tag/admins/configure-github): what loads from a repository and how installs work in the sandbox
claude-tag/concepts/glossary First recorded · 78 lines, first recorded
# Glossary ## Access bundle ## Agent identity ## Agent Proxy ## Channel memory ## The earlier Claude in Slack ## Connection ## Connector ## Environment ## Plugin ## Routine ## Rule ## Scope ## Session ## Related resources
The first capture of this source. The page was already there, and this is what it said.
# Glossary > Claude Tag terms defined in one place. See agent identity, Access bundle, connection, scope, Agent Proxy, routine, channel memory, environment, and session. export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>; <BetaNote /> ## Access bundle A named set of connections, [domain entries](/docs/claude-tag/admins/add-connections#add-a-domain), repository access, and rules that an Owner creates for Claude to use. Bundles attach to scopes, and one bundle can serve many scopes. See [Give Claude access](/docs/claude-tag/admins/add-connections). ## Agent identity The service accounts Claude acts with: the Claude app in Slack, the Claude GitHub App on code, and the credentials an admin provisions for every other tool. See [How agent identity works](/docs/claude-tag/concepts/agent-identity). ## Agent Proxy The network layer that injects credentials into Claude's outbound requests. The model and the sandbox are not given the key; Agent Proxy adds the credential at the network boundary when a request matches the rules an admin set. See [How agent identity works](/docs/claude-tag/concepts/agent-identity#agent-proxy). ## Channel memory Facts Claude retains while working in a channel, including facts you told it to remember and notes it writes itself. Entries from public channels are shared across the workspace; entries from private channels are saved to that channel's own store. See [What Claude Tag remembers](/docs/claude-tag/users/memory). ## The earlier Claude in Slack Claude Tag is the second generation of the Claude app in Slack: | | Legacy (the earlier Claude in Slack) | New (Claude Tag) | | :------------- | :------------------------------------------ | :---------------------------------------------------- | | Identity | Each user links their own claude.ai account | One agent identity with org-level service credentials | | Sessions | Spawned per request | One persistent session per thread, shared | | Memory | None | Shared workspace memory plus private-channel memory | | Proactive work | None | Routines and channel watching | Your admin chooses which generation answers `@Claude` in a given channel, so two channels in the same workspace can work differently. See [Migrate from the earlier Claude in Slack](/docs/claude-tag/admins/restrict-access#migrate-from-the-earlier-claude-in-slack). ## Connection A credential for one external service that Claude uses on the channel's behalf, like a Datadog API key or a GitHub App installation. Connections belong to the agent identity, not to any user, and are grouped into [Access bundles](#access-bundle) by an admin. A connection is not a connector. A connector belongs to your personal claude.ai account. Claude cannot use your connectors in channels; it uses the channel's connections. The one exception is a DM, where it uses your own account instead; see [how DMs work in this model](/docs/claude-tag/concepts/agent-identity#direct-message-channels). ## Connector A tool you add to your own claude.ai account, like Gmail, Google Drive, or a custom MCP server, listed under [Customize > Connectors](https://claude.ai/customize/connectors). Connectors are personal; in Slack they apply only in DMs. For the agent-side equivalent that works in channels, see [Connection](#connection). ## Environment The sandboxed compute configuration a session runs in, including its network access setting. Environments used here must be scoped to the organization, not to an individual account, because channel sessions run with no user account attached. ## Plugin A bundle of skills an Owner attaches to an Access bundle or scope, teaching Claude how to use a specific tool or follow a specific process. Anthropic provides plugins for common tools; you can add your own. See [Attach plugins](/docs/claude-tag/admins/add-connections#attach-plugins). ## Routine A scheduled or run-once task Claude runs on its own, such as a daily digest or a channel watch. Anyone in a channel can ask Claude to set one up, list what's scheduled, or disable one. Routines run with the channel's connections, not the creator's. Claude Code also has a feature named routines. Those run under an individual user's account; Claude Tag routines run under the agent identity. ## Rule The match conditions Agent Proxy checks against each outbound request. A connection pairs one credential with the rule that decides when to inject it, and a request that matches the rule gets the credential attached at the boundary. A request that nothing allows (no rule, no domain entry, no [environment](#environment) network access setting) is blocked. See [Agent Proxy](/docs/claude-tag/concepts/agent-identity#agent-proxy). ## Scope One of three levels Claude's settings can target: Default Slack access (the organization-wide root), one Slack workspace, or one channel (public or private). Scopes inherit downward, so a channel gets its workspace's settings plus any of its own. An Owner attaches [Access bundles](#access-bundle) and instructions at a scope. See [Attach the bundle to a scope](/docs/claude-tag/admins/attach-to-scope). ## Session The unit of work behind one conversation. Each Slack thread binds to one persistent session, and anyone in the channel can continue it by replying in the thread. A channel where Claude works at the top level, outside threads, also carries one session for the channel itself, separate from every thread's. See [How Claude Tag works](/docs/claude-tag/concepts/how-it-works) and [Restart a stuck or wrong-context session](/docs/claude-tag/users/commands#restart-a-stuck-or-wrong-context-session). ## Related resources * [How Claude Tag works](/docs/claude-tag/concepts/how-it-works): the scope, channel, and thread model in action * [How agent identity works](/docs/claude-tag/concepts/agent-identity): how connection, scope, and Agent Proxy fit together when Claude runs a task * [Set up Claude Tag](/docs/claude-tag/admins/setup-overview): where bundles, scopes, and connections get created in the console
claude-tag/concepts/how-it-works First recorded · 263 lines, first recorded
# How Claude Tag works ## Walk through a Claude Tag session ### Start a session ### Track Claude's progress ### Reply in the thread to steer ## Team channels and personal DMs ## How Claude Tag differs from Cowork and Claude Code ## Key concepts ## Lifecycle of a request ### What Claude posts back ### How the checklist updates ### Channel access #### How to identify access ### One-off and scheduled tasks ## Session context and memory ### Conversation context ### What survives between replies ### Channel and workspace memory ## Related resources
The first capture of this source. The page was already there, and this is what it said.
# How Claude Tag works
> Each Claude Tag thread in Slack runs a working session in a sandbox. See how progress shows in the thread, how to steer mid-task, what survives between turns, and how memory is scoped.
export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
<BetaNote />
Claude Tag is Claude, working inside your team's Slack channels. An organization Owner gives it its own accounts to the tools your team uses, so it arrives already able to act, and anyone in a channel can tag it into a problem without setting anything up.
When someone tags Claude in with a task, a working session starts for that thread. Claude works through the task and posts the result back into the conversation. It runs in an ephemeral cloud sandbox that Anthropic hosts, not on your local machine or inside your network.
This page covers:
* [Walk through a session](#walk-through-a-claude-tag-session): an annotated example thread showing one task end to end
* [Starting a session](#start-a-session), [tracking progress](#track-claude%E2%80%99s-progress), and [steering mid-thread](#reply-in-the-thread-to-steer): what to type, what to watch, and who can redirect
* [Team channels and personal DMs](#team-channels-and-personal-dms): which surface to use, and how access differs between them
* [Key concepts](#key-concepts): agent identity, scheduling, and memory defined
* [Lifecycle of a request](#lifecycle-of-a-request): the five-step loop, [the checklist](#how-the-checklist-updates), [per-channel access](#channel-access), and [scheduled tasks](#one-off-and-scheduled-tasks)
* [Session context and memory](#session-context-and-memory): what Claude reads, what survives idle, and what carries across channels
## Walk through a Claude Tag session
The thread below is one task end to end in Slack: Jordan tags @Claude into `#launch-week` with a question, a colleague steers mid-thread, and the answer lands in the channel.
<div className="tm-slack">
<div className="tm-slack-head">
<span className="tm-slack-chan"># launch-week</span>
<span className="tm-slack-members">19 members</span>
</div>
<div className="tm-slack-body">
<div className="tm-msg">
<span className="tm-avatar tm-avatar-user" aria-hidden="true">J</span>
<div className="tm-msg-col">
<div className="tm-msg-meta"><span className="tm-msg-name">Jordan</span><span className="tm-msg-time">9:02 AM</span></div>
<p><span className="tm-mention">@Claude</span> where are we on launch prep? Pull together what's still open from this channel.</p>
</div>
</div>
<div className="tm-msg">
<span className="tm-avatar tm-avatar-claude">
<img src="https://mintcdn.com/claude-ai/5JFKyLlO7sHMMf5J/images/claude-tag/logo/clay-spark.svg?fit=max&auto=format&n=5JFKyLlO7sHMMf5J&q=85&s=032101c39ca3b1af9f72fc4af8e60d12" alt="" noZoom width="94" height="94" data-path="images/claude-tag/logo/clay-spark.svg" />
</span>
<div className="tm-msg-col">
<div className="tm-msg-meta"><span className="tm-msg-name">Claude</span><span className="tm-msg-app">APP</span><span className="tm-msg-time">9:02 AM</span></div>
<p>On it. I'll go through this channel's open threads and the launch plan.</p>
<div className="tm-tasklist">
<span className="tm-task-done"><span className="tm-sr">Done: </span>Read 14 open threads</span>
<span className="tm-task-done"><span className="tm-sr">Done: </span>Cross-checked the launch plan in Drive</span>
<span className="tm-task-done"><span className="tm-sr">Done: </span>Listed who each item is waiting on</span>
<span className="tm-task-done"><span className="tm-sr">Done: </span>Drafted the status summary</span>
</div>
</div>
</div>
<div className="tm-msg">
<span className="tm-avatar tm-avatar-user tm-avatar-b" aria-hidden="true">S</span>
<div className="tm-msg-col">
<div className="tm-msg-meta"><span className="tm-msg-name">Sam</span><span className="tm-msg-time">9:06 AM</span></div>
<p>fold in the vendor quotes from last week's thread too</p>
</div>
</div>
<div className="tm-msg">
<span className="tm-avatar tm-avatar-claude">
<img src="https://mintcdn.com/claude-ai/5JFKyLlO7sHMMf5J/images/claude-tag/logo/clay-spark.svg?fit=max&auto=format&n=5JFKyLlO7sHMMf5J&q=85&s=032101c39ca3b1af9f72fc4af8e60d12" alt="" noZoom width="94" height="94" data-path="images/claude-tag/logo/clay-spark.svg" />
</span>
<div className="tm-msg-col">
<div className="tm-msg-meta"><span className="tm-msg-name">Claude</span><span className="tm-msg-app">APP</span><span className="tm-msg-time">9:08 AM</span></div>
<p>Done. Full status below: eight items closed, three open. The venue contract is the oldest, waiting on legal since the 2nd.</p>
</div>
</div>
</div>
</div>
Each of the five moments in that thread shows a piece of how Claude Tag works:
1. **Jordan handed Claude a problem, not a prompt.** Typing `@Claude` in a message that asks for something is what starts a working session.
2. **Claude acknowledged, then went quiet.** The "is thinking…" line and the checklist are the progress surface; the silence between 9:02 and 9:06 was the work happening. [How the checklist updates](#how-the-checklist-updates)
3. **Sam steered Claude without `@`-mentioning it again.** Once a session is active in a thread, it belongs to everyone there. [Reply in the thread to steer](#reply-in-the-thread-to-steer)
4. **The work ran somewhere real, with the channel's tools.** Reading fourteen threads happened in a sandbox built for this thread, and the launch plan came through this channel's Drive connection. What a session can reach is set per channel. [Channel access](#channel-access)
5. **The result is in the thread.** The whole channel can see it, use it, and build on it. [What survives between replies](#what-survives-between-replies)
The rest of this page takes each piece apart.
### Start a session
To start a session, type `@Claude` in a Slack message and say what you need in that same message (a question to answer, a task to run, a problem to dig into). Jordan's "`@Claude` where are we on launch prep?" is the whole move. Anyone in the channel can do it.
