One read of Claude Documentationclaude-docs-20261020T180705Z
246 pages moved out of 277 read.
Pages moved
246
significant first
Pages read
277
in this capture
Captured
18:07 UTC
Corpus hash
cf94986ff2f8
corpus-hash
What this read moved
51-75 of 246, page 3 of 10This capture is too large to show at once. Changes 51-75 of 246 are below, significant first; the rest are on the following screens.
claude-tag/admins/connections/snowflake Changed · +3 / -3 lines
from line 2
22
33> Connect Snowflake to Claude Tag so it can run read-only queries on your warehouse. Covers the dedicated user to create, the access token field, and the host to allow.
44
5export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
6
7<BetaNote />
5> [!NOTE]
6>
7> Claude Tag is in public beta. Features and behavior described here may change before general availability.
88
99Connecting Snowflake lets Claude run queries against your warehouse in any channel where the connector is on. Claude connects with its own credential, not a person's.
1010
claude-tag/admins/connections/stripe Changed · +3 / -3 lines
from line 2
22
33> Connect Stripe to Claude Tag so it can answer billing and subscription questions. Covers the dedicated account to create, the key fields, and the URL to allow.
44
5export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
6
7<BetaNote />
5> [!NOTE]
6>
7> Claude Tag is in public beta. Features and behavior described here may change before general availability.
88
99Connecting Stripe lets Claude answer billing and subscription questions in any channel where the connector is on. Claude connects with its own credential, not a person's.
1010
claude-tag/admins/connections/vercel Changed · +3 / -3 lines
from line 2
22
33> Connect Vercel to Claude Tag so it can check deployment status and logs. Covers the dedicated account to create, the token fields, and the URL to allow.
44
5export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
6
7<BetaNote />
5> [!NOTE]
6>
7> Claude Tag is in public beta. Features and behavior described here may change before general availability.
88
99Connecting Vercel lets Claude check deployment status and logs in any channel where the connector is on. Claude connects with its own credential, not a person's.
1010
claude-tag/admins/customize Changed · +15 / -17 lines
from line 2
22
33> Claude Tag is customized per channel and workspace (a scope), not per user. See what admins set in claude.ai, what anyone can change from the channel, and what stays fixed.
44
5export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
5> [!NOTE]
6>
7> Claude Tag is in public beta. Features and behavior described here may change before general availability.
68
7<BetaNote />
8
99Claude Tag's behavior is shaped by four layers, each set in a different place:
1010
1111| Layer | What it is | Who sets it | Where |
from line 34
3434| Enable Claude Tag | Turns Claude on or off in a scope. On the **Slack** page, the switch is labeled **Respond in all channels** or **Respond in channels** | [Turn Claude Tag on or off and set the version for a scope](/docs/claude-tag/admins/workspaces#turn-claude-tag-on-or-off-and-set-the-version-for-a-scope) |
3535| Claude Tag version | Which generation answers in a scope (**New** or **Legacy**) | [Turn Claude Tag on or off and set the version for a scope](/docs/claude-tag/admins/workspaces#turn-claude-tag-on-or-off-and-set-the-version-for-a-scope) |
3636
37<a id="channel-connections-are-separate-from-personal-connectors" />
38
3937### Claude Tag connectors are separate from personal connectors
4038
4139An Owner or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access#delegate-claude-tag-administration) configures Claude Tag connectors, plugins, and skills, and they apply per scope. They are separate from the personal connectors, skills, or MCP servers an individual user has set up in their own claude.ai or Claude Desktop account. A user's personal connectors are not part of a channel's configuration, and the channel's connectors are not listed among that user's personal connectors in claude.ai. Claude can [use a user's personal connectors in a channel](/docs/claude-tag/concepts/personal-connectors) for that user's own tasks, after the user allows it. That work runs with the user's permissions and is recorded under their name. Projects in claude.ai are separate too. Claude doesn't read a Project's instructions or knowledge in Slack, and a channel can't be pointed at a Project. Put standing guidance for a channel in its [custom instructions](/docs/claude-tag/admins/attach-to-scope#add-custom-instructions).
from line 123
125123
126124Creating the environment and choosing it on a scope happen on two different admin pages. Choose it on a channel to change only that channel's sessions, on a workspace to cover every channel in the workspace where you haven't chosen one, or on the **Slack** page to cover every workspace.
127125
128<Steps>
129 <Step title="Create the environment">
130 From the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings), add an [organization-shared environment](https://code.claude.com/docs/en/cloud-environments#organization-shared-environments) and fill in its setup script, environment variables, and network access level.
131 </Step>
126**1. Create the environment**
132127
133 <Step title="Set the scope's environment">
134 Go to [**Claude's access > Channels**](https://claude.ai/admin-settings/claude-tag?access=channels) and open the scope's page (**Slack** for the whole organization). On its **Advanced** tab, pick the environment in **Environment** under **Sessions**.
135 </Step>
128From the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings), add an [organization-shared environment](https://code.claude.com/docs/en/cloud-environments#organization-shared-environments) and fill in its setup script, environment variables, and network access level.
136129
137 <Step title="Confirm the environment in a new thread">
138 Start a fresh thread in the channel and ask Claude to use what you added, such as running the tool your setup script installed. Threads already underway keep the environment they started on, so an existing thread won't show the change.
139 </Step>
140</Steps>
130**2. Set the scope's environment**
141131
132Go to [**Claude's access > Channels**](https://claude.ai/admin-settings/claude-tag?access=channels) and open the scope's page (**Slack** for the whole organization). On its **Advanced** tab, pick the environment in **Environment** under **Sessions**.
