One read of Claude Documentationclaude-docs-20260827T003717Z
6 pages moved out of 218 read.
Pages moved
6
significant first
Pages read
218
in this capture
Captured
00:37 UTC
Corpus hash
27c46bae85d0
corpus-hash
What this read moved
1-6 of 6claude-tag/admins/add-connections Changed · +1 / -15 lines
from line 146
146146
147147A new environment's network access level is Trusted access, which allows a [documented set of package registries and developer hosts](https://code.claude.com/docs/en/cloud-environments#default-allowed-domains). A channel can already reach hosts like `pypi.org` and `registry.npmjs.org` with no domain entry.
148148
149To give a scope broader access, create an environment with a more permissive level and pin it on the scope.
150
151<Steps>
152 <Step title="Create the environment">
153 From the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings), add an [organization-shared environment](https://code.claude.com/docs/en/cloud-environments#organization-shared-environments) and set its network access level. **Full access** allows any domain; see [Network access in the Claude Code docs](https://code.claude.com/docs/en/cloud-environments#network-access) for the other levels. This step takes an Owner or admin.
154
155 Don't create the environment at [`claude.ai/code`](https://claude.ai/code): environments you create there belong to your individual account, so they never appear in the picker.
156 </Step>
157
158 <Step title="Pin it on the scope">
159 Open the scope's **Advanced** section and use the **Environment** picker. With nothing pinned, sessions use the organization default.
160 </Step>
161</Steps>
162
163The environment must be scoped to the organization, not an individual account. If sessions don't pick up the one you pinned, see [the environment troubleshooting entry](/docs/claude-tag/admins/troubleshooting#channel-sessions-use-the-wrong-environment-or-can%E2%80%99t-find-one).
149To give a scope broader access, create an organization-shared environment with a more permissive level and set it on the scope, as described in [Configure the environment for a scope](/docs/claude-tag/admins/customize#configure-the-environment-for-a-scope). **Full access** allows any domain; see [Network access in the Claude Code docs](https://code.claude.com/docs/en/cloud-environments#network-access) for the other levels.
164150
165151### Allow all hosts
166152
claude-tag/admins/configure-github Changed · +4 / -1 lines
from line 96
9696
9797### Install project dependencies
9898
99Every session runs in an isolated sandbox with a standard set of preinstalled tools. The sandbox is the same for every repository; there is no setup script or custom image to configure. If a project needs something the standard set doesn't include, such as a specific language runtime or a database client, add the install commands to the repository's `CLAUDE.md`.
99Every session runs in an isolated sandbox with a standard set of preinstalled tools. There are two places to add what a project needs beyond that set, such as a specific language runtime or a database client:
100
101* **For every session in a channel**, an admin adds the install commands to the setup script of the environment the channel's sessions run on. See [Configure the environment for a scope](/docs/claude-tag/admins/customize#configure-the-environment-for-a-scope).
102* **For one repository**, add the install commands to the repository's `CLAUDE.md`.
100103
101104Claude follows `CLAUDE.md` as guidance when it starts work that needs it, not as an unconditional setup step. Write each install as a precondition of the work it supports, for example "install the SDK before building or running tests", so Claude runs it when a task touches that code. The sandbox is fresh for every session, so the installs repeat each time Claude works in the repository.
102105
claude-tag/admins/customize Changed · +54 / -13 lines
## Configure the environment for a scope ### Decide what goes in the environment ### Create the environment and choose it on a scope ### Which environment a channel's sessions use ## Where to change a scope's environment
from line 21
2121
2222Access and organization-wide behavior are set at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), per scope (a scope is a channel, a workspace, or your whole organization), so the same agent can work differently in different channels. Most controls below are Owner-only.