### Track Claude's progress
Once your message sends, an "is thinking…" line at the bottom of the thread means Claude picked it up. What happens next depends on the size of the ask. Questions and one-off requests get a direct reply. A longer task, like Jordan's, gets a checklist instead. [How the checklist updates](#how-the-checklist-updates) covers how it works and how to read one while it runs.
While a session runs, check in by replying in the same thread. Asking "how's it going?" in the thread is enough; it reads new replies as it works.
Each delivery ends with an "Open session in Claude" link showing the full record of the work, including every tool call. To open it, you need a Claude account in your organization; without one, the link shows a not-found page. If the thread is in a private channel, you also need to be a member of that channel. The page is read-only; follow-ups go in the Slack thread.
### Reply in the thread to steer
Anyone in the channel can steer a running session by replying in its thread, not just the person who started it. That is what Sam did in the walkthrough. Without re-mentioning `@Claude` or starting over, he replied in Jordan's thread, and the session folded his instruction into work already in progress. Add context, redirect the approach, or pick up the result later; a colleague's thread is yours to continue.
Editing or deleting an earlier message doesn't steer the session the way a reply does:
* **Editing a message**: Claude receives a note each time you edit, showing what the message said before the edit and what it says now. It reads the note but doesn't act on it, so it won't reply, redo finished work, or treat words you added as a new request.
* **Deleting a reply**: Claude gets no notification and keeps the version it already read.
* **Deleting the thread's first message**: if the thread already has replies, Claude keeps working and the session stays open. If you delete it before anyone has replied, the session closes. Anything Claude already pushed or posted persists, per [what survives between replies](#what-survives-between-replies), and you start a new thread to pick the task back up.
* **Correcting course**: Claude acts on replies, not on edits or deletions. Say the change in a new reply; the reply is also how you walk back a message it already read.
## Team channels and personal DMs
Where you message Claude determines whose tools and accounts it uses. In a channel, it acts with the connections an organization admin set for that channel, and the work is attributed to its own accounts. In a DM, the same engine runs with your own claude.ai connectors, and the work is attributed to you, except pull requests, which the Claude GitHub App authors from DMs as well.
| Working in… | Access | Attribution | Best for |
| :---------- | :----------------------------------------- | :----------------------- | :--------------------------------- |
| A channel | The channel's connections, set by an admin | The agent's own accounts | Shared work the team should see |
| A DM | Your own claude.ai connectors | You | Personal tasks using your own data |
The Access column is about external systems. A channel session reaches what the channel was granted, and a DM session reaches what your own account is connected to.
Everything below describes channel sessions, where most of the model lives. For the DM side, see [direct message channels](/docs/claude-tag/concepts/agent-identity#direct-message-channels), and for choosing between the two, see [pick the right surface](/docs/claude-tag/users/good-habits#pick-the-right-surface).
## How Claude Tag differs from Cowork and Claude Code
Anthropic offers several ways to work with Claude on real tasks; they reach the same kinds of systems but through different mechanisms.
| | Claude Tag | Cowork | Claude Code |
| :---------------- | :---------------------------------------------------------------- | :------------------------------------ | :------------------------------------------- |
| Where | Slack channels | claude.ai chat | Your terminal or IDE |
| Whose access | The team's: service-account credentials an admin sets per channel | Yours: your personal OAuth connectors | Yours: your local credentials and filesystem |
| Who sees the work | Everyone in the channel | Just you | Just you |
| Best for | Shared work the team should see and steer | Personal research and drafting | Hands-on coding in your own checkout |
The short version: **team work → Claude Tag; personal work → Cowork or Claude Code.** Claude Tag's connections authenticate the agent itself with service accounts, not any person. Personal connectors apply in a Claude Tag DM, which runs on your own claude.ai account, the same way Cowork does.
## Key concepts
Three ideas recur across this page and the rest of these docs.
* **Agent identity**: in channels, Claude acts under its own service accounts that an admin provisions, not as the person who asked. What it can reach is set per channel, so everyone in a channel works with the same access. See [How agent identity works](/docs/claude-tag/concepts/agent-identity).
* **Scheduling and long-running work**: a task can run on a schedule, trigger on a repository event, or keep going across many turns in one thread. The same channel access applies whether a person or a schedule started it. See [Set up routines](/docs/claude-tag/users/proactivity).
* **Memory**: what Claude learns in public channels is saved as workspace memory that any channel can use; private channels keep their own. See [What Claude remembers](/docs/claude-tag/users/memory).
## Lifecycle of a request
Every session, in any channel, follows the same five-step loop.
1. **The session starts.** Someone tags `@Claude` with a task, or a [scheduled routine](/docs/claude-tag/users/proactivity) runs.
2. **A sandbox builds.** Anthropic builds an isolated working environment for this thread.
3. **The working loop runs.** Claude works through the task with the channel's access, editing its checklist in place.
4. **The result lands in the thread.** An answer, a doc, a chart, or a pull request.
5. **A quiet period follows.** The sandbox is released while the thread persists; a new reply rebuilds it and starts the loop again.
<img className="block dark:hidden" src="https://mintcdn.com/claude-ai/5JFKyLlO7sHMMf5J/images/claude-tag/diagrams/session-loop.svg?fit=max&auto=format&n=5JFKyLlO7sHMMf5J&q=85&s=436dd451c4ab3ab0f0b072f85051e844" alt="Flow diagram of one session in five numbered steps. Step 1, tag Claude in with an @Claude message carrying a task. Steps 2 and 3 happen inside the sandbox. Step 2, a sandbox builds, one per thread; step 3, the working loop runs through the task's steps using the channel's access. Step 4, Claude posts the result in the thread as an answer, a doc, a chart, or a pull request. Step 5, a dashed quiet period follows, where the sandbox is released while the thread persists. A dashed return arrow from the quiet period back up into the sandbox shows that a new reply rebuilds it and the loop continues." width="1000" height="400" data-path="images/claude-tag/diagrams/session-loop.svg" />
<img className="hidden dark:block" src="https://mintcdn.com/claude-ai/5JFKyLlO7sHMMf5J/images/claude-tag/diagrams/session-loop-dark.svg?fit=max&auto=format&n=5JFKyLlO7sHMMf5J&q=85&s=616c51832cbb9bc57fe6da5346c6ac85" alt="Flow diagram of one session in five numbered steps. Step 1, tag Claude in with an @Claude message carrying a task. Steps 2 and 3 happen inside the sandbox. Step 2, a sandbox builds, one per thread; step 3, the working loop runs through the task's steps using the channel's access. Step 4, Claude posts the result in the thread as an answer, a doc, a chart, or a pull request. Step 5, a dashed quiet period follows, where the sandbox is released while the thread persists. A dashed return arrow from the quiet period back up into the sandbox shows that a new reply rebuilds it and the loop continues." width="1000" height="400" data-path="images/claude-tag/diagrams/session-loop-dark.svg" />
Steps 1 and 2 are [starting a session](#start-a-session): a message tags Claude in, and a sandbox builds for that thread. Step 3, the working loop, is [the checklist](#how-the-checklist-updates) below. Steps 4 and 5, the result and the quiet period that follows, are covered in [What survives between replies](#what-survives-between-replies).
Every session runs in an ephemeral sandbox Anthropic hosts, a real working environment where it can read documents, run code, build charts, and open pull requests. Claude clones your repositories into the sandbox, edits them there, and pushes changes back to your Git host as a branch or pull request. The sandbox runs the same engine that powers Claude Code on the web, Anthropic's agent for writing and running code, which is why the results are working artifacts rather than chat.
Two threads in the same channel are two separate sessions with separate sandboxes; sessions don't share state directly.
Even with nothing connected, every session starts from the same baseline.
* It reads its own thread and the channel's history, including pinned items
* It searches the workspace's content
* It writes and runs code inside the sandbox, which is how a chart comes out of a posted CSV, or a doc out of a long thread, with nothing wired up
### What Claude posts back
Claude posts each session's result in the thread you asked in, choosing the form that fits the work.
| Form | What it is | When you see it |
| :------------------ | :------------------------------------------------------ | :--------------------------------- |
| A reply | An answer, list, or summary as a Slack message | Questions and short results |
| A file or chart | Attached to the thread the way anyone shares a file | Data, images, generated documents |
| A page kept current | Any of the above, edited in place over time | Digests, indexes, standing reports |
| A hosted page | A web page published on claude.ai, linked in the thread | Dashboards, prototypes, reports |
A hosted page stays available after the session ends, and Claude updates it when you ask in the thread. Anyone with access to the channel can open it; [artifact visibility](/docs/claude-tag/concepts/security-and-data#artifact-visibility) covers the access model. These are the same artifacts [Claude Code publishes](https://code.claude.com/docs/en/artifacts), with channel-based access in place of owner-controlled sharing.
For code work, the result is usually a draft pull request opened under the Claude GitHub App, with the link posted in the thread.
### How the checklist updates
For a longer task, Claude's first reply is a checklist, a live task list that it edits in place as it goes. Slack does not send notifications when a message is edited, so the thread can look frozen while the list is still moving.
A quiet thread usually means Claude is mid-task, not stuck. Open the thread. Checklist items checked off since you last looked mean the work is moving. In the walkthrough, nothing new arrived in anyone's notifications between 9:02 and 9:06, while the checklist ticked through fourteen threads of reading. If the work hits a wall, Claude usually says so in a reply rather than going silent. When a thread stays silent well past what the task should need, treat it as a stuck session; see [Claude reacted or started thinking, then never replied](/docs/claude-tag/users/troubleshooting#claude-reacted-or-started-thinking-then-never-replied).
### Channel access
Connections extend a session's reach into your own systems. An organization admin attaches access to a scope (the organization, a workspace, or a single channel), so the same request can do more in one channel than in another, and everyone in a given channel works with the same capability.
A thread locks in its skills, plugins, and custom instructions when it starts, and a running thread keeps that set. Connections and domain rules are enforced on each request, so one an admin adds mid-thread works in a running thread. Claude doesn't announce a new connection in an existing thread; ask it to use the service by name. A new thread picks up every kind of change, so after a configuration change, start a new top-level thread.
#### How to identify access
Because access is set per channel rather than per person, the way to find out what a session can reach is to ask it, not to guess from your own permissions.
* **Ask what Claude can reach.** In any channel, `@Claude what can you access from this channel?` lists its current reach.
* **If Claude cannot reach something, the channel was not granted access.** Another channel may have the access, and an organization Owner can add it. [How agent identity works](/docs/claude-tag/concepts/agent-identity) covers the model.
* **Personal connectors apply only in DMs.** A connection an admin attaches to a channel is separate from a connector on your personal claude.ai account; anything on your own account works in your DMs, not here.
### One-off and scheduled tasks
A session starts the same way whether a person triggers it or a schedule does. A mention starts a session for that one task, and the sandbox is released once it finishes. A routine runs the same loop on a schedule, a channel watch, or a repository event, with the channel's connections, so a recurring digest or watcher gets the same access a typed request would. See [set up routines](/docs/claude-tag/users/proactivity).
## Session context and memory
Every session runs the same lifecycle; what varies by place and thread is [what it can see](#conversation-context), [what survives idle](#what-survives-between-replies), and [what it remembers](#channel-and-workspace-memory).
### Conversation context
A session reads its own thread and its channel. Mentioning `@Claude` partway into an existing thread gives it up to 50 messages from the start of the thread (the root plus the oldest replies, with other bots' replies filtered out). In long threads, the most recent messages before your mention can fall outside that window, so restate anything critical.
Claude works in channels it has been added to, but workspace search can still find messages by keyword from public channels it's not a member of (the same search any Slack user has). Workspace search is unavailable in [channels that include guests](/docs/claude-tag/admins/restrict-access#restrict-guest-channels). Finding something is broader than being able to act somewhere; to have it participate in a channel directly, invite it with `/invite @Claude`.