133
134**3. Confirm the environment in a new thread**
135
136Start a fresh thread in the channel and ask Claude to use what you added, such as running the tool your setup script installed. Threads already underway keep the environment they started on, so an existing thread won't show the change.
137
142138### Which environment a channel's sessions use
143139
144140When a session starts, Claude uses the first environment it finds, in this order:
from line 162
166162* **Inheritance:** rules you set on a workspace or on the [**Slack** page](/docs/claude-tag/admins/attach-to-scope#how-scopes-inherit) (the organization-wide root) carry down to the channels beneath, the way [custom instructions](/docs/claude-tag/admins/attach-to-scope#custom-instructions) stack. A channel's own rules add to those and never replace them, so put a rule on a single channel's scope to pre-approve an action there without changing any other channel.
167163* **Access:** you edit the list with the same admin access as the scope's other **Advanced** settings
168164
169<Warning>Once you add an allow rule, Claude runs the actions it names in every channel the scope covers without anyone approving them in the moment. Keep each rule narrow: name the tool, the action, and the environment it allows, and put rules that unlock sensitive systems on the narrowest scope that needs them.</Warning>
165> [!WARNING]
166>
167> Once you add an allow rule, Claude runs the actions it names in every channel the scope covers without anyone approving them in the moment. Keep each rule narrow: name the tool, the action, and the environment it allows, and put rules that unlock sensitive systems on the narrowest scope that needs them.
170168
171169## Name, handle, and avatar of the Claude app
172170
claude-tag/admins/federated-access/authorization-server Changed · +20 / -20 lines
from line 2
22
33> Let Claude exchange a short-lived identity token for an access token from an OAuth 2.0 authorization server you run, then call your APIs with it. Covers what your token endpoint receives and must check, what it returns, and how to register it in the console.
44
5export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
5> [!NOTE]
6>
7> Claude Tag is in public beta. Features and behavior described here may change before general availability.
68
7<BetaNote />
9> [!NOTE]
10>
11> Authorization servers are connected on the [**Federated agent access**](https://claude.ai/admin-settings/claude-tag/federated-cloud-access) page, under **Claude Tag** in the admin settings sidebar. Use its **Authorization servers** section. Connecting a server needs an organization Owner, or an admin with full Claude Tag management permission.
812
9<Note>Authorization servers are connected on the [**Federated agent access**](https://claude.ai/admin-settings/claude-tag/federated-cloud-access) page, under **Claude Tag** in the admin settings sidebar. Use its **Authorization servers** section. Connecting a server needs an organization Owner, or an admin with full Claude Tag management permission.</Note>
10
1113With an authorization server connection, Claude presents a short-lived identity token to an OAuth 2.0 authorization server you run, receives one of your access tokens in return, and calls your APIs with it. No long-lived credential for your systems is stored in Claude, and [Agent Proxy](/docs/claude-tag/concepts/agent-identity#agent-proxy) holds each access token only until it expires. The identity token names your organization and the [agent](/docs/claude-tag/concepts/agent-identity) making the request (Claude's identity in one Slack channel), and your server decides whether to issue a token for it.
1214
1315Choose this when you run an authorization server that issues tokens for your APIs. If your own service will verify the identity token on every request instead, [connect a gateway](/docs/claude-tag/admins/federated-access/connect-a-gateway). If a vendor's API gave you a private key to sign assertions with (Salesforce, for example), use the [OAuth 2.0 JWT bearer](/docs/claude-tag/admins/connections/custom#oauth-2-0-jwt-bearer) credential type instead; the console labels this page's connection **Authorization server**.
from line 66
6466
6567## Register the endpoint and connect the server
6668
67<Steps>
68 <Step title="Open the Connect an authorization server dialog">
69 In **Authorization servers**, click **Connect an authorization server**.
70 </Step>
69**1. Open the Connect an authorization server dialog**
7170
72 <Step title="Enter the token endpoint">
73 In the **Token endpoint** field, enter the full address starting with `https://`, for example `https://auth.example.com/oauth2/token`. In the **Issuer URL** field, enter your authorization server's issuer identifier, the `iss` value it uses, for example `https://auth.example.com`. That value is the token's audience, and it must be an HTTPS URL on the same host as the token endpoint. Leave the field empty only if your server requires the token endpoint URL as the audience. Then the **Token endpoint** address is the audience. The **Audience** row of the card shows which one will be sent.
74 </Step>
71In **Authorization servers**, click **Connect an authorization server**.
7572
76 <Step title="Confirm the subject check and register">
77 Select the checkbox labeled **This authorization server checks that each token's subject belongs to your organization**. The **Register server** button stays disabled until you do. The checkbox is your confirmation that the server makes the subject check described under [Configure the authorization server](#configure-the-authorization-server), and a server that doesn't must not be connected. Then click **Register server**. The dialog notes that the automatic connection check doesn't run for token endpoints. The token's audience, your **Issuer URL** value or the token endpoint if you left that field empty, is registered as a gateway with the check marked **Skipped**, and the dialog moves to the second step.
73**2. Enter the token endpoint**
7874
79 If you close the dialog at that point, the audience address stays registered and counts toward the limit. To continue later, click **Connect an authorization server** again, enter the same **Token endpoint** and **Issuer URL**, and select the checkbox again, which returns you to the second step. Don't use **Add to bundle** on that address's row in the **Gateways** table; that would connect the address as a gateway, after which the server can't be connected.