2323
24| Setting | What it does | More |
25| :-------------------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------- |
26| Custom instructions | Standing guidance read in every session on a scope, like team conventions. Outranks channel memory. | [Add custom instructions](/docs/claude-tag/admins/attach-to-scope#add-custom-instructions) |
27| Respond automatically | Whether Claude replies to a channel's messages without an @-mention. Channel members can change it too, from Slack or the channel's Configure page. | [Turn automatic replies on or off](/docs/claude-tag/users/when-claude-responds#turn-automatic-replies-on-or-off) |
28| Plugins | Bundles of skills that teach Claude how to use a specific tool | [Attach plugins](/docs/claude-tag/admins/add-connections#attach-plugins) |
29| Connections | Which systems it can reach from each channel | [Add connections](/docs/claude-tag/admins/add-connections) |
30| Default model | Which Claude model handles sessions in a scope | [Choose the model for a scope](#choose-the-model-for-a-scope) |
31| Auto mode allow rules | Actions pre-approved in a scope's sessions that Claude's permission checker would otherwise flag or stop | [Auto mode allow rules](#auto-mode-allow-rules) |
32| Environment | Which cloud environment a scope's sessions run in. The picker shows [organization-shared cloud environments](https://code.claude.com/docs/en/cloud-environments#organization-shared-environments), plus runner pools for organizations that use [self-hosted environments](https://code.claude.com/docs/en/self-hosted-environments-quickstart). Environments on an individual account never appear, because Claude runs channel sessions with no user account attached. | [Channel environment troubleshooting](/docs/claude-tag/admins/troubleshooting#channel-sessions-use-the-wrong-environment-or-can%E2%80%99t-find-one) |
33| Claude Tag version | Which generation answers (New, Legacy, or Off) in a scope | [Migrate from the earlier Claude in Slack](/docs/claude-tag/admins/workspaces#set-the-version-for-a-scope) |
24| Setting | What it does | More |
25| :-------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------- | :---------------------------------------------------------------------------------------------------------- |
26| Custom instructions | Standing guidance read in every session on a scope, like team conventions. Outranks channel memory. | [Add custom instructions](/docs/claude-tag/admins/attach-to-scope#add-custom-instructions) |
27| Respond automatically | Whether Claude replies to a channel's messages without an @-mention. Channel members can change it too, from Slack or the channel's Configure page. | [Turn automatic replies on or off](/docs/claude-tag/users/when-claude-responds#turn-automatic-replies-on-or-off) |
28| Plugins | Bundles of skills that teach Claude how to use a specific tool | [Attach plugins](/docs/claude-tag/admins/add-connections#attach-plugins) |
29| Connections | Which systems it can reach from each channel | [Add connections](/docs/claude-tag/admins/add-connections) |
30| Default model | Which Claude model handles sessions in a scope | [Choose the model for a scope](#choose-the-model-for-a-scope) |
31| Auto mode allow rules | Actions pre-approved in a scope's sessions that Claude's permission checker would otherwise flag or stop | [Auto mode allow rules](#auto-mode-allow-rules) |
32| Environment | Which cloud environment a scope's sessions run in | [Configure the environment for a scope](#configure-the-environment-for-a-scope) |
33| Claude Tag version | Which generation answers (New, Legacy, or Off) in a scope | [Migrate from the earlier Claude in Slack](/docs/claude-tag/admins/workspaces#set-the-version-for-a-scope) |
3434
3535### Channel connections are separate from personal connectors
3636
from line 77
7777
7878A change to the allowed list applies to new sessions, like a change to the **Default model**; a thread already underway keeps its model until someone in it asks Claude to switch.
7979
80## Where to change a scope's environment
80## Configure the environment for a scope
8181
82The environment is the sandboxed compute configuration a scope's sessions run in. You create environments in one place and pin one per scope in another. An Owner or admin creates environments on the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings), as [organization-shared environments](https://code.claude.com/docs/en/cloud-environments#organization-shared-environments). You then pin one per scope, in the **Environment** picker in the scope's **Advanced** section on [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), for **Default Slack access**, a workspace, or a channel. A channel with no pin of its own inherits the nearest pin above it; with nothing pinned anywhere, sessions use the **Organization default**.
82Claude runs every channel session in a sandbox that starts with a standard set of tools. When a channel's work needs something that sandbox doesn't have, such as a language runtime, a database client, a set of environment variables, or broader web access, give the channel an environment. An environment is an [organization-shared cloud environment](https://code.claude.com/docs/en/cloud-environments#organization-shared-environments): you create it once, then choose it on a scope, meaning a channel, a workspace, or **Default Slack access**. Both steps take an Owner; a [channel manager](/docs/claude-tag/admins/restrict-access#delegate-channel-setup-to-channel-managers) can't change a channel's environment.
8383
84A change applies to new sessions; after you pin an environment, start a fresh thread to pick it up. To give a channel broader network access through its environment, see [broad web access through the environment](/docs/claude-tag/admins/add-connections#broad-web-access-through-the-environment). If sessions don't pick up the environment you pinned, see [channel sessions use the wrong environment](/docs/claude-tag/admins/troubleshooting#channel-sessions-use-the-wrong-environment-or-can%E2%80%99t-find-one).