### What survives between replies
The thread is durable; the sandbox is not. When a session is idle, its sandbox is released, and it is rebuilt when the next message arrives.
<img className="block dark:hidden" src="https://mintcdn.com/claude-ai/5JFKyLlO7sHMMf5J/images/claude-tag/diagrams/session-lifecycle.svg?fit=max&auto=format&n=5JFKyLlO7sHMMf5J&q=85&s=9a56231787b03f179e8d552d887778fc" alt="Timeline with two lanes. The Slack thread lane is one continuous bar that persists from the moment a task starts. The sandbox lane below it is segmented, built when the task starts, released while the thread goes quiet, and rebuilt fresh when someone replies." width="1000" height="270" data-path="images/claude-tag/diagrams/session-lifecycle.svg" />
<img className="hidden dark:block" src="https://mintcdn.com/claude-ai/5JFKyLlO7sHMMf5J/images/claude-tag/diagrams/session-lifecycle-dark.svg?fit=max&auto=format&n=5JFKyLlO7sHMMf5J&q=85&s=0693a90b98baa729dcacfd35261f6494" alt="Timeline with two lanes. The Slack thread lane is one continuous bar that persists from the moment a task starts. The sandbox lane below it is segmented, built when the task starts, released while the thread goes quiet, and rebuilt fresh when someone replies." width="1000" height="270" data-path="images/claude-tag/diagrams/session-lifecycle-dark.svg" />
| | Survives idle periods |
| :------------------------------------- | :---------------------------------- |
| The conversation and its context | Yes |
| Channel memory | Yes |
| Work pushed, posted, or opened as a PR | Yes, in the external system |
| Files that exist only in the sandbox | No. Claude recreates them if asked. |
For long tasks, ask it to push branches and post drafts as it goes, so deliverables are saved somewhere durable while the work is still running. See [Good habits](/docs/claude-tag/users/good-habits#give-every-task-a-definition-of-done).
### Channel and workspace memory
Memory follows places the same way access does, and it accumulates for the team rather than for any individual.
Memory from public channels is shared across the workspace, so a decision recorded while working in #launch-week is available when someone asks in #gtm-west. When Claude cites something from a channel you have never used it in, it is reading workspace memory, not a record about you.
Private channels read workspace memory while working, and what they save is written to that channel's own store rather than the workspace store.
To see what it holds, ask `@Claude what do you remember about this channel?`. Anyone in the channel can correct or remove entries. [What Claude Tag remembers](/docs/claude-tag/users/memory) covers reading, correcting, and adding to memory.
The whole model so far fits in one picture, with access set at the scope, memory shared from public channels, work in progress per thread, and DMs outside all of it.
<img className="block dark:hidden" src="https://mintcdn.com/claude-ai/5JFKyLlO7sHMMf5J/images/claude-tag/diagrams/three-levels.svg?fit=max&auto=format&n=5JFKyLlO7sHMMf5J&q=85&s=511231c5561da4ade26f91cd395488fa" alt="Diagram showing three nested levels. A scope container holds two channels, #platform-eng and #gtm-west, and each channel holds its own threads, like 'fix checkout latency' or 'pull deal state'. The private channel is marked with a lock. Callouts mark what lives at each level (identity and access at the scope; memory, shared from public channels across the workspace while private channels keep their own; and work in progress at the thread). A DM with Claude sits below, outside every scope, and runs on your own account." width="1000" height="648" data-path="images/claude-tag/diagrams/three-levels.svg" />
<img className="hidden dark:block" src="https://mintcdn.com/claude-ai/5JFKyLlO7sHMMf5J/images/claude-tag/diagrams/three-levels-dark.svg?fit=max&auto=format&n=5JFKyLlO7sHMMf5J&q=85&s=e593920bd85a97c285a56f7b9d3e5019" alt="Diagram showing three nested levels. A scope container holds two channels, #platform-eng and #gtm-west, and each channel holds its own threads, like 'fix checkout latency' or 'pull deal state'. The private channel is marked with a lock. Callouts mark what lives at each level (identity and access at the scope; memory, shared from public channels across the workspace while private channels keep their own; and work in progress at the thread). A DM with Claude sits below, outside every scope, and runs on your own account." width="1000" height="648" data-path="images/claude-tag/diagrams/three-levels-dark.svg" />
DMs are outside this picture; they run on your own account, as covered in [Team channels and personal DMs](#team-channels-and-personal-dms) above. Owners can disable DMs organization-wide; see [Allow or disable direct messages](/docs/claude-tag/admins/restrict-access#allow-or-disable-direct-messages).
## Related resources
* [Getting started](/docs/claude-tag/users/getting-started): hand Claude your first task
* [How agent identity works](/docs/claude-tag/concepts/agent-identity): why an admin sets access per channel, and how credentials stay out of the sandbox
* [Good habits](/docs/claude-tag/users/good-habits): write tasks that survive the sandbox lifecycle
claude-tag/concepts/security-and-data First recorded · 108 lines, first recorded
# Security and data handling ## How a request travels ### Compute and the sandbox ### Credential storage ### Network egress ### Service accounts ### Isolate credentials between channels ## Artifact visibility ## Member access ## Related resources
The first capture of this source. The page was already there, and this is what it said.
# Security and data handling > Claude Tag runs in an isolated sandbox where outbound traffic is default-deny and reaches only allowed hosts. Covers sandbox isolation, credential storage, network egress, service accounts, isolating credentials between channels and what one channel can reach, who can open a published artifact, and which members can invoke Claude. export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>; <BetaNote /> In channels, Claude acts under its own service accounts that an Owner provisions. By default it can read and post in Slack channels it's been added to and search public channels by keyword; it has no access to your external systems until an Owner adds connections. Each connection is scoped to specific channels and workspaces, and the actions Claude takes in connected tools are attributable to its own service accounts. Every channel request, whether a person typed it or a schedule triggered it, follows the same path: it runs in a sandbox Anthropic hosts, leaves that sandbox only through Agent Proxy, and reaches your systems under the agent's own accounts. DMs run on the user's own claude.ai account instead and are covered separately on [How agent identity works](/docs/claude-tag/concepts/agent-identity#direct-message-channels). ## How a request travels Each Slack thread runs in its own sandbox, and every outbound call from that sandbox passes through the same checkpoints. <img className="block dark:hidden" src="https://mintcdn.com/claude-ai/5JFKyLlO7sHMMf5J/images/claude-tag/diagrams/request-path.svg?fit=max&auto=format&n=5JFKyLlO7sHMMf5J&q=85&s=e8776cf0edd1f3ec912b9b044c9cc838" alt="Diagram showing the request path across three zones. A task mentioned in your Slack workspace runs in a session sandbox on Anthropic's infrastructure, one sandbox per thread, holding no credentials. Outbound requests pass to Agent Proxy, which injects the credential drawn from the credential store; a request matching no rule is blocked. Credentialed requests reach your systems, like GitHub, a data warehouse, monitoring, or any HTTP API. A dashed return path shows results posting back in the thread, as Claude." width="1000" height="440" data-path="images/claude-tag/diagrams/request-path.svg" /> <img className="hidden dark:block" src="https://mintcdn.com/claude-ai/5JFKyLlO7sHMMf5J/images/claude-tag/diagrams/request-path-dark.svg?fit=max&auto=format&n=5JFKyLlO7sHMMf5J&q=85&s=a2ed5f3270989c3ed3d9b9a78a72bff0" alt="Diagram showing the request path across three zones. A task mentioned in your Slack workspace runs in a session sandbox on Anthropic's infrastructure, one sandbox per thread, holding no credentials. Outbound requests pass to Agent Proxy, which injects the credential drawn from the credential store; a request matching no rule is blocked. Credentialed requests reach your systems, like GitHub, a data warehouse, monitoring, or any HTTP API. A dashed return path shows results posting back in the thread, as Claude." width="1000" height="440" data-path="images/claude-tag/diagrams/request-path-dark.svg" /> | Checkpoint | The guarantee | | :----------- | :------------------------------------------------------------------------------------------------------------- | | The sandbox | Runs on Anthropic's infrastructure and holds no credentials | | Agent Proxy | Injects credentials from the credential store at request time, and blocks traffic to unlisted hosts by default | | Your systems | See the agent's own accounts, so its actions there are attributable | ### Compute and the sandbox Sessions run in sandboxes Anthropic hosts, the same managed compute behind [Claude Code on the web](https://code.claude.com/docs/en/web-quickstart). Each Slack thread gets its own sandbox. When a thread goes quiet, its sandbox is released; replying in the thread builds a fresh one. What persists across that release and rebuild: * **Persists:** The thread, its visible work, and anything pushed to a branch, opened as a pull request, or posted into Slack. * **Does not persist:** Files that existed only inside the sandbox. To keep generated files, ask Claude to push them to a branch or post them in the thread. Claude Tag retains channel memory and session transcripts. Because of that retention, Claude Tag isn't available to organizations with Zero Data Retention (ZDR) enabled. ### Credential storage Credentials you provision are kept in a separate credential store, not in the proxy itself. When an outbound request matches a rule, [Agent Proxy](/docs/claude-tag/concepts/agent-identity#agent-proxy), the network layer between the sandbox and any external host, retrieves the credential from that store and injects it at the boundary, so the model and the sandbox are not given the key. This means: * **A saved credential is not displayed again.** The setup screens are write-only. * **The credential travels only to the hosts you named** when you added the connection. * **You can narrow the credential further**, to one host, one path prefix, or read-only methods, in [Add connections](/docs/claude-tag/admins/add-connections). ### Network egress Outbound traffic from a channel session's sandbox is default-deny. Requests go only to hosts an allow layer covers, and the layers are a [connection's Allowed websites](/docs/claude-tag/admins/connections/custom#fill-out-the-custom-tool-form), the [bundle's Domains tab](/docs/claude-tag/admins/add-connections#allow-a-host-without-a-credential), and the network access setting of the [environment](/docs/claude-tag/concepts/glossary#environment) the scope's sessions run on. A new environment's default level, Trusted access, already covers a [documented set of package registries and developer hosts](https://code.claude.com/docs/en/cloud-environments#default-allowed-domains). Every request gets one of three outcomes: * **Matches a credential rule.** The credential is attached at the boundary and the request proceeds. * **Matches only an allowlist.** The host is on the Domains tab or allowed by the environment's network access setting; the request is sent without credentials. * **Matches nothing.** The request is blocked outright; the host is unreachable rather than merely unauthenticated. <img className="block dark:hidden" src="https://mintcdn.com/claude-ai/Tf9m3OvmKAZp3uXC/images/claude-tag/diagrams/proxy-decision.svg?fit=max&auto=format&n=Tf9m3OvmKAZp3uXC&q=85&s=a4aecacf4e23944d5a2ecaacf6cf95a1" alt="Flow diagram across two zones. Inside Anthropic's infrastructure, a session sandbox that holds no credentials sends every outbound request to Agent Proxy, which matches it against admin rules. Three outcomes branch toward your systems: on a rule match, the credential is attached at the boundary and the request proceeds; on an allowlist-only match, from the bundle's Domains list or the environment's network access setting, the request is sent without credentials; on no match, the request is blocked entirely (the default-deny outcome) and the host is unreachable." width="1000" height="400" data-path="images/claude-tag/diagrams/proxy-decision.svg" /> <img className="hidden dark:block" src="https://mintcdn.com/claude-ai/Tf9m3OvmKAZp3uXC/images/claude-tag/diagrams/proxy-decision-dark.svg?fit=max&auto=format&n=Tf9m3OvmKAZp3uXC&q=85&s=d2ad1dd61b859e9f2aebfceedbc247c3" alt="Flow diagram across two zones. Inside Anthropic's infrastructure, a session sandbox that holds no credentials sends every outbound request to Agent Proxy, which matches it against admin rules. Three outcomes branch toward your systems: on a rule match, the credential is attached at the boundary and the request proceeds; on an allowlist-only match, from the bundle's Domains list or the environment's network access setting, the request is sent without credentials; on no match, the request is blocked entirely (the default-deny outcome) and the host is unreachable." width="1000" height="400" data-path="images/claude-tag/diagrams/proxy-decision-dark.svg" /> Because requests to any other host are blocked, data can only leave the sandbox to hosts an allow layer covers. An admin sets the Allowed websites list on each connection and the Domains tab on each bundle. An admin sets the environment's network access level, which defaults to Trusted access, from