80 </Step>
75In the **Token endpoint** field, enter the full address starting with `https://`, for example `https://auth.example.com/oauth2/token`. In the **Issuer URL** field, enter your authorization server's issuer identifier, the `iss` value it uses, for example `https://auth.example.com`. That value is the token's audience, and it must be an HTTPS URL on the same host as the token endpoint. Leave the field empty only if your server requires the token endpoint URL as the audience. Then the **Token endpoint** address is the audience. The **Audience** row of the card shows which one will be sent.
8176
82 <Step title="Choose the APIs and the bundle">
83 Optionally enter a **Resource**, the API the returned token should be scoped to as an absolute URI (for example `https://api.example.com`), and a **Scope**, space-separated scopes to request. In **Allowed API hosts**, add the hosts Claude may call with the returned token, for example `api.example.com`. A wildcard as the leftmost label matches any subdomain. An entry or wildcard can cover the token endpoint's host only when the endpoint's address has a folder of its own, like `/oauth2` in `https://auth.example.com/oauth2/token`. In that case, list the paths Claude may use, such as `/graphql`, under **Allowed API paths**. A listed path covers everything under it, and a path that overlaps the token endpoint's folder isn't allowed. Then choose a bundle from the **Access bundle** list (or create one: click **New bundle** if the dialog shows it, enter a **Bundle name**, and click **Create bundle**) and click **Connect server**.
77**3. Confirm the subject check and register**
8478
85 This creates a [connection](/docs/claude-tag/admins/add-connections) in that bundle, with the API hosts under **Allowed hosts**. Agent Proxy attaches the access token as an `Authorization: Bearer` header to every request Claude makes to those hosts. A token endpoint can be connected once in your organization, in one bundle, and the connection applies wherever that bundle applies.
86 </Step>
87</Steps>
79Select the checkbox labeled **This authorization server checks that each token's subject belongs to your organization**. The **Register server** button stays disabled until you do. The checkbox is your confirmation that the server makes the subject check described under [Configure the authorization server](#configure-the-authorization-server), and a server that doesn't must not be connected. Then click **Register server**. The dialog notes that the automatic connection check doesn't run for token endpoints. The token's audience, your **Issuer URL** value or the token endpoint if you left that field empty, is registered as a gateway with the check marked **Skipped**, and the dialog moves to the second step.
80
81If you close the dialog at that point, the audience address stays registered and counts toward the limit. To continue later, click **Connect an authorization server** again, enter the same **Token endpoint** and **Issuer URL**, and select the checkbox again, which returns you to the second step. Don't use **Add to bundle** on that address's row in the **Gateways** table; that would connect the address as a gateway, after which the server can't be connected.
82
83**4. Choose the APIs and the bundle**
84
85Optionally enter a **Resource**, the API the returned token should be scoped to as an absolute URI (for example `https://api.example.com`), and a **Scope**, space-separated scopes to request. In **Allowed API hosts**, add the hosts Claude may call with the returned token, for example `api.example.com`. A wildcard as the leftmost label matches any subdomain. An entry or wildcard can cover the token endpoint's host only when the endpoint's address has a folder of its own, like `/oauth2` in `https://auth.example.com/oauth2/token`. In that case, list the paths Claude may use, such as `/graphql`, under **Allowed API paths**. A listed path covers everything under it, and a path that overlaps the token endpoint's folder isn't allowed. Then choose a bundle from the **Access bundle** list (or create one: click **New bundle** if the dialog shows it, enter a **Bundle name**, and click **Create bundle**) and click **Connect server**.
86
87This creates a [connection](/docs/claude-tag/admins/add-connections) in that bundle, with the API hosts under **Allowed hosts**. Agent Proxy attaches the access token as an `Authorization: Bearer` header to every request Claude makes to those hosts. A token endpoint can be connected once in your organization, in one bundle, and the connection applies wherever that bundle applies.
8888
8989The **Authorization servers** table lists each server by its **Token endpoint**, with its **Access bundle**, its **Allowed hosts**, when it was **Added**, and a **Remove** action. The audience address also appears in the **Gateways** table with its check marked **Skipped** and a note that a connected authorization server uses it.
9090
claude-tag/admins/federated-access/aws Changed · +52 / -54 lines
from line 2
22
33> Let Claude sign in to an IAM role in your AWS account with a short-lived identity token instead of stored access keys. Covers the identity provider and trust policy to create in AWS, how to connect the role in the console, and how to verify the connection in CloudTrail.
44
5export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
5> [!NOTE]
6>
7> Claude Tag is in public beta. Features and behavior described here may change before general availability.
68
7<BetaNote />
9> [!NOTE]
10>
11> AWS roles are connected on the [**Federated agent access**](https://claude.ai/admin-settings/claude-tag/federated-cloud-access) page, under **Claude Tag** in the admin settings sidebar. Use its **Cloud roles** section. Connecting a role needs an organization Owner, or an admin with full Claude Tag management permission.
812
9<Note>AWS roles are connected on the [**Federated agent access**](https://claude.ai/admin-settings/claude-tag/federated-cloud-access) page, under **Claude Tag** in the admin settings sidebar. Use its **Cloud roles** section. Connecting a role needs an organization Owner, or an admin with full Claude Tag management permission.</Note>
10
1113With an AWS role connection, Claude signs in to an IAM role in your AWS account with a short-lived identity token and calls AWS with the role's permissions. No access key is stored in Claude. The token names your organization and the [agent](/docs/claude-tag/concepts/agent-identity) making the request (Claude's identity in one Slack channel), and your role's trust policy decides which tokens to accept. If someone else manages your AWS account, give them the values from the console and the trust policy below; the console steps need an organization Owner or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access#delegate-claude-tag-administration).