84### Decide what goes in the environment
85
86An environment carries a setup script, environment variables, and a network access level. Not everything a channel needs belongs there, so match each need to its place before you create one:
87
88| What the channel needs | Where to put it |
89| :------------------------------------------------------------------------------ | :------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
90| A tool installed before Claude starts, such as a runtime or a database client | The environment's setup script, a Bash script whose installs are on disk before Claude starts work |
91| A value every session should see, such as a deployment target or a feature flag | The environment's environment variables, as `KEY=value` pairs, one per line |
92| Web access without a credential | The environment's network access level; see [broad web access through the environment](/docs/claude-tag/admins/add-connections#broad-web-access-through-the-environment) |
93| An API key, token, or other credential | A [connection](/docs/claude-tag/admins/add-connections), never an environment variable |
94| Setup for one repository, such as installing its dependencies | That repository's `CLAUDE.md`; see [install project dependencies](/docs/claude-tag/admins/configure-github#install-project-dependencies) |
95
96Keep credentials out of environment variables because every session on the environment reads them and Claude can print them. There is no separate secrets store. A connection stores the credential outside the sandbox and attaches it to matching requests at the network layer, so Claude uses the service without holding the raw value. [Agent Proxy](/docs/claude-tag/concepts/agent-identity#agent-proxy) describes how. A connection also travels with the access bundle, so you choose channel by channel which sessions can use it. Repository-specific setup goes in `CLAUDE.md` so the people who maintain the repository keep it current. Claude reads it when it starts work in that repository.
97
98### Create the environment and choose it on a scope
99
100Creating the environment and choosing it on a scope happen on two different admin pages. Choose it on a channel to change only that channel's sessions, on a workspace to cover every channel in the workspace where you haven't chosen one, or on **Default Slack access** to cover every workspace.
101
102<Steps>
103 <Step title="Create the environment">
104 From the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings), add an [organization-shared environment](https://code.claude.com/docs/en/cloud-environments#organization-shared-environments) and fill in its setup script, environment variables, and network access level.
105 </Step>
106
107 <Step title="Choose it on the scope">
108 Open [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), select the **Slack** tab under **Claude Tag's access**, and select the scope's row: the **Slack** row for **Default Slack access**, or the workspace or channel. Expand **Advanced** and pick the environment in the **Environment** picker.
109 </Step>
110
111 <Step title="Check it in a new thread">
112 Start a fresh thread in the channel and ask Claude to use what you added, such as running the tool your setup script installed. Threads already underway keep the environment they started on, so an existing thread won't show the change.
113 </Step>
114</Steps>
115
116### Which environment a channel's sessions use
117
118When a session starts, Claude uses the first environment it finds, in this order:
119
1201. The channel's **Environment** setting
1212. The workspace's **Environment** setting
1223. The **Environment** setting on **Default Slack access**
1234. The [organization's default environment](https://code.claude.com/docs/en/cloud-environments#the-default-environment), which an Owner chooses under **Cloud sessions** at [`claude.ai/admin-settings/claude-code`](https://claude.ai/admin-settings/claude-code)
124
125If you haven't chosen an environment on a scope, its picker shows **Organization default**, but sessions there may still run on an environment you chose on the workspace or on **Default Slack access**. In a channel where Claude runs with [channel-only access](/docs/claude-tag/admins/restrict-access#how-channel-only-works) because a guest is present, sessions run on the standard environment regardless of these settings. If a channel's sessions aren't on the environment you expect, see [channel sessions use the wrong environment](/docs/claude-tag/admins/troubleshooting#channel-sessions-use-the-wrong-environment-or-can%E2%80%99t-find-one).
85126
86127## Auto mode allow rules
87128
claude-tag/concepts/for-claude-code-users Changed · +11 / -10 lines
from line 25
2525
2626### How hooks run in the sandbox
2727
28Hooks run inside the sandbox, and every session runs on the same standard sandbox image, no matter which repository it clones. If a hook calls a command that the image doesn't include, add an install step for it to the repository's `CLAUDE.md`, as described in [Install project dependencies](/docs/claude-tag/admins/configure-github#install-project-dependencies).
28Hooks run inside the sandbox. If a hook calls a command the sandbox doesn't include, ask an admin to add it to the setup script of the [environment the channel's sessions run on](/docs/claude-tag/admins/customize#configure-the-environment-for-a-scope). For a command only one repository needs, add an install step to that repository's `CLAUDE.md`, as described in [Install project dependencies](/docs/claude-tag/admins/configure-github#install-project-dependencies).
2929
3030## Local settings versus admin settings
3131
from line 37
3737
3838The table shows what takes the place of each setting from your machine. Where a counterpart exists, an admin sets it for the whole channel.