the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings). See [Set allowed websites](/docs/claude-tag/admins/add-connections#set-allowed-websites) and [Allow a host without a credential](/docs/claude-tag/admins/add-connections#allow-a-host-without-a-credential). Organizations can opt in to allow-all egress, where a `*` entry on a bundle's Domains tab admits requests to any host on the ports that entry lists, still without credentials. Private and internal network addresses and cloud metadata endpoints remain blocked. Allow-all egress is off by default and enabled per organization by Anthropic; see [Allow all hosts](/docs/claude-tag/admins/add-connections#allow-all-hosts). ### Service accounts In channels, Claude acts under service credentials of its own, not under the account of the person who tagged it. The Slack surface is the Claude app, code work goes through the Claude GitHub App, and every other connected tool uses a service account an Owner provisions in an Access bundle. See [How agent identity works](/docs/claude-tag/concepts/agent-identity) for the full model. A connection belongs to that agent identity and is shared by everyone the bundle's scope covers. Anyone in a channel under that scope can ask Claude to act with the credential, so whatever the connected account can read or write is available to every member of those channels. Connect a dedicated identity you control for each service, such as a `[email protected]` seat or a native service account, rather than a personal login. A dedicated account keeps the agent's actions separately auditable in each tool's logs and lets you revoke its access without affecting a person; see [Create a dedicated account per service](/docs/claude-tag/admins/add-connections#create-a-dedicated-account-per-service). DMs with `@Claude` run on the user's own claude.ai account instead, with that user's personal connectors, and work there is attributed to them, except pull requests, which the Claude GitHub App authors from DMs as well. Personal connectors apply only in DMs, never in channels. Owners can disable DMs organization-wide; see [Allow or disable direct messages](/docs/claude-tag/admins/restrict-access#allow-or-disable-direct-messages). ### Isolate credentials between channels A channel session can use only the [Access bundles](/docs/claude-tag/admins/add-connections) attached in one of three places: * **The channel itself.** A bundle you attach here applies in that channel only. * **The channel's workspace.** A bundle you attach here applies in every channel of that workspace. * **[Default Slack access](/docs/claude-tag/admins/attach-to-scope#how-scopes-inherit).** The organization-wide root; a bundle you attach here applies in every channel of every paired workspace. A bundle attached anywhere else in your organization is invisible to the session, and no request from the session's sandbox can carry a credential from a bundle outside those three scopes. For example, if you attach a bundle holding finance credentials to one private channel, sessions in every other channel run as if that credential doesn't exist. If you attach the same bundle to a workspace or to Default Slack access instead, every channel beneath it gets that access, so isolation comes from where you attach the bundle, not from the bundle itself. Confine a credential to one channel in three steps: 1. Attach its bundle to that channel and nowhere broader. 2. Keep the channel private. A bundle on a public channel [grants its access to anyone who joins](/docs/claude-tag/admins/attach-to-scope#attach-to-a-channel). 3. Check the channel's **Access summary** on the [Slack tab in admin settings](/docs/claude-tag/admins/attach-to-scope). It shows the access the channel actually gets, including what it inherits from the workspace and Default Slack access. Claude [doesn't operate in externally shared channels](/docs/claude-tag/admins/restrict-access#externally-shared-channels), so a channel shared with another company never has a session to isolate. Isolating a credential doesn't isolate what Claude knows. What it learns in a public channel becomes [workspace memory](/docs/claude-tag/users/memory) that sessions in the workspace's other channels can read, and it can [search public channels by keyword](/docs/claude-tag/admins/restrict-access#controls-that-aren%E2%80%99t-available) without being added to them, the same way any workspace member can. ## Artifact visibility A session can publish an artifact, a web page hosted on claude.ai with the link posted in the thread, and the page stays available after the sandbox is released. Anyone with access to the source Slack channel can open it, which in a public channel covers everyone in the workspace. Someone who opens the link without that access sees a request-access prompt rather than the page. There is no share setting for anyone to change, and updates go through Claude in the thread. Artifacts you publish from your own Claude Code sessions work differently: they belong to you, and you control who can open them, with sharing options that depend on your plan and organization settings. See the [Claude Code artifacts documentation](https://code.claude.com/docs/en/artifacts). ## Member access By default, anyone in a connected Slack workspace can invoke Claude in channels, with or without a Claude account. An Owner can turn on a restriction toggle to narrow that: on Team plans it limits Claude to people with a Claude account in your organization, and on Enterprise plans it limits Claude to members whose role grants the **Claude Tag in Slack** capability. See [Restrict who can use Claude](/docs/claude-tag/admins/restrict-access#members). The toggle governs DMs as well as channels. ## Related resources * [How agent identity works](/docs/claude-tag/concepts/agent-identity): the identity model in full, including DM attribution * [Restrict where Claude Tag operates](/docs/claude-tag/admins/restrict-access): the controls that exist and the ones that don't * [Audit Claude Tag activity](/docs/claude-tag/admins/audit): the trails for tracing what it did
claude-tag/concepts/settings-map First recorded · 56 lines, first recorded
# Claude Tag settings map ## The Claude Tag admin page ## Spend limits and usage ## The Configure page ## Personal connectors on claude.ai ## Claude Tag versus Claude Managed Agents ## Related resources
The first capture of this source. The page was already there, and this is what it said.
# Claude Tag settings map > Claude Tag settings map: the admin page for access and behavior, the usage page for spend limits, the in-Slack Configure link for channel instructions, and personal connectors for DMs. Claude Managed Agents is configured separately on the Claude Platform. export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>; <BetaNote /> Claude Tag's settings live on claude.ai, split across a few pages that each own a different kind of setting. Which page you need depends on what you're changing. The table maps each surface to what it controls. | Surface | Who changes it | What it controls | | :--------------------------------------------------------------------------------------------- | :------------------------------------------------- | :------------------------------------------------------------------------------------------------------- | | [Claude Tag admin page](https://claude.ai/admin-settings/claude-tag) | An Owner in your Claude organization | Access, behavior, and restrictions for channels, per [scope](/docs/claude-tag/concepts/glossary#scope) | | [Usage page](https://claude.ai/admin-settings/usage/claude-tag) | An admin | Spend limits and per-channel usage analytics | | The **Configure** link in any Claude reply footer | Channel members, unless an admin restricts editing | One channel's instructions and whether Claude replies there without an @-mention | | [Customize > Connectors](https://claude.ai/customize/connectors) on your own claude.ai account | You | Which of your personal tools apply in [DMs](/docs/claude-tag/concepts/agent-identity#direct-message-channels) | Channel memory and routines aren't in the table because you change them by talking to Claude in the channel; see [what anyone can change from the channel](/docs/claude-tag/admins/customize#change-behavior-from-the-channel). ## The Claude Tag admin page Everything an Owner configures for channels lives at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag). Settings there apply per scope (a channel, a workspace, or the whole organization). A scope without its own setting inherits from its parent, and a channel's setting overrides its workspace's, so two channels can run with different connections, models, and instructions. Most controls are Owner-only; the [permissions table](/docs/claude-tag/admins/restrict-access#permissions-by-role) lists each action and who can take it. * **Access bundles**: the connections, domain entries, repository grants, and plugins Claude uses in the channels a bundle covers. See [Give Claude access](/docs/claude-tag/admins/add-connections). * **Custom instructions**: standing guidance Claude reads in every session on a scope. See [Add custom instructions](/docs/claude-tag/admins/attach-to-scope#add-custom-instructions). * **Default model**: the model new sessions in a scope start on. The picker shows the models your organization allows for Claude Code, leaving out any that Claude Tag doesn't support, so it can be missing models you see in Claude Code itself. See [Choose the model for a scope](/docs/claude-tag/admins/customize#choose-the-model-for-a-scope). * **Auto mode allow rules**: plain sentences that pre-approve actions Claude's permission checker would otherwise flag or stop in a scope's sessions. See [Auto mode allow rules](/docs/claude-tag/admins/customize#auto-mode-allow-rules). * **Workspace pairing and restrictions**: which Slack workspaces are paired, whether DMs are allowed, guest-channel behavior, who can invoke Claude, and which generation of the app answers in each scope. See [Restrict where Claude Tag operates](/docs/claude-tag/admins/restrict-access). ## Spend limits and usage Spend limits and usage analytics live at [`claude.ai/admin-settings/usage/claude-tag`](https://claude.ai/admin-settings/usage/claude-tag), a different page than the Claude Tag admin page. It holds the organization-wide spend limit, the default spend limit for channels, per-channel limits, and the per-channel spend breakdown. If your organization bills through a reseller, this page is not available. See [Set a spend limit](/docs/claude-tag/admins/set-spend-limit) for funding the usage balance and what users see when a limit is reached. ## The Configure page Every Claude reply in Slack ends with a footer, and its **Configure** link opens a claude.ai page for that channel. Anyone in the channel who is also a member of your Claude organization can edit the **Channel instructions** field there, unless an admin has [restricted editing to admins](/docs/claude-tag/admins/attach-to-scope#restrict-who-can-set-channel-instructions). The page's **Respond automatically** toggle controls whether Claude replies in the channel without an @-mention; see [Turn automatic replies on or off](/docs/claude-tag/users/when-claude-responds#turn-automatic-replies-on-or-off). The page also shows the channel's **Connections**, which admins set, so members can see the list but not change it. The Configure page and the **Custom instructions** field on the scope's panel in admin settings write the same instructions, so a change from either place is visible in the other. See [Configure Claude for a channel](/docs/claude-tag/users/good-habits#configure-claude-for-a-channel). ## Personal connectors on claude.ai Connectors you add to your own claude.ai account, under **Customize > Connectors**, apply only in DMs with Claude, because [a DM runs on your own account](/docs/claude-tag/concepts/agent-identity#direct-message-channels). A channel uses only the connections an admin attached to it, and personal connectors never apply there. Slack has no connector settings of its own. See [connectors on claude.ai](/docs/connectors/overview) for setting one up, and [the troubleshooting entry](/docs/claude-tag/users/troubleshooting#a-connector-works-on-claude-ai-but-not-in-slack) if a connector you use on claude.ai is missing in Slack. ## Claude Tag versus Claude Managed Agents [Claude Managed Agents](https://platform.claude.com/docs/en/managed-agents/overview) is a separate product for developers, a pre-built agent harness that runs in managed infrastructure. You configure it on the Claude Platform through the Managed Agents API, and access requires a Claude API key. An agent there is defined by its model, system prompt, tools, MCP servers, and skills. Environments choose where its sessions run (a cloud sandbox, or a self-hosted sandbox on your own infrastructure), and scheduled deployments run it on a cron schedule. The two products don't share settings. Nothing on the Claude Tag admin page configures a Managed Agent, and an agent defined on the Claude Platform doesn't change how Claude behaves in Slack. ## Related resources * [Customize Claude Tag](/docs/claude-tag/admins/customize): the layers that shape Claude's behavior in a channel and who sets each one * [How agent identity works](/docs/claude-tag/concepts/agent-identity): why channels and DMs use different access * [Set up Claude Tag](/docs/claude-tag/admins/setup-overview): where each setting is first created during setup
claude-tag/overview First recorded · 220 lines, first recorded
# Work with Claude Tag ## Plans that include Claude Tag ## Where Claude Tag runs ## Billing and spend limits ## Put Claude Tag to work ## Set Claude Tag up once for everyone ## Where to start with Claude Tag
The first capture of this source. The page was already there, and this is what it said.