1214
1315## Before you begin
from line 30
2830
2931## Create the identity provider and role in AWS
3032
31<Steps>
32 <Step title="Create the IAM identity provider">
33 In the AWS account that owns the role, create an IAM OpenID Connect (OIDC) identity provider with the provider URL `https://identity.anthropic.com/agents` and the audience `sts.amazonaws.com`. Include the `/agents` path. A provider created with the bare hostname, or with any other path, makes every sign-in fail later with an invalid-token or provider error from AWS. You don't need to supply a certificate thumbprint, because AWS verifies the provider's certificate itself.
33**1. Create the IAM identity provider**
3434
35 To confirm the provider, run `aws iam get-open-id-connect-provider --open-id-connect-provider-arn <provider ARN>` and check that `Url` is `identity.anthropic.com/agents` (AWS stores the URL without `https://`) and `ClientIDList` contains `sts.amazonaws.com`.
36 </Step>
35In the AWS account that owns the role, create an IAM OpenID Connect (OIDC) identity provider with the provider URL `https://identity.anthropic.com/agents` and the audience `sts.amazonaws.com`. Include the `/agents` path. A provider created with the bare hostname, or with any other path, makes every sign-in fail later with an invalid-token or provider error from AWS. You don't need to supply a certificate thumbprint, because AWS verifies the provider's certificate itself.
3736
38 <Step title="Create the role with this trust policy">
39 Create an IAM role with the trust policy below. Replace the account ID with yours (the rest of the provider ARN is the same for every account), and replace the `sub` value with your **Subject prefix** followed by `*`.
37To confirm the provider, run `aws iam get-open-id-connect-provider --open-id-connect-provider-arn <provider ARN>` and check that `Url` is `identity.anthropic.com/agents` (AWS stores the URL without `https://`) and `ClientIDList` contains `sts.amazonaws.com`.
4038
41 ```json theme={null}
39**2. Create the role with this trust policy**
40
41Create an IAM role with the trust policy below. Replace the account ID with yours (the rest of the provider ARN is the same for every account), and replace the `sub` value with your **Subject prefix** followed by `*`.
42
43```json theme={null}
44{
45 "Version": "2012-10-17",
46 "Statement": [
4247 {
43 "Version": "2012-10-17",
44 "Statement": [
45 {
46 "Effect": "Allow",
47 "Principal": {
48 "Federated": "arn:aws:iam::123456789012:oidc-provider/identity.anthropic.com/agents"
49 },
50 "Action": "sts:AssumeRoleWithWebIdentity",
51 "Condition": {
52 "StringEquals": {
53 "identity.anthropic.com/agents:aud": "sts.amazonaws.com"
54 },
55 "StringLike": {
56 "identity.anthropic.com/agents:sub": "wimse://identity.anthropic.com/org/org_01Hx7rQkPzT9sN3mVbJw2eYd/agent/*"
57 }
58 }
48 "Effect": "Allow",
49 "Principal": {
50 "Federated": "arn:aws:iam::123456789012:oidc-provider/identity.anthropic.com/agents"
51 },
52 "Action": "sts:AssumeRoleWithWebIdentity",
53 "Condition": {
54 "StringEquals": {
55 "identity.anthropic.com/agents:aud": "sts.amazonaws.com"
56 },
57 "StringLike": {
58 "identity.anthropic.com/agents:sub": "wimse://identity.anthropic.com/org/org_01Hx7rQkPzT9sN3mVbJw2eYd/agent/*"
5959 }
60 ]
60 }
6161 }
62 ```
62 ]
63}
64```
6365
64 Keep both conditions. Because every organization's tokens come from the same issuer with the same audience, the `sub` condition is the only thing that limits the role to your organization; see [Authorize on the subject](/docs/claude-tag/admins/federated-access/token-reference#authorize-on-the-subject). The wildcard replaces only the agent ID at the end. Never put a wildcard before `/agent/`. `StringEquals` on the prefix never matches, so keep the prefix condition under `StringLike`. Both condition keys start with `identity.anthropic.com/agents:` (the issuer without `https://`).
66Keep both conditions. Because every organization's tokens come from the same issuer with the same audience, the `sub` condition is the only thing that limits the role to your organization; see [Authorize on the subject](/docs/claude-tag/admins/federated-access/token-reference#authorize-on-the-subject). The wildcard replaces only the agent ID at the end. Never put a wildcard before `/agent/`. `StringEquals` on the prefix never matches, so keep the prefix condition under `StringLike`. Both condition keys start with `identity.anthropic.com/agents:` (the issuer without `https://`).
6567
66 The prefix condition is the minimum, and it admits every agent in your organization. Where your use case allows, pin the role to specific agents instead, which is the strongest form: use `StringEquals` on `identity.anthropic.com/agents:sub` with one full subject, or a JSON array of full subjects. The console doesn't show agent IDs, so you learn a subject from CloudTrail after a first sign-in under the prefix condition. Agent IDs change when a Slack channel is deleted and recreated, so update the policy when that happens.