3939
40| Claude Code setting on your machine | In Claude Tag |
41| :--------------------------------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
42| `/model` | An admin sets the [default model per channel](/docs/claude-tag/admins/customize#choose-the-model-for-a-scope), and you can [switch models in a thread](/docs/claude-tag/users/models) |
43| Effort level | Not configurable. Sessions run at the model's default effort. |
44| MCP servers in `.mcp.json` | Not loaded, even when `.mcp.json` is checked into the repository. A session reaches external services only through the [connections an admin set for the channel](/docs/claude-tag/admins/add-connections), and each connection holds that service's credentials. |
45| Secrets and API keys in your environment | An admin provisions them as channel connections. The raw key never enters the sandbox. It is [added to requests at the network layer](/docs/claude-tag/concepts/agent-identity#agent-proxy). |
46| Environment variables and a personal `settings.json` | No counterpart. Every session runs on the same standard sandbox image, so there is no per-person environment to customize. Put non-secret setup in `CLAUDE.md` as [install steps](/docs/claude-tag/admins/configure-github#install-project-dependencies), and ask an admin to add secrets as connections. |
47| A setup script for your workspace | No counterpart. Use `CLAUDE.md` install steps instead. |
48| Permission prompts | Sessions run in auto mode, where Claude's permission checker reviews each action and can stop it. An admin pre-approves routine actions with [auto mode allow rules](/docs/claude-tag/admins/customize#auto-mode-allow-rules) instead of you approving in the moment. |
40| Claude Code setting on your machine | In Claude Tag |
41| :--------------------------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
42| `/model` | An admin sets the [default model per channel](/docs/claude-tag/admins/customize#choose-the-model-for-a-scope), and you can [switch models in a thread](/docs/claude-tag/users/models) |
43| Effort level | Not configurable. Sessions run at the model's default effort. |
44| MCP servers in `.mcp.json` | Not loaded, even when `.mcp.json` is checked into the repository. A session reaches external services only through the [connections an admin set for the channel](/docs/claude-tag/admins/add-connections), and each connection holds that service's credentials. |
45| Secrets and API keys in your environment | An admin provisions them as channel connections. The raw key never enters the sandbox. It is [added to requests at the network layer](/docs/claude-tag/concepts/agent-identity#agent-proxy). |
46| Environment variables | An admin sets them on the [environment the channel's sessions run on](/docs/claude-tag/admins/customize#configure-the-environment-for-a-scope), and every session in the channel reads them. There is no per-person environment to customize. The values are readable in every session on the environment, so ask an admin to add secrets as connections instead. |
47| A personal `settings.json` | Not loaded. |
48| A setup script for your workspace | An admin sets a setup script on the [environment the channel's sessions run on](/docs/claude-tag/admins/customize#configure-the-environment-for-a-scope), and what it installs is in place when each session in the channel starts. For setup that belongs to one repository, use `CLAUDE.md` [install steps](/docs/claude-tag/admins/configure-github#install-project-dependencies) instead. |
49| Permission prompts | Sessions run in auto mode, where Claude's permission checker reviews each action and can stop it. An admin pre-approves routine actions with [auto mode allow rules](/docs/claude-tag/admins/customize#auto-mode-allow-rules) instead of you approving in the moment. |
4950
5051To change what a session can reach, ask an admin to [add a connection](/docs/claude-tag/admins/add-connections). The change applies to every session in the channel.
5152
claude-tag/admins/restrict-access Changed · +1 / -0 lines
from line 141
141141* No repositories, including any in a bundle attached to the channel, and no connectors set directly on the channel.
142142* No instructions set on the workspace or the organization. Instructions set on the channel itself still apply.
143143* No memory, including this channel's own, and no skills.
144* No [environment set on the scope](/docs/claude-tag/admins/customize#configure-the-environment-for-a-scope). The session runs on the standard environment, so that environment's setup script, environment variables, and network access level don't apply while a guest is present.
144145
145146Claude decides this when a conversation starts. When no guest is in the channel, new conversations get its usual full access, as under **Allow**. A guest can talk to Claude by mentioning `@Claude` or by replying in a thread Claude started after a guest was in the channel, and Claude answers them. In a thread Claude began before the first guest joined, Claude stops replying while a guest is present, and a guest who writes there gets the same notice as under **Restrict**; start a new thread instead. While a guest is present, Claude replies only to mentions and to threads it's already part of; it doesn't pick up other channel messages on its own, even where [**Respond automatically**](/docs/claude-tag/users/when-claude-responds#turn-automatic-replies-on-or-off) is on. A guest can't approve a tool or permission request, or restart, mute, fork, or stop the session. If a guest clicks approve, nothing is granted and a workspace member has to ask Claude again.
146147
claude-tag/admins/troubleshooting Changed · +1 / -1 lines
from line 609
609609
610610**What it means**
611611
612Each scope at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), on the **Slack** tab under **Claude Tag's access**, has an **Environment** picker (in the scope's **Advanced** section) that pins the Claude Code environment or runner pool that sessions in that scope use. A channel with no pin of its own inherits the nearest pin above it; with nothing pinned anywhere, sessions use the **Organization default**. The picker only lists environments scoped to the organization; an environment created under an individual account doesn't appear, because channel sessions run with no user account attached.
612Sessions run on the environment or runner pool set on the nearest scope above them, or on the organization's default environment when none is set; [Configure the environment for a scope](/docs/claude-tag/admins/customize#configure-the-environment-for-a-scope) covers the picker. The picker only lists environments scoped to the organization; an environment created under an individual account doesn't appear, because channel sessions run with no user account attached.
613613
614614**How to resolve**
615615