# Work with Claude Tag
> Claude Tag puts Claude in your Slack channels with admin-governed access. See what to hand it, how setup works, and where to start as an admin or end user.
<div className="tm-hero">
<div className="tm-hero-copy">
<span className="tm-pill">Public Beta</span>
<p className="tm-hero-title">Tag <span className="tm-hero-at">@Claude</span> in. Get results back in the thread.</p>
<p className="tm-hero-lede">Anyone in a channel can tag Claude into a problem and hand it work: reproduce a bug and open a pull request, turn a decision thread into a doc, assemble the state of a project. It posts a checklist in the thread as it goes, and the whole exchange stays visible to the channel.</p>
<div className="tm-hero-ctas">
<a className="tm-btn tm-btn-dark" href="/docs/docs/claude-tag/admins/setup-overview">I'm setting it up →</a>
<a className="tm-btn tm-btn-light" href="#put-claude-tag-to-work">Use it in your channel ↓</a>
</div>
</div>
<div className="tm-slack">
<div className="tm-slack-head">
<span className="tm-slack-chan"># platform-eng</span>
<span className="tm-slack-members">38 members</span>
</div>
<div className="tm-slack-body">
<div className="tm-msg">
<span className="tm-avatar tm-avatar-user" aria-hidden="true">D</span>
<div className="tm-msg-col">
<div className="tm-msg-meta"><span className="tm-msg-name">Dana</span><span className="tm-msg-time">2:14 PM</span></div>
<p>checkout has felt slow all morning — anyone else seeing it?</p>
</div>
</div>
<div className="tm-msg">
<span className="tm-avatar tm-avatar-user tm-avatar-b" aria-hidden="true">L</span>
<div className="tm-msg-col">
<div className="tm-msg-meta"><span className="tm-msg-name">Leo</span><span className="tm-msg-time">2:15 PM</span></div>
<p>same. <span className="tm-mention">@Claude</span> can you investigate? Compare latency against this morning's deploy and find what's causing it.</p>
</div>
</div>
<div className="tm-msg">
<span className="tm-avatar tm-avatar-claude">
<img src="https://mintcdn.com/claude-ai/5JFKyLlO7sHMMf5J/images/claude-tag/logo/clay-spark.svg?fit=max&auto=format&n=5JFKyLlO7sHMMf5J&q=85&s=032101c39ca3b1af9f72fc4af8e60d12" alt="" noZoom width="94" height="94" data-path="images/claude-tag/logo/clay-spark.svg" />
</span>
<div className="tm-msg-col">
<div className="tm-msg-meta"><span className="tm-msg-name">Claude</span><span className="tm-msg-app">APP</span><span className="tm-msg-time">2:15 PM</span></div>
<p>On it. I'll compare latency before and after the deploy, track down the cause, and report back here.</p>
<div className="tm-tasklist">
<span className="tm-task-done"><span className="tm-sr">Done: </span>Pulled p99 latency from Datadog</span>
<span className="tm-task-done"><span className="tm-sr">Done: </span>Diffed deploy 4f2c1 against main</span>
<span className="tm-task-done"><span className="tm-sr">Done: </span>Reproduced the slow query locally</span>
<span className="tm-task-doing"><span className="tm-sr">In progress: </span>Opening a pull request with the fix…</span>
</div>
</div>
</div>
</div>
</div>
</div>
## Plans that include Claude Tag
Claude Tag is available on Team and Enterprise plans, on Anthropic's first-party service. It isn't available on individual plans (Free, Pro, or Max), or for third-party deployments. To use it, your organization pairs its Slack workspace with its Claude organization; see [the setup overview](/docs/claude-tag/admins/setup-overview) for the full prerequisites.
If you're choosing between Claude products for Slack-shaped work, [how Claude Tag differs from Cowork and Claude Code](/docs/claude-tag/concepts/how-it-works#how-claude-tag-differs-from-cowork-and-claude-code) compares them directly: team work in shared channels is Claude Tag; personal work on your own files is Cowork or Claude Code.
## Where Claude Tag runs
Claude Tag works in Slack. You interact with it by writing in a Slack channel, thread, or direct message, and it replies there. Mention `@Claude` in a channel to guarantee it picks the message up.
When Claude works on a task, it runs in an ephemeral sandbox hosted by Anthropic, not on your computer or inside your network. The sandbox is created when a conversation starts, holds any code or files Claude is working with, and is discarded when the conversation goes idle. See [how Claude Tag works](/docs/claude-tag/concepts/how-it-works) for the full lifecycle.
You extend what Claude can reach, like your repositories, ticketing systems, data warehouses, and custom tools, through [connections](/docs/claude-tag/admins/add-connections), [plugins, and skills](/docs/claude-tag/admins/customize). An Owner configures these per scope (a channel, a workspace, or the whole organization), separately from any connectors an individual user has set up in their own claude.ai account.
<div className="tm-route-grid">
<div className="tm-card">
<a className="tm-band tm-band-admins" href="/docs/docs/claude-tag/admins/setup-overview">
<span className="tm-band-text">
<span className="tm-band-label">For administrators</span>
<span className="tm-band-title">Provision the identity</span>
</span>
<img src="https://mintcdn.com/claude-ai/5JFKyLlO7sHMMf5J/images/claude-tag/illustrations/Hand-Key.svg?fit=max&auto=format&n=5JFKyLlO7sHMMf5J&q=85&s=1b7a9675728f971bc7a4663c7f1ea599" alt="" noZoom width="1000" height="1000" data-path="images/claude-tag/illustrations/Hand-Key.svg" />
</a>
<div className="tm-qrows">
<a className="tm-qrow" href="/docs/docs/claude-tag/admins/setup-overview">
<span className="tm-qrow-text">
<span className="tm-qrow-q">Where do I start?</span>
<span className="tm-qrow-sub">The four setup steps, what to have ready, and what to test first</span>
</span>
</a>
<a className="tm-qrow" href="/docs/docs/claude-tag/concepts/agent-identity">
<span className="tm-qrow-text">
<span className="tm-qrow-q">What can Claude Tag access?</span>
<span className="tm-qrow-sub">How admins set access per channel, and where credentials are stored</span>
</span>
</a>
<a className="tm-qrow" href="/docs/docs/claude-tag/admins/add-connections">
<span className="tm-qrow-text">
<span className="tm-qrow-q">How do I connect each service?</span>
<span className="tm-qrow-sub">Credential types, allowed hosts, and what each connection lets Claude reach</span>
</span>
</a>
</div>
</div>
<div className="tm-card">
<a className="tm-band tm-band-users" href="#put-claude-tag-to-work">
<span className="tm-band-text">
<span className="tm-band-label">For end users</span>
<span className="tm-band-title">Put Claude Tag to work</span>
</span>
<img src="https://mintcdn.com/claude-ai/5JFKyLlO7sHMMf5J/images/claude-tag/illustrations/Hand-NodePair.svg?fit=max&auto=format&n=5JFKyLlO7sHMMf5J&q=85&s=c64df4c6d27a6da752aa32c9e0622781" alt="" noZoom width="1000" height="1000" data-path="images/claude-tag/illustrations/Hand-NodePair.svg" />
</a>
<div className="tm-qrows">
<a className="tm-qrow" href="/docs/docs/claude-tag/users/getting-started">
<span className="tm-qrow-text">
<span className="tm-qrow-q">How do I hand Claude Tag a task?</span>
<span className="tm-qrow-sub">Mention Claude in any channel it's in, with nothing to install</span>
</span>
</a>
<a className="tm-qrow" href="/docs/docs/claude-tag/users/use-cases">
<span className="tm-qrow-text">
<span className="tm-qrow-q">What is Claude Tag good at?</span>
<span className="tm-qrow-sub">Use cases for coding, data, incidents, and GTM</span>
</span>
</a>
<a className="tm-qrow" href="/docs/docs/claude-tag/users/good-habits">
<span className="tm-qrow-text">
<span className="tm-qrow-q">How do I get good results?</span>
<span className="tm-qrow-sub">Good habits for scoping and reviewing work</span>
</span>
</a>
<a className="tm-qrow" href="/docs/docs/claude-tag/users/memory">
<span className="tm-qrow-text">
<span className="tm-qrow-q">What does Claude Tag remember?</span>
<span className="tm-qrow-sub">Channel memory, what's shared across the workspace, and who can see what</span>
</span>
</a>
<a className="tm-qrow" href="/docs/docs/claude-tag/users/proactivity">
<span className="tm-qrow-text">
<span className="tm-qrow-q">Can Claude Tag run tasks on a schedule?</span>
<span className="tm-qrow-sub">Scheduled jobs, channel watching, and triggers</span>
</span>
</a>
</div>
</div>
</div>
## Billing and spend limits
Adding Claude to Slack doesn't add a per-seat charge. Channel and thread work is billed by usage instead: it draws from a **usage balance**, an amount in your organization's billing currency that an Owner funds. A [spend limit](/docs/claude-tag/admins/set-spend-limit) caps how much of that balance Claude Tag can use each billing period.
Direct messages don't draw from this balance. A DM runs on the sender's own claude.ai account and follows that seat's usual usage limits, so the organization spend limit doesn't apply to it.
To learn what your team's usage costs, run a pilot with a spend limit set and watch the per-channel breakdown on the [usage page in your admin settings](https://claude.ai/admin-settings/usage/claude-tag). Your organization may already have a [launch usage credit](https://support.claude.com/en/articles/15575654-claude-tag-launch-promo-for-claude-team-and-enterprise) to run that pilot against before it funds the balance itself.
[Set a spend limit](/docs/claude-tag/admins/set-spend-limit) covers how to fund the balance on each plan, set the limit, and what happens when usage reaches it.
<div className="tm-eyebrow"><span className="tm-swatch tm-swatch-users" />For end users</div>
## Put Claude Tag to work
If Claude Tag is in your channel, you can use it now. (If it isn't there yet, an Owner in your Claude organization runs setup: see [Set up Claude Tag](/docs/claude-tag/admins/setup-overview).) Anyone in the channel can hand it work, and channel work bills to the organization, not to you.
What it can reach depends on the channel you're in, not on who you are. The fastest way to find out is to ask it: `@Claude what can you access from this channel?` Or, if you're signed in to your Claude organization, click **Configure** in the footer of any Claude reply to see the channel's connections.
The one exception is a DM, where it runs on your own claude.ai account instead of the channel's setup. Owners can disable DMs organization-wide; see [Allow or disable direct messages](/docs/claude-tag/admins/restrict-access#allow-or-disable-direct-messages).
Begin with [Get started](/docs/claude-tag/users/getting-started), which covers your first message, what you see while it works, and how to shape its behavior in your channel.
<div className="tm-eyebrow"><span className="tm-swatch tm-swatch-admins" />For administrators</div>
## Set Claude Tag up once for everyone
Installing the Claude app in Slack is a prerequisite, not the setup. Setup is provisioning an identity. Claude Tag starts with no access to your external systems; you choose its credentials and repositories (an [Access bundle](/docs/claude-tag/concepts/glossary#access-bundle)), and which workspaces and channels they apply to.
You configure this once, at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), and everyone in those places can use Claude Tag immediately, with no per-user setup. You must be an Owner in your Claude organization to run setup.
[Set up Claude Tag](/docs/claude-tag/admins/setup-overview) walks the four provisioning steps, from creating the identity to attaching it to your first channel.