67 </Step>
68The prefix condition is the minimum, and it admits every agent in your organization. Where your use case allows, pin the role to specific agents instead, which is the strongest form: use `StringEquals` on `identity.anthropic.com/agents:sub` with one full subject, or a JSON array of full subjects. The console doesn't show agent IDs, so you learn a subject from CloudTrail after a first sign-in under the prefix condition. Agent IDs change when a Slack channel is deleted and recreated, so update the policy when that happens.
6869
69 <Step title="Attach permissions">
70 Attach a least-privilege permissions policy to the role for the work Claude will do. The check under [Verify the connection](#verify-the-connection) needs no permissions. Each sign-in gives Claude temporary credentials that last 1 hour, the AWS default. Claude doesn't ask for a different length, and the role's maximum session duration setting doesn't change this. To cut off access before they expire, use the role's **Revoke active sessions** option in IAM or change its permissions.
71 </Step>
72</Steps>
70**3. Attach permissions**
7371
72Attach a least-privilege permissions policy to the role for the work Claude will do. The check under [Verify the connection](#verify-the-connection) needs no permissions. Each sign-in gives Claude temporary credentials that last 1 hour, the AWS default. Claude doesn't ask for a different length, and the role's maximum session duration setting doesn't change this. To cut off access before they expire, use the role's **Revoke active sessions** option in IAM or change its permissions.
73
7474## Connect the role in the console
7575
76<Steps>
77 <Step title="Open the Connect an AWS role dialog">
78 In **Cloud roles**, click **Connect an AWS role**.
79 </Step>
76**1. Open the Connect an AWS role dialog**
8077
81 <Step title="Enter the role ARN">
82 In the **Role ARN** field, enter the role's ARN, for example `arn:aws:iam::123456789012:role/ClaudeTag`. The role's name is used as the connection's name.
83 </Step>
78In **Cloud roles**, click **Connect an AWS role**.
8479
85 <Step title="Narrow the allowed AWS hosts">
86 The **Allowed AWS hosts** field starts with `*.amazonaws.com`, which lets Claude use the role with any AWS service. Keep that entry for the first verification, then narrow the list to the hosts Claude needs from the connection's [**Edit connection** dialog](/docs/claude-tag/admins/add-connections#set-allowed-websites), which you open from the connection's row on the **Connectors** tab; see [Manage federated connections on the Connectors tab](/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab). A wildcard covers subdomains only: `*.s3.us-west-2.amazonaws.com` matches `example-reports.s3.us-west-2.amazonaws.com` but not `s3.us-west-2.amazonaws.com`. The AWS CLI and SDKs use both forms for S3, so list both the plain host and the wildcard for each region, and for `us-east-1` also `*.s3.amazonaws.com`, the older global S3 address some tools still use there. Every host must end in `.amazonaws.com`. The sign-in itself goes to the AWS Security Token Service (STS) from Anthropic's side and doesn't need an entry here.
87 </Step>
80**2. Enter the role ARN**
8881
89 <Step title="Confirm the trust policy">
90 Select the checkbox labeled **The role's trust policy requires the subject prefix shown above**. The **Connect role** button stays disabled until you do. Select it only if the trust policy pins `sub` to one or more full subjects under your **Subject prefix**, or to your prefix followed by `*` under `StringLike`, as described under [Create the identity provider and role in AWS](#create-the-identity-provider-and-role-in-aws).
91 </Step>
82In the **Role ARN** field, enter the role's ARN, for example `arn:aws:iam::123456789012:role/ClaudeTag`. The role's name is used as the connection's name.
9283
93 <Step title="Choose a bundle and connect">
94 Choose a bundle from the **Access bundle** list, or create one: click **New bundle** if the dialog shows it, enter a **Bundle name**, and click **Create bundle**. Then click **Connect role**. This creates a [connection](/docs/claude-tag/admins/add-connections) in that bundle, with the hosts you entered under **Allowed hosts**. A role can be connected in one bundle only, and it applies wherever that bundle applies.
95 </Step>
96</Steps>
84**3. Narrow the allowed AWS hosts**
85
86The **Allowed AWS hosts** field starts with `*.amazonaws.com`, which lets Claude use the role with any AWS service. Keep that entry for the first verification, then narrow the list to the hosts Claude needs from the connection's [**Edit connection** dialog](/docs/claude-tag/admins/add-connections#set-allowed-websites), which you open from the connection's row on the **Connectors** tab; see [Manage federated connections on the Connectors tab](/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab). A wildcard covers subdomains only: `*.s3.us-west-2.amazonaws.com` matches `example-reports.s3.us-west-2.amazonaws.com` but not `s3.us-west-2.amazonaws.com`. The AWS CLI and SDKs use both forms for S3, so list both the plain host and the wildcard for each region, and for `us-east-1` also `*.s3.amazonaws.com`, the older global S3 address some tools still use there. Every host must end in `.amazonaws.com`. The sign-in itself goes to the AWS Security Token Service (STS) from Anthropic's side and doesn't need an entry here.
87
88**4. Confirm the trust policy**
89
90Select the checkbox labeled **The role's trust policy requires the subject prefix shown above**. The **Connect role** button stays disabled until you do. Select it only if the trust policy pins `sub` to one or more full subjects under your **Subject prefix**, or to your prefix followed by `*` under `StringLike`, as described under [Create the identity provider and role in AWS](#create-the-identity-provider-and-role-in-aws).
