Capture
One read of Claude Documentation
12 pages moved out of 216 read.
claude-tag/admins/restrict-access Changed · +1 / -5 lines
from line 164
### Migrate from the earlier Claude in Slack -If your organization used the earlier Claude in Slack app, you choose which generation answers `@Claude` per scope. The control is the **Claude Tag version** setting on each workspace or channel scope at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), with the choices **Off**, **Legacy**, **New**, and **Inherit**, plus the **Claude Tag version** row on the **Default Slack access** scope above them. - -Both generations answer through the same @Claude app, so **Off** turns off both. To opt out of Claude Tag but keep the earlier app answering in a scope, choose **Legacy**. - -Access bundles only apply where the New version answers. The [glossary](/docs/claude-tag/concepts/glossary#the-earlier-claude-in-slack) covers how the two differ. +If your organization used the earlier Claude in Slack app, the **Claude Tag version** setting on each scope chooses which generation answers `@Claude` there. Access bundles only apply where the New version answers. See [Set the version for a scope](/docs/claude-tag/admins/workspaces#set-the-version-for-a-scope) for the values and [Migrate from the earlier Claude in Slack](/docs/claude-tag/admins/migrate-from-earlier) for the switch. ### Allow or disable direct messages
claude-tag/admins/setup-overview Changed · +4 / -4 lines
from line 182
| You expected | But got | Do this | | :----------------------------------------------------------------------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------ | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | The setup page at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag) | A page titled **Set up Claude Tag** with **View setup guide** and **Go to chat** buttons | Your signed-in account can't run setup, and **View setup guide** leads back to this guide. On a personal account (Free, Pro, or Max), [start a Team or Enterprise plan](https://claude.com/pricing) first. In a Team or Enterprise organization, ask an Owner to run setup. When the page shows a workspace switcher, your account also belongs to another Team or Enterprise organization; switch to it and retry. | -| A pairing code from `@Claude connect` | “Only Slack workspace admins (or Enterprise Grid org admins) can link this workspace to a Claude organization…” | The person who sent `@Claude connect` isn't a Slack workspace admin (or Grid org admin). [Send the request](/docs/claude-tag/admins/pair-workspace#send-the-install-request-to-your-slack-admin) to someone who is. | -| A pairing code | “…installation is out of date” | The app was updated with permissions your workspace hasn't approved yet. A Slack admin approves the update or reinstalls the app, then sends `@Claude connect` again. See [both remedies](/docs/claude-tag/admins/pair-workspace#if-@claude-connect-says-the-installation-is-out-of-date). | +| A pairing code from `@Claude connect` | “Only Slack workspace admins (or Enterprise Grid org admins) can link this workspace to a Claude organization…” | The person who sent `@Claude connect` isn't a Slack workspace admin or Grid org admin. See [Only Slack workspace admins or Grid org admins can link this workspace](/docs/claude-tag/admins/troubleshooting#only-slack-workspace-admins-or-grid-org-admins-can-link-this-workspace). | +| A pairing code | “…installation is out of date” | A Slack admin approves the update or reinstalls the app, then sends `@Claude connect` again. See [This workspace's Claude app installation is out of date](/docs/claude-tag/admins/troubleshooting#this-workspace%E2%80%99s-claude-app-installation-is-out-of-date). | | The Slack row under **Where Claude Tag works** to show your workspace as connected | It still shows **Not connected** | The code may have expired (codes last 15 minutes) or come from a different workspace. Send `@Claude connect` again for a fresh code. | | A pairing code | A message about guests, or about the channel being shared across workspaces | Send `@Claude connect` again in a channel with no guests that belongs to a single workspace. Match the exact message in [Guest and shared channels](/docs/claude-tag/admins/troubleshooting#guest-and-shared-channels) for the fix that fits it. | | A connected tool to work in your test | “I can't reach…” | Claude isn't told about a connection added after the thread started. Ask it to use the service by name, or start a fresh thread. |
from line 191