<div className="tm-strip">
<div className="tm-strip-head">
<p className="tm-strip-title">Security review</p>
<a className="tm-strip-all" href="/docs/docs/claude-tag/concepts/security-and-data">Security and data handling</a>
</div>
<p>The security model, what admins can and can't restrict, audit trails, and network requirements.</p>
</div>
## Where to start with Claude Tag
<CardGroup cols={2}>
<Card title="Set up Claude Tag" icon="gear" href="/docs/claude-tag/admins/setup-overview" horizontal arrow>
Admins: provision the identity and connect your first channel
</Card>
<Card title="Hand Claude Tag your first task" icon="paper-plane" href="/docs/claude-tag/users/getting-started" horizontal arrow>
It's already in your channel: send your first message
</Card>
<Card title="How Claude Tag works" icon="diagram-project" href="/docs/claude-tag/concepts/how-it-works" horizontal arrow>
The session model, what it can read, and how memory follows places
</Card>
<Card title="Use case library" icon="list" href="/docs/claude-tag/users/use-cases" horizontal arrow>
Prompts to paste, by team and connection
</Card>
</CardGroup>
claude-tag/users/commands First recorded · 114 lines, first recorded
# Commands Claude Tag understands ## See the commands available to you ## Restart a stuck or wrong-context session ## Mute or unmute a thread ## Send feedback ## List the routines in a channel ## Continue a thread in another channel ## Related resources
The first capture of this source. The page was already there, and this is what it said.
# Commands Claude Tag understands
> A few exact, bang-prefixed words after an @-mention run a fixed action instead of starting a normal turn: see the command list, restart a stuck or wrong-context session, mute or unmute a thread, send feedback, list a channel's routines, and continue a thread's conversation in another channel.
export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
<BetaNote />
A command is `@Claude` followed immediately by one of a few exact words starting with `!`. Claude matches the message against that word and runs a fixed action instead of starting a normal turn. `!help`, `!restart`, `!mute`, and `!unmute` must stand alone: adding extra words, as in `!restart` with words tacked on, makes the message an ordinary prompt instead. `!feedback`, `!routines`, and `!fork` accept text after the command, covered below.
## See the commands available to you
```text wrap theme={null}
@Claude !help
```
Claude replies with the commands it understands in your workspace. The list can differ by workspace, since a command can be enabled for some workspaces and not others.
## Restart a stuck or wrong-context session
```text wrap theme={null}
@Claude !restart
```
Use this when a session is stuck, or when it's carrying context you don't want the next reply to build on. Claude archives the current session and starts a fresh one in its place.
Every thread Claude takes part in runs a session of its own, holding that one conversation. Some channels have one more session on top of the per-thread ones. That session belongs to the channel itself, and it's the session Claude works from at the channel's top level, outside any thread. When Claude [replies to a top-level message no one mentioned it in](/docs/claude-tag/users/when-claude-responds), the channel's session is the one replying.
Where you run `!restart` picks which session gets replaced:
* **In a thread**, `!restart` replaces that thread's session. The fresh session rereads the thread, so it keeps what's in the messages and drops everything else the old one was carrying.
* **At a channel's top level**, `!restart` replaces the channel's session. The fresh session picks up from where the old one left off.
Claude confirms once the replacement session is ready. If the restart can't complete, Claude tells you and you can run `!restart` again.
You need the same access to run `!restart` that you'd need to message the session directly; someone who can only observe a thread can't restart it.
## Mute or unmute a thread
```text wrap theme={null}
@Claude !mute
```
Run `!mute` in a thread Claude is part of, and Claude stops replying there. Muting is per thread by design. Other threads, the channel's top level, [routine](/docs/claude-tag/users/proactivity) posts, and service notices are unaffected.
There's no channel-level mute. If you run `!mute` at a channel's top level, Claude posts this hint:
```text wrap theme={null}
:mute: Muting works per thread — reply `@Claude !mute` (or `!unmute`) inside the thread you mean.
```
To quiet unprompted replies across a whole channel, turn the channel's [**Respond automatically** setting](/docs/claude-tag/users/when-claude-responds#turn-automatic-replies-on-or-off) off.
Unmute the same way:
```text wrap theme={null}
@Claude !unmute
```
A muted thread also unmutes on any direct `@Claude` mention, so you don't need `!unmute` before asking something new.
You need the same access to mute or unmute a thread that you'd need to message Claude there.
## Send feedback
```text wrap theme={null}
@Claude !feedback
```
Opens a form in Slack for sending feedback on Claude Tag to the team that builds it, along with a note on what the report includes. Add words after `!feedback` and Claude carries them into the form as a starting draft, which you can still edit before submitting:
```text wrap theme={null}
@Claude !feedback the channel summary skipped the pinned thread
```
## List the routines in a channel
```text wrap theme={null}
@Claude !routines
```
Claude replies in the thread with the [routines](/docs/claude-tag/users/proactivity) set up in the channel: the scheduled jobs, watched channels, and other standing work it runs there. The list covers only that channel's routines.
* **For the current channel**, run `!routines` in that channel.
* **For another channel**, add the channel mention or its ID, as in `@Claude !routines #other-channel`. You need to be a member of that channel, and it must belong to your organization. Claude sends the list in a reply only you can see, so that channel's routines aren't posted for everyone in the channel where you asked.
If the single word after `!routines` isn't a channel mention or ID, Claude replies with how to use the command. Adding two or more words makes the message an ordinary prompt that starts a normal turn instead.
## Continue a thread in another channel
```text wrap theme={null}
@Claude !fork #channel <prompt>
```
Run `!fork` from inside a thread Claude is part of, and Claude continues that conversation in a new thread in the channel you name. Use it when a discussion outgrows its home channel: a bug thread that turns out to belong in the owning team's channel, or a side question that deserves its own audience.
The fork starts a new thread in Slack and links the two threads together:
* **In the channel you name**, Claude posts a new top-level message that links back to the original thread and carries your prompt, then continues in the replies under it. The new conversation starts with the original thread as background, so nobody has to re-explain.
* **Back in the original thread**, Claude replies with a link to the new thread, so anyone following along can see where the conversation continued.
The prompt is required, and it kicks off the new thread: Claude starts working on it there right away.
Pick the channel from Slack's `#` autocomplete so it arrives as a channel mention. The channel must be public, and both you and Claude must be members of it; invite Claude with `/invite @Claude` first if it isn't there yet. On Enterprise Grid, a public channel in another workspace of your grid also works when that workspace is paired to the same Claude organization, but a channel shared across workspaces doesn't.
`!fork` works from threads in public channels only. Threads in private channels, DMs, and group DMs can't be forked, since forking would carry the conversation to a different audience.
If the fork can't be set up, Claude replies with a note only you can see, and nothing is posted in either channel.
## Related resources
* [Set up routines](/docs/claude-tag/users/proactivity): the standing work `!routines` lists, and how to create, edit, or disable it
* [Control when Claude Tag responds](/docs/claude-tag/users/when-claude-responds): what makes Claude reply without any command or mention at all
* [Restrict where Claude Tag operates](/docs/claude-tag/admins/restrict-access): the admin controls that decide who can message Claude at all, including its commands
claude-tag/users/getting-started First recorded · 117 lines, first recorded
# Get started ## When to tag Claude in a channel versus a DM ## Add Claude to a channel ## Check that Claude is working ### What you see when Claude first joins a channel ## Hand Claude a task ## What Claude can see ### Which messages Claude reads ## Give Claude standing instructions ## Related resources
The first capture of this source. The page was already there, and this is what it said.
# Get started
> Claude Tag works in your Slack channels. See how to check it's on, send your first message, what it can read, and why DMs work differently.
export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
<BetaNote />
Claude Tag is Claude working in your Slack workspace. You hand it work by writing a message where Claude is, and Claude carries it out in that thread. An `@Claude` mention guarantees a response in a channel, but it isn't required everywhere. DMs and threads Claude is already in reach it without one. There's nothing for you to install or configure; if `@Claude` is in your channel, you can use it (unless your admin has [restricted who can invoke Claude](/docs/claude-tag/admins/restrict-access#members)).
## When to tag Claude in a channel versus a DM
Where you tag Claude decides whose tools it uses and who sees the result.
* **Channel** for shared team work. The work happens in the open, so anything Claude does in the thread, including its checklist and results, is visible to everyone in the channel, and anyone can reply to steer the work. An admin sets what Claude can reach in each channel, and everyone who asks there gets the same access. By default you don't need a Claude account to tag Claude in a channel; the work bills to the organization. An admin can [restrict who can invoke Claude](/docs/claude-tag/admins/restrict-access#members).
* Example: `@Claude where are we on the launch checklist? Pull what's still open from this channel and #design-review.`
* **DM** for personal tasks. A DM runs on your own claude.ai account with [your own connectors](/docs/connectors/overview). Every DM message reaches Claude without an @-mention. You can also DM Claude questions about getting started, like how to word a task or what to try first. DMs are one-to-one only; group DMs aren't supported.
* Example: `Pull my afternoon meetings from my calendar and draft a one-line prep note for each.`
See [team channels and personal DMs](/docs/claude-tag/concepts/how-it-works#team-channels-and-personal-dms) for the full comparison.
If your workspace previously used the earlier Claude in Slack app, see [how Claude Tag differs](/docs/claude-tag/admins/migrate-from-earlier) for what has changed.
## Add Claude to a channel
Claude only works in channels it's been added to. To add it, anyone in the channel can run:
```text wrap theme={null}
/invite @Claude
```
Run the command in the channel's message box. Slack rejects `/invite` sent from inside a thread.
Or mention `@Claude` in a message; Slack will prompt you to add it.
## Check that Claude is working
Mention `@Claude` in any channel where it's been added. In the Slack message box, send:
```text wrap theme={null}
@Claude what can you access from this channel?
```
A reply means it's running there, and the answer tells you what it can reach.
### What you see when Claude first joins a channel
When a person first invites Claude to a channel, it posts a short intro on its own: it reads the channel's history and suggests a few tasks it could pick up. The intro doesn't post when a bot adds Claude, in org-shared channels, or in channels that already have memory.
Each reply ends with a footer showing an **Open session in Claude** link (the full record of that task), a **Configure** link (opens a page where you can [tailor how Claude works in this channel](/docs/claude-tag/users/good-habits#configure-claude-for-a-channel)), and which model handled the reply. You can [choose a different model](/docs/claude-tag/users/models) yourself, and admins [set the default model for each channel](/docs/claude-tag/admins/customize#choose-the-model-for-a-scope).
| If you see | It means | Do this |
| :------------------------------------------------------------------------------------ | :------------------------------------------------------------------------------------------------------------------------------------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Typing `@Claude` doesn't show **Claude** with an **APP** badge in the suggestion list | The Claude app isn't installed in your workspace | Ask your Slack admin to install the Claude app, and send them [the installation guide](/docs/claude-tag/admins/pair-workspace#install-and-pair) |
| The mention sends but Claude doesn't reply | Setup isn't finished for this channel | Ask your Claude organization admin to enable Claude Tag for this channel, and send them [the setup guide](/docs/claude-tag/admins/setup-overview) with the channel name |
| Claude replies "I couldn't find a Claude Code environment for your account" | Your own claude.ai account has no cloud environment yet; this appears in DMs, which run on your account rather than the organization's | Sign in at [claude.ai/code](https://claude.ai/code) once, then try again |
## Hand Claude a task
Every interaction has the same shape. You mention `@Claude` with a task, Claude works on it in the thread, and Claude posts the result there.
```text wrap theme={null}
@Claude learn what you can about my role from this workspace, then tell me three tasks you could take off my plate this week.
```
An "is thinking…" line appears at the bottom of the thread when Claude picks the task up, and it replies with results; a multi-step task also gets a checklist it updates as it works. A quiet thread after the "is thinking…" line means Claude is working, not stuck; long tasks can take a minute or more before the first reply.
