What this read moved
1–2 of 2claude-tag/admins/attach-to-scope Changed · +19 / -1 lines
### Attach a bundle to channels by name #### Where rule-attached bundles appear
from line 32
3232
3333## Attach the bundle
3434
35Attaching binds the bundle to a workspace scope or to a single channel under it.
35Attaching binds the bundle to a workspace scope, to a single channel under it, or to every channel whose name matches a pattern.
3636
3737The binding takes full effect in new threads only. A thread already running keeps the skills, plugins, and custom instructions it started with. A connection added after a thread started still works there if you ask Claude to use the service by name, but Claude doesn't announce it, so test with a new top-level thread after attaching a bundle. See [What survives between replies](/docs/claude-tag/concepts/how-it-works#what-survives-between-replies).
3838
from line 59
5959In a channel shared across more than one workspace in your Enterprise Grid, bundles bound to the channel or its workspace don't apply. See [Channels shared across workspaces in your Enterprise Grid](/docs/claude-tag/admins/restrict-access#channels-shared-across-workspaces-in-your-enterprise-grid) for what Claude does there instead.
6060
6161<Warning>A bundle attached to a public channel grants its access to anyone who joins that channel. In most Slack workspaces, anyone can join a public channel, so the channel's join policy becomes the effective access control for whatever the bundle grants. Keep elevated credentials in private-channel scopes.</Warning>
62
63### Attach a bundle to channels by name
64
65A bundle attach rule binds a bundle to every channel whose name matches a pattern, instead of channel by channel. Rules live in the **Auto-join channels** table, the same table that holds the [auto-join patterns](/docs/claude-tag/admins/restrict-access#block-or-auto-join-channels-by-name), in the collapsed **Advanced** section of the **Default Slack access** panel and of each workspace scope's panel at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag). A rule on **Default Slack access** covers matching channels in every connected workspace; a rule on a workspace scope covers only that workspace's matching channels. Adding or removing a bundle on a pattern needs an Owner of your Claude organization. Editing the patterns themselves needs an Admin or Owner.
66
67Each table row is one channel-name pattern. To create a rule, select **Add bundle** on the pattern's row and pick the bundle; if the pattern isn't listed yet, add it with **Add pattern** first. A pattern added here is also an auto-join pattern, so Claude starts joining matching public channels when they're created or renamed.
68
69For example, if your incident channel names start with `inc-`, add `inc-*` with **Add pattern** and attach your incident-response bundle to its row. Claude then joins each new public incident channel and has the bundle's access there.
70
71The rule grants the bundle in every matching channel Claude is in under the scope, including channels it was invited to before the rule existed. The rule itself doesn't add Claude to any channel; only the auto-join patterns, or an invite, do that. A channel whose name matches a [blocked pattern](/docs/claude-tag/admins/restrict-access#block-or-auto-join-channels-by-name) stays off-limits even when a rule matches it. After adding or changing a rule, test with a new thread in a matching channel.
72
73A rule's pattern follows the same syntax as the other [channel name patterns](/docs/claude-tag/admins/restrict-access#block-or-auto-join-channels-by-name), lowercase with `*` matching any run of characters and `?` matching exactly one. Each scope holds up to 20 bundle attach rules. On a workspace scope, the table also lists the organization's patterns, marked **Org-wide**. You can attach a bundle to an **Org-wide** pattern from the workspace's table, and that rule covers only the workspace's matching channels; you edit the pattern itself on **Default Slack access**.
74
75<Warning>A bundle attach rule grants its bundle in every matching channel Claude is in, now or in the future, and anyone who can rename a channel can move it into or out of a pattern. Keep elevated credentials out of broad patterns, and add a [blocked channel pattern](/docs/claude-tag/admins/restrict-access#block-or-auto-join-channels-by-name) for name shapes that should never carry access; a blocked channel stays off-limits whatever rules match it.</Warning>
76
77#### Where rule-attached bundles appear
78
79When bundle attach rules cover a channel, the channel scope's panel lists their bundles under **Attached here by rule**. The list is read-only, because a channel scope doesn't take rules of its own; to change it, edit the rule on **Default Slack access** or the workspace scope. Rules on **Default Slack access** and rules on the channel's workspace apply together.
6280
6381### Attach a single repository or connector
6482
claude-tag/admins/restrict-access Changed · +8 / -4 lines
from line 127
127127
128128### Block or auto-join channels by name
129129
130**Channel name rules** steer where Claude works by channel name instead of channel by channel. The rules sit in the **Advanced** section of the **Default Slack access** panel and of each workspace scope's panel at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), as two pattern lists:
130**Channel name rules** steer where Claude works by channel name instead of channel by channel. The rules sit in the **Advanced** section of the **Default Slack access** panel and of each workspace scope's panel at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), as a **Blocked channel patterns** list and an **Auto-join channels** table:
131131
132132* **Blocked channel patterns**: Claude won't read or respond in a channel whose name matches, even if someone invites it there. When it's added to such a channel or @-mentioned in one, it posts a notice that an admin has blocked it there, and otherwise stays silent.
133* **Auto-join channel patterns**: Claude joins a public channel whose name matches when the channel is created or renamed. Private channels still need an invite. To add Claude to an existing channel, invite it as usual.
133* **Auto-join channels**: Claude joins a public channel whose name matches one of its patterns when the channel is created or renamed. Private channels still need an invite. To add Claude to an existing channel, invite it as usual.
134134
135A pattern is written in lowercase, like Slack channel names, plus two wildcards: `*` matches any run of characters and `?` matches exactly one. `inc-*` matches every channel whose name starts with `inc-`, and `*-confidential-*` matches any name containing `-confidential-`. Each list holds up to 50 patterns of up to 80 characters.
135Each row of the **Auto-join channels** table is one pattern, added with **Add pattern**. A row can also carry [access bundles](/docs/claude-tag/admins/attach-to-scope#attach-a-bundle-to-channels-by-name), which attach in every matching channel Claude is in; a row with no bundles is marked **Auto-join only**, and Claude joins matching channels whether or not a row carries bundles. Editing the patterns needs an Admin or Owner of your Claude organization, and editing the bundles on a row needs an Owner.
136
137Removing a pattern row also detaches the row's bundles. A row marked **Not auto-joined** shows a pattern that still has bundles attached but that the auto-join list no longer carries. Claude joins no new channels for it, but its bundles still attach in matching channels Claude is already in; remove the bundles from the row to end that.
138
139A pattern is written in lowercase, like Slack channel names, plus two wildcards: `*` matches any run of characters and `?` matches exactly one. `inc-*` matches every channel whose name starts with `inc-`, and `*-confidential-*` matches any name containing `-confidential-`. The blocked list and the auto-join table each hold up to 50 patterns of up to 80 characters.
136140
137141A channel that matches a blocked pattern stays off-limits even when it also matches an auto-join pattern. Patterns on **Default Slack access** apply in every connected workspace. A workspace scope can add its own patterns but can't remove the organization's.
138142