| Claude to respond in Slack | "Claude Tag has been turned off for your Claude organization…" | The **Enable Claude Tag for your organization** toggle is off. An Owner turns it on at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag). See [the troubleshooting entry](/docs/claude-tag/admins/troubleshooting#claude-tag-is-turned-off-for-your-organization). | | Claude to respond in Slack | "Claude Tag is unavailable because Routines aren't enabled for your organization…" | Routines isn't enabled for your Claude organization, which Claude Tag requires. An admin enables Routines at [`claude.ai/admin-settings/claude-code`](https://claude.ai/admin-settings/claude-code), then anyone can mention `@Claude` again. See [the troubleshooting entry](/docs/claude-tag/admins/troubleshooting#claude-tag-is-unavailable-because-routines-are-not-enabled). | | Claude to respond in Slack | "Claude in Slack is not available for your organization" or "Claude isn't available for organizations with restricted compliance settings." | The paired Claude organization has a restricted compliance configuration, such as Zero Data Retention (ZDR), that Claude Tag can't run under. No setting lifts this; contact your account team. See [the troubleshooting entry](/docs/claude-tag/admins/troubleshooting#restricted-compliance-settings-block-claude-tag). | -| The **Slack** tab to list your scopes | "Couldn't load Slack scopes. Reload the page to try again." | A page-load fetch failed; reload. Your configuration is intact. | -| A reply in your test channel | "Couldn't check this channel just now" | The pre-reply guest check briefly failed. Mention `@Claude` again. | +| The **Slack** tab to list your scopes | "Couldn't load Slack scopes. Reload the page to try again." | Reload the page. See [Couldn't load Slack scopes](/docs/claude-tag/admins/troubleshooting#couldn%E2%80%99t-load-slack-scopes). | +| A reply in your test channel | "Couldn't check this channel just now" | Mention `@Claude` again. See [Couldn't check this channel just now](/docs/claude-tag/admins/troubleshooting#couldn%E2%80%99t-check-this-channel-just-now). | | A reply in your test channel | "Something went wrong starting a session" | Retry first. If it persists, see [the session-start entries](/docs/claude-tag/admins/troubleshooting#something-went-wrong-starting-a-session). | ## Related resources
claude-tag/concepts/security-and-data Changed · +1 / -5 lines
from line 47
### Network egress -Outbound traffic from a channel session's sandbox is default-deny. Requests go only to hosts an allow layer covers, and the layers are a [connection's Allowed websites](/docs/claude-tag/admins/connections/custom#fill-out-the-custom-tool-form), the [bundle's Domains tab](/docs/claude-tag/admins/add-connections#allow-a-host-without-a-credential), and the network access setting of the [environment](/docs/claude-tag/concepts/glossary#environment) the scope's sessions run on. A new environment's default level, Trusted access, already covers a [documented set of package registries and developer hosts](https://code.claude.com/docs/en/cloud-environments#default-allowed-domains). Every request gets one of three outcomes: - -* **Matches a credential rule.** The credential is attached at the boundary and the request proceeds. -* **Matches only an allowlist.** The host is on the Domains tab or allowed by the environment's network access setting; the request is sent without credentials. -* **Matches nothing.** The request is blocked outright; the host is unreachable rather than merely unauthenticated. +Outbound traffic from a channel session's sandbox is default-deny. Requests go only to hosts an allow layer covers, and the layers are a [connection's Allowed websites](/docs/claude-tag/admins/connections/custom#fill-out-the-custom-tool-form), the [bundle's Domains tab](/docs/claude-tag/admins/add-connections#allow-a-host-without-a-credential), and the network access setting of the [environment](/docs/claude-tag/concepts/glossary#environment) the scope's sessions run on. A new environment's default level, Trusted access, already covers a [documented set of package registries and developer hosts](https://code.claude.com/docs/en/cloud-environments#default-allowed-domains). See [Agent Proxy](/docs/claude-tag/concepts/agent-identity#agent-proxy) for what happens to a request under each layer. <img className="block dark:hidden" src="https://mintcdn.com/claude-ai/Tf9m3OvmKAZp3uXC/images/claude-tag/diagrams/proxy-decision.svg?fit=max&auto=format&n=Tf9m3OvmKAZp3uXC&q=85&s=a4aecacf4e23944d5a2ecaacf6cf95a1" alt="Flow diagram across two zones. Inside Anthropic's infrastructure, a session sandbox that holds no credentials sends every outbound request to Agent Proxy, which matches it against admin rules. Three outcomes branch toward your systems: on a rule match, the credential is attached at the boundary and the request proceeds; on an allowlist-only match, from the bundle's Domains list or the environment's network access setting, the request is sent without credentials; on no match, the request is blocked entirely (the default-deny outcome) and the host is unreachable." width="1000" height="400" data-path="images/claude-tag/diagrams/proxy-decision.svg" />
claude-tag/concepts/glossary Changed · +1 / -1 lines
from line 37
| Memory | None | Shared workspace memory plus private-channel memory | | Proactive work | None | Routines and channel watching | -Your admin chooses which generation answers `@Claude` in a given channel, so two channels in the same workspace can work differently. See [Migrate from the earlier Claude in Slack](/docs/claude-tag/admins/restrict-access#migrate-from-the-earlier-claude-in-slack). +Your admin chooses which generation answers `@Claude` in a given channel, so two channels in the same workspace can work differently. See [Migrate from the earlier Claude in Slack](/docs/claude-tag/admins/workspaces#set-the-version-for-a-scope). ## Connection