Once Claude is in a thread, you don't need to @-mention it again; it reads every reply in that thread.
Read Claude's work before you use it, in proportion to what's at stake. A summary you can skim; something going to a customer or changing a system gets a careful read. If a result needs checking, ask it to show its work in the same thread.
The work runs on Anthropic's servers, so it continues after you close Slack.
Replies in the thread reach Claude without re-mentioning. If the thread looks idle, Claude is usually still working; see [how to read its progress](/docs/claude-tag/concepts/how-it-works#track-claude%E2%80%99s-progress).
## What Claude can see
After you've handed Claude a task, the first question is what it has to work with. The short version: it reads the thread you tagged it in, it can search your workspace's public channels, and anything beyond Slack depends on what your admin connected.
| What you give Claude | Can Claude read it? |
| :----------------------------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Messages in this thread | Yes. Mentioning it mid-thread also gives it the thread's earlier messages |
| An image or screenshot you attach | Yes |
| Other public channels in your workspace | By searching only, the same way a person searches Slack; Claude can find a message by keyword but can't read a channel's full history unless it's been added there |
| Private channels and DMs | Only from inside them. Adding Claude to a private channel lets it work there, but the channel stays unreadable from any other channel or DM. |
| A link you paste, like a Google Doc or a webpage | Only if your admin allowed that site for this channel. If not, Claude tells you it can't reach it. For files in your personal Drive or Google account, DM Claude instead; [a DM uses your own connectors](/docs/claude-tag/concepts/agent-identity#direct-message-channels) |
| A Slack canvas | No |
| A message you edited after sending | Yes. Each edit sends Claude a note showing the text before and after the edit. Claude reads the note but doesn't act on it, so say a correction in a new reply. Deleting a message doesn't notify Claude |
The fastest way to find out for your channel is to ask: `@Claude can you read the doc I just linked?` gets you a yes or a "that site isn't allowed here."
<Note>Slack doesn't expose personal account settings (your sidebar, notification preferences, channel membership, or DMs between you and other people) to apps. If you want help organizing channels, paste or screenshot the list and Claude can propose a scheme you apply yourself.</Note>
### Which messages Claude reads
* An @-mention guarantees a response. Claude may also respond to a message that doesn't mention it when it judges a reply is warranted; include the mention to guarantee one. It receives the thread's root message and earlier replies for context when you mention it mid-thread; for details on the window, refer to [what Claude sees when you mention it](/docs/claude-tag/concepts/how-it-works#conversation-context).
* Once mentioned in a thread, Claude follows the rest of that thread and may reply without another mention.
* While working on a task, Claude can search the workspace's public channels by keyword, the same way a person searches Slack. It can't read a channel's full history unless it's been added there.
To quiet Claude in a thread or remove it from a channel, see [Control when Claude Tag responds](/docs/claude-tag/users/when-claude-responds).
## Give Claude standing instructions
Set instructions for a channel by telling Claude there, the way you'd ask anyone on the team:
```text wrap theme={null}
@Claude remember for this channel: keep replies short, and always include a link to the source.
```
The instruction saves to channel memory and applies to everyone's threads. Public-channel memory is also [shared across your workspace](/docs/claude-tag/users/memory). Verify with "what do you remember about this channel?"
## Related resources
* [Use case library](/docs/claude-tag/users/use-cases): every shape of work, each with the prompts to paste
* [Good habits](/docs/claude-tag/users/good-habits): how to write tasks that finish
* [Set up routines](/docs/claude-tag/users/proactivity): once a task works, have Claude run it on its own schedule
* [Commands](/docs/claude-tag/users/commands): exact words starting with `!` that run a fixed action, like `!restart` for a stuck session
claude-tag/users/good-habits First recorded · 188 lines, first recorded
# Good habits for working with Claude Tag ## Work in the open ## Write tasks that close ### Name the outcome, not the activity ### How much detail to give ### Give every task a definition of done ### Say which decisions come back to you ### Specify the output format for anything recurring ### Steer Claude Tag explicitly ## Work in the right place ### Start a new thread for a new task ### Pick the right surface ### Teach Claude something that sticks ### Configure Claude for a channel ## Keep thread count and review rate matched ## Related resources
The first capture of this source. The page was already there, and this is what it said.
# Good habits for working with Claude Tag
> Name the outcome, give every task a definition of done, and pick the right channel. See how to write tasks Claude can finish and how to keep many threads reviewable.
export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
<BetaNote />
Tasks should have a verifiable end state. Claude runs each one in its own thread, and a thread closes when someone can confirm the work is done. A task without that end state produces an open-ended report, and the thread stays open while you decide what to do with it.
The habits here are for anyone who tags Claude in from Slack.
## Work in the open
Claude is most useful when the work is somewhere the team can see, steer, and build on. A few mindsets make that the default rather than something you remember to do.
* **Work in public.** Assume everyone in the channel can read the thread, including its checklist and results. Anything your team writes down, like decisions, conventions, and postmortems, is context Claude can use. Knowledge that lives in DMs or was only said aloud is invisible to it. Put anything personal in a DM instead.
* **Share control.** Replying in a thread someone else started is how work moves. Redirect the approach, add what the requester didn't know, or pick up the result and run with it.
* **Grant broad access.** A channel with more connections (the tools an admin linked for this channel, like GitHub or Drive) produces more useful results, because Claude can join more sources together. The connections are scoped to the agent's identity, so granting them to a channel does not expose anyone's personal data.
* **Give Claude the destination, not the route.** State the outcome you want and let Claude work out the steps; the [definition of done](#give-every-task-a-definition-of-done) below makes that concrete.
* **Tolerate the mess.** A first draft posted in the thread is more useful than a polished one in a DM. The thread is the workspace, not the deliverable.
## Write tasks that close
The phrasing of a task determines whether it has a verifiable end state, what form the result takes, and how Claude responds while working on it.
### Name the outcome, not the activity
A task like "post the project status and tag me when it's up" has an end state Claude can verify; "look at this" does not, and invites an open-ended report. Put the verifiable outcome in the first sentence of the task.
### How much detail to give
Claude [reads the thread you tag it in, can search the workspace's public channels, and works with the channel's connections](/docs/claude-tag/users/getting-started#what-claude-can-see). If the background for your task is already in a thread, channel, or connected tool, link to it and state the outcome you want in one sentence. You don't need to restate the background.
```text wrap theme={null}
@Claude take over the bug in the thread linked above. Fix it and open a draft PR.
```
When a mistake would be costly to undo, give Claude more detail. Write the detail as constraints: name the rules the change must respect, the checks that count as verification, and what the work must not touch.
```text wrap theme={null}
@Claude migrate the export config to the new schema. Hard rules: no behavior change, don't touch the billing module, and every old config key keeps working as an alias. Done means the full test suite passes, not only the export tests.
```
<Warning>Constraints in a task steer Claude but don't restrict Claude from performing a specific action. Anything you type to Claude goes into its working context, where it can be forgotten or overridden. If there are actions Claude must not take, enforce them outside the conversation, with controls like repository permissions, branch protection rules, and required checks.</Warning>
### Give every task a definition of done
Starting a thread costs one sentence. Closing it costs your attention, because you read the output, decide whether it's right, and reply.
Without a stated end condition, Claude can't declare the thread finished and you can't stop checking it. The end condition you write determines who can close the thread, and the table matches each kind of condition to who closes it.
| End condition | Who closes it | Example |
| :----------------------------- | :----------------- | :---------------------------------------------------- |
| An objective check passes | Claude, on its own | "Done when CI is green" |
| You approve a prepared result | You, one click | "Draft the status memo and post it here for approval" |
| You choose between options | You, one word | "Research approaches A and B and recommend one" |
| No verifiable condition exists | No one | Reframe it as a question instead of a task |
Two refinements make the table work in practice:
* **The condition must be observable by Claude.** "Done when CI is green" requires access to CI. If the proof lives in a system the channel isn't connected to, change the condition to one you close yourself.
* **Spell out everything the condition includes.** "Babysit this PR until it merges" can produce a merge the moment approvals arrive, before open review comments are addressed. If the full condition is approvals present, comments resolved, and your final go-ahead, write all three into the task.
For tasks Claude closes itself, ask it to attach proof, such as the source link, the chart, the test output, or the diff. You read the proof, not the transcript.
For long-running work, make getting the deliverable somewhere durable part of the definition. Post the file to the thread, push the branch, or open the draft pull request as it goes. See [what survives between replies](/docs/claude-tag/concepts/how-it-works#what-survives-between-replies).
Calibrate over time. Check everything it produces in a new channel at first, and widen what it closes on its own as its output holds up under review.
### Say which decisions come back to you
Tell Claude which decisions it can make on its own and which ones it must bring to you before acting. If you don't, Claude judges each case itself. It may make a change you wanted to see first, or stop to ask so often that it spends most of the task waiting for your replies.
```text wrap theme={null}
@Claude update the retry logic the way this thread decided. Handle test failures and lint yourself. Come back to me before changing any public interface, and for anything you're not sure is in scope.
```
<Warning>These instructions steer Claude but don't restrict Claude from deciding on its own. A decision that must come back to you needs an enforced control too, such as branch protection for merges.</Warning>
Once you've seen and verified Claude's output over several tasks, you can let it make more decisions without checking in, the same way you widen [what it closes on its own](#give-every-task-a-definition-of-done).
### Specify the output format for anything recurring
A monitor or digest that posts on a schedule posts to the channel repeatedly, so spell out the shape you want each post to take. Say how long each item should be, give it the status legend to use, and tell it what to leave out, so the channel can read every post at a glance.
```text wrap theme={null}
@Claude every 6 hours, check #alerts and post one line per item: 🔴 needs a person, 🟡 watch, 🟢 fine. Skip 🟢 unless something changed.
```
Once a post matches the format you want, you can also point at it directly: "use the format from your 9am post going forward."
### Steer Claude Tag explicitly
Claude adapts to instructions, but it won't guess that you want it to. Tell it how to behave in this channel and ask it to remember. That works in both directions, whether you want more structure or less noise:
```text wrap theme={null}
@Claude remember for this channel: always format reports as a table, and ask before posting anything longer than a screen.
```
```text wrap theme={null}
@Claude remember for this channel: keep replies to three sentences unless someone asks for detail.
```
Verify what stuck by asking what it remembers about the channel. See [What Claude Tag remembers](/docs/claude-tag/users/memory).
## Work in the right place
Where you start a thread determines what Claude can reach, who else can pick the work up, and which standing conventions apply.
### Start a new thread for a new task
Each thread runs its own session, and the session carries the whole conversation into every reply. Keep follow-ups on the same task in the same thread, where Claude already has the context.
Start a new thread for each new task. The fresh session begins with full room for the work, picks up any configuration changes made since the old thread began, and keeps each piece of work reviewable on its own. A thread that accumulates many tasks eventually [grows past what one session can hold](/docs/claude-tag/users/troubleshooting#this-conversation-is-too-long-for-me-to-process).
### Pick the right surface
Channel access belongs to the channel, and DM access belongs to you. A channel can also be yours alone. Create one with just you and Claude in it, and it works the same way a team channel does. The table compares the three surfaces.
| | A team channel | Your own channel | A DM |
| :---------------- | :----------------------------------------- | :---------------------------------------------------------------------------------- | :----------------------------------------------------------------------------------------------------- |
| Access | The channel's connections, set by an admin | The channel's connections, set by an admin | Your own claude.ai connectors |
| Memory | Channel memory the team builds | Channel memory you build | Outside channel and workspace memory |
| Who sees the work | Everyone in the channel | You, plus anyone you invite | You |
| Billing | The organization | The organization | Your seat |
| Best for | Shared work the team should see and steer | Your own questions, digests, and follow-ups, kept where a teammate can pick them up | Personal tasks on your own connections, or data that shouldn't run through a shared channel connection |
[Routines](/docs/claude-tag/users/proactivity) belong to a channel too. You set standing work up in the channel where it should post, and it runs with that channel's connections. [Work from your own channel](/docs/claude-tag/users/use-cases/your-own-channel) shows what a channel of your own is good for.