91
92**5. Choose a bundle and connect**
93
94Choose a bundle from the **Access bundle** list, or create one: click **New bundle** if the dialog shows it, enter a **Bundle name**, and click **Create bundle**. Then click **Connect role**. This creates a [connection](/docs/claude-tag/admins/add-connections) in that bundle, with the hosts you entered under **Allowed hosts**. A role can be connected in one bundle only, and it applies wherever that bundle applies.
9795
9896The **Cloud roles** table has **Role**, **Access bundle**, **Allowed hosts**, **Added**, and **Actions** columns. Each connection's name appears under **Role** with the role's ARN and an **AWS role** chip beneath it, and **Check trust policy** and **Remove** are under **Actions**.
9997
claude-tag/admins/federated-access/connect-a-gateway Changed · +21 / -21 lines
from line 2
22
33> Connect a gateway you run so Claude Tag can call your internal services with a short-lived identity token instead of a stored credential. Covers what the gateway must check, how to register it in the console, and how to verify the connection.
44
5export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
5> [!NOTE]
6>
7> Claude Tag is in public beta. Features and behavior described here may change before general availability.
68
7<BetaNote />
9> [!NOTE]
10>
11> Gateways are connected on the [**Federated agent access**](https://claude.ai/admin-settings/claude-tag/federated-cloud-access) page, under **Claude Tag** in the admin settings sidebar. Use its **Gateways** section. Connecting a gateway needs an organization Owner, or an admin with full Claude Tag management permission.
812
9<Note>Gateways are connected on the [**Federated agent access**](https://claude.ai/admin-settings/claude-tag/federated-cloud-access) page, under **Claude Tag** in the admin settings sidebar. Use its **Gateways** section. Connecting a gateway needs an organization Owner, or an admin with full Claude Tag management permission.</Note>
10
1113A gateway is a service you run between Claude and your internal systems. Every request Claude sends it carries a signed identity token naming your organization and the [agent](/docs/claude-tag/concepts/agent-identity) making the request (Claude's identity in one Slack channel). The gateway checks the token, decides what that agent may do, and forwards the request with your own credentials. No long-lived credential for your systems is stored in Claude.
1214
1315Two terms recur on this page. The **subject check** is what your gateway does to every token, confirming it belongs to your organization. The **connection check** is what the console does once, when you connect the gateway, confirming that your gateway performs the subject check.
from line 54
5254
5355## Register the gateway in the console
5456
55<Steps>
56 <Step title="Open the Connect a gateway dialog">
57 In **Gateways**, click **Connect a gateway**.
58 </Step>
57**1. Open the Connect a gateway dialog**
5958
60 <Step title="Enter the gateway address">
61 In the **Gateway address** field, enter the host only, in lowercase, starting with `https://`, for example `https://gateway.example.com`. This address is the token's audience.
62 </Step>
59In **Gateways**, click **Connect a gateway**.
6360
64 <Step title="Confirm the subject check">
65 Select the **This gateway checks that each token's subject belongs to your organization** checkbox. The **Run check and connect** button stays disabled until you do. Select it only if the gateway rejects every subject outside your organization, by explicit list, by prefix, or by the `tenant` claim.
66 </Step>
61**2. Enter the gateway address**
6762
68 <Step title="Run the connection check">
69 Leave the **Run the check** option selected and click **Run check and connect**. The check can take up to a minute. If it fails, nothing is registered; see [Common errors](#common-errors). If the gateway can't be reached from the internet yet, select the **Skip the check** option, enter a **Reason for skipping**, and click **Connect without the check**. The reason is shown in the **Gateways** table, under the **Skipped** result's **Details**. Entering an address that is already registered runs the check again (unless you skip it) without changing the stored result, then moves to the bundle step.
70 </Step>
63In the **Gateway address** field, enter the host only, in lowercase, starting with `https://`, for example `https://gateway.example.com`. This address is the token's audience.
7164
72 <Step title="Add the gateway to a bundle">
73 Choose a bundle from the **Access bundle** list, or create one: click **New bundle** if the dialog shows it, enter a **Bundle name**, and click **Create bundle**. Then click **Add to bundle**. This creates a connection in that bundle, with the gateway's host as its allowed website. A gateway can be in more than one bundle, and it applies wherever those bundles apply. The **Access bundle** list offers only the bundles it isn't in yet. Click **Not now** to finish without a bundle.
74 </Step>
75</Steps>
65**3. Confirm the subject check**
66
67Select the **This gateway checks that each token's subject belongs to your organization** checkbox. The **Run check and connect** button stays disabled until you do. Select it only if the gateway rejects every subject outside your organization, by explicit list, by prefix, or by the `tenant` claim.
68
69**4. Run the connection check**
70
71Leave the **Run the check** option selected and click **Run check and connect**. The check can take up to a minute. If it fails, nothing is registered; see [Common errors](#common-errors). If the gateway can't be reached from the internet yet, select the **Skip the check** option, enter a **Reason for skipping**, and click **Connect without the check**. The reason is shown in the **Gateways** table, under the **Skipped** result's **Details**. Entering an address that is already registered runs the check again (unless you skip it) without changing the stored result, then moves to the bundle step.
72
73**5. Add the gateway to a bundle**
74
75Choose a bundle from the **Access bundle** list, or create one: click **New bundle** if the dialog shows it, enter a **Bundle name**, and click **Create bundle**. Then click **Add to bundle**. This creates a connection in that bundle, with the gateway's host as its allowed website. A gateway can be in more than one bundle, and it applies wherever those bundles apply. The **Access bundle** list offers only the bundles it isn't in yet. Click **Not now** to finish without a bundle.