claude-tag/concepts/how-it-works Changed · +2 / -0 lines
from line 243
For long tasks, ask it to push branches and post drafts as it goes, so deliverables are saved somewhere durable while the work is still running. See [Good habits](/docs/claude-tag/users/good-habits#give-every-task-a-definition-of-done). +A running thread isn't told about configuration changes an admin makes after it started, such as a new connection, plugin, skill, repository grant, or custom instruction. A new thread starts from the scope's current configuration, so after changing a scope, start a fresh thread to see the change. + The channel's own session, the one that handles top-level messages outside any thread, lives longer than a thread's. Claude replaces it with a fresh one when a top-level message arrives after about an hour with no top-level activity, when the session is about a day old, or when the channel's configuration has changed since the session started. Channel memory and the channel's history are unaffected, so the only visible effect is that Claude no longer carries what the previous session had been working on. Claude also stops reading a channel's top-level messages once about 100 of them have arrived since it last posted or replied there. An `@Claude` mention in the channel starts it reading again; see [When Claude stops reading a channel](/docs/claude-tag/users/when-claude-responds#when-claude-stops-reading-a-channel). These thresholds are defaults and can change, so treat the numbers as approximate.
claude-tag/admins/troubleshooting Changed · +0 / -2 lines
from line 336
2. Open [Claude for Slack](https://claude.com/claude-for-slack), select **Add to Slack**, and choose **Install to entire organization**. 3. Mention `@Claude` anywhere. If the reinstall worked, the mention gets a reaction and a reply. The pairing survives the reinstall, so a normal reply means you're done. A reply that says the workspace isn't set up means the pairing needs to be redone; see [This workspace isn't set up for Claude Tag yet](#this-workspace-isn%E2%80%99t-set-up-for-claude-tag-yet). -See [If `@Claude` doesn't respond at all](/docs/claude-tag/admins/pair-workspace#if-@claude-doesn%E2%80%99t-respond-at-all). - ### This workspace isn't set up for Claude Tag yet **What you see**
claude-tag/concepts/agent-identity Changed · +1 / -1 lines
from line 73
### How a host gets allowed -Agent Proxy allows a host when any one of three layers allows it: a [Domains entry](/docs/claude-tag/admins/add-connections#allow-a-host-without-a-credential) on the bundle attached to the scope, a [connection's allowed websites](/docs/claude-tag/admins/add-connections#set-allowed-websites) (which also attaches that connection's credential), or the network access level of the [environment](/docs/claude-tag/concepts/glossary#environment) the scope's sessions run on. A host that none of them allows is blocked, and Claude names the blocked host in the thread so an admin can add it; see [Give Claude access to your tools](/docs/claude-tag/admins/add-connections). +A host that none of the three layers above allows is blocked, and Claude names the blocked host in the thread so an admin can add it; see [Give Claude access to your tools](/docs/claude-tag/admins/add-connections). ### Web search vs. network requests
claude-tag/admins/pair-workspace Changed · +1 / -1 lines
from line 57
### If `@Claude` doesn't respond at all -On Enterprise Grid, an earlier install can lose its connection and stop responding in every workspace. Don't uninstall the app. Have a Slack Org Owner or Org Admin, while signed in to one of the workspaces (not the org-level admin page), open [claude.com/claude-for-slack](https://claude.com/claude-for-slack), select **Add to Slack**, and choose **Install to entire organization**. This refreshes the connection in place. Then send `@Claude connect` again in a channel of that workspace. +On Enterprise Grid, an earlier install can lose its connection and stop responding in every workspace. See [Claude is silent everywhere on Enterprise Grid](/docs/claude-tag/admins/troubleshooting#claude-is-silent-everywhere-on-enterprise-grid) for the reinstall that refreshes it without uninstalling, then send `@Claude connect` again in a channel of that workspace. ### If `@Claude connect` says the installation is out of date
claude-tag/admins/migrate-from-earlier Changed · +2 / -2 lines
from line 34