A DM can still answer questions about a public channel when the answer should stay private. Name the channel in the DM, as in `summarize the last week of #product-feedback`. Claude's Slack search covers public channels in this workspace from a DM the same as from a channel, so the DM advantage is privacy of the answer, not broader reach. Workspace search is unavailable in [channels that include guests](/docs/claude-tag/admins/restrict-access#restrict-guest-channels), so ask from a DM or from a channel without guests.
Reading a public channel's full history, rather than what search finds, needs Claude to be a member of that channel. If it says it can't read a public channel, `/invite @Claude` from inside that channel adds it.
A private channel is readable only from inside it. Inviting Claude lets it work in that channel, but Claude can't read the private channel's messages from any other channel or DM. To ask about a private channel, ask in that channel.
Channels in a different workspace and Slack Connect channels stay out of reach.
When more than one surface would work, prefer a channel. Work that happens there compounds, because Claude can draw on it in later threads and teammates can find it, redirect it, or build on it.
If Claude says it can't reach something in a channel, the channel likely wasn't granted that access. See [How agent identity works](/docs/claude-tag/concepts/agent-identity).
### Teach Claude something that sticks
When Claude gets something wrong, or learns something worth keeping, where you put the fix decides who else benefits and whether you can do it yourself.
| You want Claude to know | Put it in | Who can write it | Reaches |
| :---------------------------------------------------------------------------------------- | :----------------------------------------------------------------------------------------------------------------------------- | :--------------------------------------------------------------------------------------------------------------------------------- | :---------------------------------------------------- |
| How this channel should behave: format, tone, when to respond | [**Channel memory**](/docs/claude-tag/users/memory) (say it and ask Claude to remember) | Anyone in the channel | This channel (or workspace, from a public channel) |
| Conventions and setup for one repository: file layout, PR labels, dependencies to install | **`CLAUDE.md`** at the repo root ([loaded when the repo is](/docs/claude-tag/admins/configure-github#what-loads-from-a-repository)) | Anyone with repo write | Any session that works in that repo, from any channel |
| Standing rules for this channel that outrank memory | The [**Configure** page](#configure-claude-for-a-channel), in the **Channel instructions** field | Channel members, unless an admin has [restricted it](/docs/claude-tag/admins/attach-to-scope#restrict-who-can-set-channel-instructions) | This channel |
| How to use a tool correctly, or follow a specific process, org-wide | [**A skill**](/docs/claude-tag/admins/skills-repo) in your org's plugin marketplace | An organization Owner adds it; anyone can ask Claude to open a PR proposing the change | Every channel under the scope it's attached to |
| Standing rules across many channels | [**Custom instructions**](/docs/claude-tag/admins/attach-to-scope#add-custom-instructions) on a workspace or organization scope | An organization Owner, in the console | Every session in that scope |
The first three are yours to write. Skills and wider-scope custom instructions are attached by an Owner, but you can still ask Claude to draft a skill change as a pull request for an admin to review:
```text wrap theme={null}
@Claude that worked. Open a PR to the skills repo so this query pattern is part of the Datadog skill.
```
See [the admin guide to a skills repository](/docs/claude-tag/admins/skills-repo) for what that setup gives you.
A `CLAUDE.md` carries setup as well as conventions. Sessions run in a sandbox with a standard set of preinstalled tools. If the repository needs more, such as a language runtime or a database client, put the install commands in `CLAUDE.md`, and Claude [runs them when its work needs them](/docs/claude-tag/admins/configure-github#install-project-dependencies).
A `CLAUDE.md` is guidance; a required status check is a gate. If a pull request must carry a label or pass a check, make that a repository rule rather than a memory note or a skill.
### Configure Claude for a channel
The **Configure** link in the footer of any Claude reply opens a page where you tailor how Claude behaves in that channel. The page is on claude.ai, so you need to be signed in to your Claude organization to edit it, and an admin can [restrict editing](/docs/claude-tag/admins/attach-to-scope#restrict-who-can-set-channel-instructions) so the page is read-only for members.
The **Respond automatically** toggle on that page controls whether Claude replies in the channel without an @-mention. See [Turn automatic replies on or off](/docs/claude-tag/users/when-claude-responds#turn-automatic-replies-on-or-off) for what the setting does and the other places you can change it.
Use the **Channel instructions** field on that page to write standing guidance Claude reads in every new session in the channel: the channel's purpose, its conventions, the tone replies should take, and anything Claude should do or avoid there. Channel instructions outrank channel memory and sit alongside any instructions an admin has set for the workspace or organization. Save the field and the change applies to new sessions started in the channel.
The page also shows **Connections**, the services Claude can reach from this channel. Your organization's admins set that list, so you can see it on this page but not change it.
## Keep thread count and review rate matched
Claude runs as many threads as you start. Your capacity to review them doesn't scale the same way, because every thread that needs your judgment routes through you serially. Three conventions keep the queue manageable:
* **One channel per project.** Threads and the project's working context stay in one place, and a glance at the channel shows the project's state.
* **Batch your reviews.** Several threads in one sitting costs less than the same number spread across the day, because each return is a context reload.
* **Mark closed threads.** React ✅ to anything you consider done, and tell your digest routine to skip them.
## Related resources
* [Use case library](/docs/claude-tag/users/use-cases): the full setups these habits make reliable
* [What Claude Tag remembers](/docs/claude-tag/users/memory): make corrections stick
claude-tag/users/memory First recorded · 68 lines, first recorded
# What Claude Tag remembers ## Workspace memory ## Manage what Claude Tag remembers ### Make an instruction stick ### Check and correct what Claude Tag remembers ## Related resources
The first capture of this source. The page was already there, and this is what it said.
# What Claude Tag remembers
> Claude Tag memory belongs to the channel, not to you. See how public channels share workspace memory, why private channels stay isolated, and how to check or correct it.
export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
<BetaNote />
Claude keeps memory by channel. Memory from public channels is shared across the workspace. What it learns working in a private channel is saved to that channel's own store, and nothing it learns in a channel is attached to you individually.
Memory accumulates three ways:
* **You tell Claude.** Say "remember for this channel: reports go out as tables" and it saves the instruction.
* **Claude saves facts on its own.** While working it keeps notes like decisions the channel made.
* **Claude can read past sessions.** Ask it to look back and it lists earlier sessions in the channel and reads their transcripts; it can't full-text search across them, so name a timeframe or topic.
## Workspace memory
Memory generated in public channels is shared across the workspace automatically. A decision recorded in #data-eng is available when you ask in #analytics. You can still point it at a specific channel, like "check what #data-eng knows about this."
Reading and saving follow different rules depending on where Claude is working:
| Where Claude is working | Reads from | Saves to |
| :---------------------- | :------------------------------------------------------- | :------------------------------------------------------------------------ |
| Public channel | Workspace memory | This channel's notes or workspace-shared, both inside the workspace store |
| Private channel | That channel's memory, plus workspace memory (read-only) | That channel's own store |
DMs and other workspaces stay separate.
If a private channel is later made public, its accumulated memory does not move with it: new sessions there read and write the workspace store, and the memory it saved while private is no longer read by new sessions.
## Manage what Claude Tag remembers
Anyone in the channel can save, read, and correct memory by talking to Claude directly in the channel.
### Make an instruction stick
Memory is a curated note, not a transcript. To make something permanent, say so explicitly:
```text wrap theme={null}
@Claude remember for this channel: changes go to acme/data-pipeline, never acme/website, and run the lint check before opening any pull request.
```
Keep saved instructions short. Long entries crowd out everything else; memory works best holding stable facts, not a running log of events.
For longer playbooks, put them in a repository Claude can read. The documents that onboard a person to your team work as context the same way. Link the runbook, style guide, or review checklist in the channel, or store them where it can read them, instead of re-describing their contents in memory.
### Check and correct what Claude Tag remembers
Ask Claude in the channel to list everything it has saved to memory.
```text wrap theme={null}
@Claude what do you remember about this channel?
```
If something is wrong or stale, tell it to update or forget the entry. Anyone in the channel can read and change channel memory.
Two habits keep memory useful over time:
* **After correcting an entry, have Claude record the fix.** "Update your memory for this channel so this doesn't happen again" turns a one-time fix into a standing one.
* **Prune what your work has outgrown.** Entries written weeks ago can describe a repository, owner, or convention that no longer exists; review the memory list when the channel's work shifts.
An Admin in your Claude organization can view a scope's memory files at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), under the scope's options menu; only an Owner can edit or delete them.
## Related resources
* [How Claude Tag works](/docs/claude-tag/concepts/how-it-works): the scope, channel, and thread model behind memory
* [Good habits](/docs/claude-tag/users/good-habits): habits that keep memory accurate
claude-tag/users/models First recorded · 58 lines, first recorded
# Choose the model Claude Tag uses ## Switch the model in a thread ## Set a default model for the channel ## Choose the model for your direct messages ## Which models you can use ## Related resources
The first capture of this source. The page was already there, and this is what it said.
# Choose the model Claude Tag uses
> Ask Claude to switch models in a Slack thread, set a channel's default model, or pick the model for your direct messages. See which models you can use and how to confirm which one replied.
export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
<BetaNote />
Every Claude Tag reply in Slack comes from one Claude model, and you choose which one by asking Claude for it in plain language, the same way you hand it any other task. The footer of each reply names the model that handled it, so you can confirm a switch took effect.
Which models you can ask for depends on your organization; see [which models you can use](#which-models-you-can-use).
## Switch the model in a thread
Tell Claude which model you want, in your own words, in the thread.
```text wrap theme={null}
@Claude switch to Claude Opus 4.8 for the rest of this thread.
```
To confirm the switch, check the reply footers. The reply that acknowledges the switch still names the previous model, because Claude writes it before the switch takes effect; the new model appears in the footer of the reply after it. Asking in a thread changes the model for that thread only. To change what new threads in the channel start on, set a [default model for the channel](#set-a-default-model-for-the-channel) instead.
The same request works in a direct message, where it applies to that conversation only.
## Set a default model for the channel
To change what new threads in a channel start on, ask for the channel, not just the thread.
```text wrap theme={null}
@Claude use Sonnet for this thread, and make it the default model for this channel.
```
Claude sets the channel's default model, which applies to new threads in that channel. Threads already underway keep the model they started with until someone in them asks Claude to switch.
Admins set the same default from claude.ai, per workspace or channel; see [choose the model for a scope](/docs/claude-tag/admins/customize#choose-the-model-for-a-scope).
## Choose the model for your direct messages
Open the Claude app's **Home** tab in Slack. When model selection is enabled for your organization, the tab includes a model selector for direct messages. New direct message conversations you start with Claude use the model you pick there. The selector offers only the models your organization allows.
The selector doesn't change a conversation already underway. To change one of those, ask Claude to switch in that conversation.
## Which models you can use
Anthropic manages the list of models on offer, and your organization's settings narrow it. The options include Opus and Sonnet models, drawn from what's available to your organization. Every list you see in Slack, the direct message selector and the models Claude offers to switch to, is already filtered to that set.
To see the current list, ask in the thread.
```text wrap theme={null}
@Claude what models can I use here?
```
If you ask for a model that isn't on the list, Claude tells you it isn't available, and the thread stays on the model it was already using.
## Related resources
* [Get started](/docs/claude-tag/users/getting-started): what else the reply footer links to
* [Customize Claude Tag](/docs/claude-tag/admins/customize#choose-the-model-for-a-scope): how admins set a default model per workspace or channel, and how the organization's model policy applies