7676
7777The **Gateways** table lists each gateway with its **Access bundles**, its **Connection check** result (**Passed**, or **Skipped**, with the reason you gave under **Details**), when it was added, and **Add to bundle** and **Remove** actions; on a row that is already in a bundle, the add action reads **Add to another bundle**. For a gateway that is already registered, skip the dialog's first step: click the add action in the gateway's row of the **Gateways** table, which opens the dialog at the bundle step. Entering the address again in **Connect a gateway** also reaches the bundle step, but unless you skip the check it runs again first, and that run counts toward the check limit.
7878
claude-tag/admins/federated-access/gcp Changed · +31 / -31 lines
from line 2
22
33> Let Claude call Google Cloud through workload identity federation with a short-lived identity token instead of a service account key. Covers the pool, provider, and IAM grants to create, with or without a service account, and how to connect the identity in the console.
44
5export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
5> [!NOTE]
6>
7> Claude Tag is in public beta. Features and behavior described here may change before general availability.
68
7<BetaNote />
9> [!NOTE]
10>
11> Google Cloud identities are connected on the [**Federated agent access**](https://claude.ai/admin-settings/claude-tag/federated-cloud-access) page, under **Claude Tag** in the admin settings sidebar. Use its **Cloud roles** section. Connecting an identity needs an organization Owner, or an admin with full Claude Tag management permission.
812
9<Note>Google Cloud identities are connected on the [**Federated agent access**](https://claude.ai/admin-settings/claude-tag/federated-cloud-access) page, under **Claude Tag** in the admin settings sidebar. Use its **Cloud roles** section. Connecting an identity needs an organization Owner, or an admin with full Claude Tag management permission.</Note>
10
1113With a Google Cloud identity connection, Claude exchanges a short-lived identity token at a workload identity pool you create and calls Google Cloud APIs with the result. No service account key is stored in Claude. The token names your organization and the [agent](/docs/claude-tag/concepts/agent-identity) making the request (Claude's identity in one Slack channel), and your pool's attribute condition decides which tokens to accept. If someone else manages your Google Cloud project, give them the values from Claude's admin settings and the settings below; the console steps need an organization Owner or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access#delegate-claude-tag-administration).
1214
1315Before you start, decide whether Claude acts as the federated identity itself, with roles granted to it directly, or as a service account you create. Both forms are covered below.
from line 71
6971
7072## Connect the identity in the console
7173
72<Steps>
73 <Step title="Open the Connect a Google Cloud identity dialog">
74 In **Cloud roles**, click **Connect a Google Cloud identity**.
75 </Step>
74**1. Open the Connect a Google Cloud identity dialog**
7675
77 <Step title="Enter the provider resource name">
78 In the **Workload identity provider** field, enter `//iam.googleapis.com/` followed by the provider's full name as Google reports it, for example `//iam.googleapis.com/projects/123456789/locations/global/workloadIdentityPools/claude/providers/agents`. Use the project number, not the project ID (find it on the project's dashboard in the Google Cloud console). The value is stored as you type it and is the token's audience.
79 </Step>
76In **Cloud roles**, click **Connect a Google Cloud identity**.
8077
81 <Step title="Name the service account, or leave the field empty">
82 In the **Service account to act as (optional)** field, enter the service account's email, for example `[email protected]`, if you chose the form with a service account. Leave the field empty to have Claude act as the federated identity itself. The connection is named after the service account, or after the provider's ID (the last part of its resource name) when there is none.
83 </Step>
78**2. Enter the provider resource name**
8479
85 <Step title="Decide whether to block credential minting">
86 The **Block requests that mint new credentials** checkbox is selected by default. With it selected:
80In the **Workload identity provider** field, enter `//iam.googleapis.com/` followed by the provider's full name as Google reports it, for example `//iam.googleapis.com/projects/123456789/locations/global/workloadIdentityPools/claude/providers/agents`. Use the project number, not the project ID (find it on the project's dashboard in the Google Cloud console). The value is stored as you type it and is the token's audience.
8781
88 * Claude can't use this identity to call Google endpoints that create keys, tokens, or other credentials, even if IAM would allow the call.
89 * Requests to a list of services that deal in credentials are refused entirely. See [what the credential-minting block refuses](/docs/claude-tag/admins/federated-access/limits#what-the-credential-minting-block-refuses) on the limits page.
90 * gRPC calls are refused, so tell Claude in the custom instructions to use the REST transport of client libraries such as Spanner, Bigtable, Firestore, and Pub/Sub.
82**3. Name the service account, or leave the field empty**
9183
92 If Claude needs one of the refused services, clear the checkbox and rely on your IAM grants alone. The token exchange itself, including acting as the service account, happens inside Agent Proxy and isn't affected by this checkbox or by the allowed hosts.
93 </Step>
84In the **Service account to act as (optional)** field, enter the service account's email, for example `[email protected]`, if you chose the form with a service account. Leave the field empty to have Claude act as the federated identity itself. The connection is named after the service account, or after the provider's ID (the last part of its resource name) when there is none.
9485
95 <Step title="Narrow the allowed Google hosts">
96 Replace the prefilled `*.googleapis.com` entry in the **Allowed Google hosts** field with the hosts Claude needs, for example `storage.googleapis.com`. A wildcard as the leftmost label, such as `*.storage.googleapis.com`, matches any subdomain but not the name itself. Every host must be `googleapis.com`, a subdomain of it, or a subdomain of `clients6.google.com`. You can change the list later from the connection's [**Edit connection** dialog](/docs/claude-tag/admins/add-connections#set-allowed-websites), which you open from the connection's row on the **Connectors** tab; see [Manage federated connections on the Connectors tab](/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab).