### If `@Claude` doesn't respond at all -On Enterprise Grid, an earlier install can lose its connection and stop responding in every workspace. Don't uninstall the app. Have a Slack Org Owner or Org Admin, while signed in to one of the workspaces (not the org-level admin page), open [claude.com/claude-for-slack](https://claude.com/claude-for-slack), select **Add to Slack**, and choose **Install to entire organization**. This refreshes the connection in place. Then send `@Claude connect` again in a channel of that workspace and continue with step 1 above. +On Enterprise Grid, an earlier install can lose its connection and stop responding in every workspace. See [Claude is silent everywhere on Enterprise Grid](/docs/claude-tag/admins/troubleshooting#claude-is-silent-everywhere-on-enterprise-grid) for the reinstall that refreshes it without uninstalling, then send `@Claude connect` again in a channel of that workspace and continue with step 1 above. <Warning>The earlier Claude in Slack app, shown as **Legacy** in admin settings, is being deprecated; check with your account team for the cutover date. After that date, channels still set to Legacy stop responding until the scope's Claude Tag version is set to New.</Warning>
from line 56
| Standing work | None | Routines and channel watching | | Who sets it up | Each user, individually | An Owner, once | -The **Claude Tag version** setting on each scope lets you pin a channel or workspace to **Off**, **Legacy**, or **New**, or **Inherit** the organization default. Use it to hold specific channels on the Legacy behavior while you finish provisioning, then switch them when ready. Access bundles only apply where the New version answers. See [the version setting](/docs/claude-tag/admins/restrict-access#migrate-from-the-earlier-claude-in-slack) for the control. +The **Claude Tag version** setting on each scope chooses whether the New or Legacy version answers there, or neither. Access bundles only apply where the New version answers. See [Set the version for a scope](/docs/claude-tag/admins/workspaces#set-the-version-for-a-scope) for the four values and where to set them. ## Two versions of the same Slack app
claude-tag/admins/customize Changed · +1 / -1 lines
from line 30
| Default model | Which Claude model handles sessions in a scope | [Choose the model for a scope](#choose-the-model-for-a-scope) | | Auto mode allow rules | Actions pre-approved in a scope's sessions that Claude's permission checker would otherwise flag or stop | [Auto mode allow rules](#auto-mode-allow-rules) | | Environment | Which cloud environment a scope's sessions run in. The picker shows [organization-shared cloud environments](https://code.claude.com/docs/en/cloud-environments#organization-shared-environments), plus runner pools for organizations that use [self-hosted environments](https://code.claude.com/docs/en/self-hosted-environments-quickstart). Environments on an individual account never appear, because Claude runs channel sessions with no user account attached. | [Channel environment troubleshooting](/docs/claude-tag/admins/troubleshooting#channel-sessions-use-the-wrong-environment-or-can%E2%80%99t-find-one) | -| Claude Tag version | Which generation answers (New, Legacy, or Off) in a scope | [Migrate from the earlier Claude in Slack](/docs/claude-tag/admins/restrict-access#migrate-from-the-earlier-claude-in-slack) | +| Claude Tag version | Which generation answers (New, Legacy, or Off) in a scope | [Migrate from the earlier Claude in Slack](/docs/claude-tag/admins/workspaces#set-the-version-for-a-scope) | ### Channel connections are separate from personal connectors
claude-tag/admins/attach-to-scope Changed · +1 / -1 lines
from line 34
Attaching binds the bundle to a workspace scope or to a single channel under it. -The binding takes full effect in new threads only. A thread already running keeps the skills, plugins, and custom instructions it started with. A connection added after a thread started still works there if you ask Claude to use the service by name, but Claude doesn't announce it, so test with a new top-level thread after attaching a bundle. +The binding takes full effect in new threads only. A thread already running keeps the skills, plugins, and custom instructions it started with. A connection added after a thread started still works there if you ask Claude to use the service by name, but Claude doesn't announce it, so test with a new top-level thread after attaching a bundle. See [What survives between replies](/docs/claude-tag/concepts/how-it-works#what-survives-between-replies). At the channel's top level, outside any thread, Claude works from a single long-lived channel session. After a configuration change, Claude replaces that session on the next channel message, so top-level replies pick up the change from then on.
claude-tag/admins/add-connections Changed · +1 / -1 lines
from line 235
Registering a plugin at the organization level makes it available, not active. It takes effect only where a bundle enables it or a scope adds it directly. -Adding or removing plugins and skills applies to new threads only. A thread already running keeps the set it began with; start a fresh thread to pick up changes. +Adding or removing plugins and skills applies to new threads only. A thread already running keeps the set it began with; start a fresh thread to pick up changes. See [What survives between replies](/docs/claude-tag/concepts/how-it-works#what-survives-between-replies). Claude can't publish a new skill version from inside a thread; that update happens in admin settings.