97 </Step>
86**4. Decide whether to block credential minting**
9887
99 <Step title="Confirm the attribute condition">
100 Select the checkbox labeled **The provider's attribute condition requires the subject prefix shown above**. The **Connect identity** button stays disabled until you do. Select the checkbox only if the provider's attribute condition pins `assertion.sub` to one or more full subjects under your **Subject prefix**, or at minimum pins `assertion.sub` to your **Subject prefix** (or, if you mapped it, `attribute.org` to your organization ID), as described under [Create the pool and provider in Google Cloud](#create-the-pool-and-provider-in-google-cloud).
101 </Step>
88The **Block requests that mint new credentials** checkbox is selected by default. With it selected:
10289
103 <Step title="Choose a bundle and connect">
104 Choose a bundle from the **Access bundle** list, or create one: click **New bundle** if the dialog shows it, enter a **Bundle name**, and click **Create bundle**. Then click **Connect identity**. This creates a [connection](/docs/claude-tag/admins/add-connections) in that bundle, with the hosts you entered under **Allowed hosts**. The same provider can be connected more than once, for example once with a service account and once without, as long as no two Google Cloud connections in one bundle share a host under **Allowed hosts**. Each connection applies wherever its bundle applies.
105 </Step>
106</Steps>
90* Claude can't use this identity to call Google endpoints that create keys, tokens, or other credentials, even if IAM would allow the call.
91* Requests to a list of services that deal in credentials are refused entirely. See [what the credential-minting block refuses](/docs/claude-tag/admins/federated-access/limits#what-the-credential-minting-block-refuses) on the limits page.
92* gRPC calls are refused, so tell Claude in the custom instructions to use the REST transport of client libraries such as Spanner, Bigtable, Firestore, and Pub/Sub.
93
94If Claude needs one of the refused services, clear the checkbox and rely on your IAM grants alone. The token exchange itself, including acting as the service account, happens inside Agent Proxy and isn't affected by this checkbox or by the allowed hosts.
95
96**5. Narrow the allowed Google hosts**
97
98Replace the prefilled `*.googleapis.com` entry in the **Allowed Google hosts** field with the hosts Claude needs, for example `storage.googleapis.com`. A wildcard as the leftmost label, such as `*.storage.googleapis.com`, matches any subdomain but not the name itself. Every host must be `googleapis.com`, a subdomain of it, or a subdomain of `clients6.google.com`. You can change the list later from the connection's [**Edit connection** dialog](/docs/claude-tag/admins/add-connections#set-allowed-websites), which you open from the connection's row on the **Connectors** tab; see [Manage federated connections on the Connectors tab](/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab).
99
100**6. Confirm the attribute condition**
101
102Select the checkbox labeled **The provider's attribute condition requires the subject prefix shown above**. The **Connect identity** button stays disabled until you do. Select the checkbox only if the provider's attribute condition pins `assertion.sub` to one or more full subjects under your **Subject prefix**, or at minimum pins `assertion.sub` to your **Subject prefix** (or, if you mapped it, `attribute.org` to your organization ID), as described under [Create the pool and provider in Google Cloud](#create-the-pool-and-provider-in-google-cloud).
103
104**7. Choose a bundle and connect**
105
106Choose a bundle from the **Access bundle** list, or create one: click **New bundle** if the dialog shows it, enter a **Bundle name**, and click **Create bundle**. Then click **Connect identity**. This creates a [connection](/docs/claude-tag/admins/add-connections) in that bundle, with the hosts you entered under **Allowed hosts**. The same provider can be connected more than once, for example once with a service account and once without, as long as no two Google Cloud connections in one bundle share a host under **Allowed hosts**. Each connection applies wherever its bundle applies.
107107
108108The **Cloud roles** table has **Role**, **Access bundle**, **Allowed hosts**, **Added**, and **Actions** columns. Each connection's name appears under **Role** with the provider and a **Google Cloud** chip beneath it, which also names the service account when the connection acts as one, and **Remove** is under **Actions**.
109109
claude-tag/admins/federated-access/limits Changed · +3 / -3 lines
from line 2
22
33> Counts, lengths, lifetimes, and unsupported configurations for Claude Tag's federated agent access: gateways, AWS roles, Google Cloud identities, and authorization servers.
44
5export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
6
7<BetaNote />
5> [!NOTE]
6>
7> Claude Tag is in public beta. Features and behavior described here may change before general availability.
88
99This page collects the fixed limits of Federated agent access in one place.
1010
claude-tag/admins/federated-access/overview Changed · +6 / -4 lines
from line 2
22
33> Claude Tag proves its identity to your systems with a short-lived signed token instead of a credential stored in Claude. Learn how the token works and which of the four connection types to use.
44
5export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
5> [!NOTE]
6>
7> Claude Tag is in public beta. Features and behavior described here may change before general availability.
68
7<BetaNote />
8
9<Note>Federated connections are managed on the [**Federated agent access**](https://claude.ai/admin-settings/claude-tag/federated-cloud-access) page, under **Claude Tag** in the admin settings sidebar. Connecting a gateway, cloud role, or authorization server needs an organization Owner, or an admin with full Claude Tag management permission.</Note>
9> [!NOTE]
10>
11> Federated connections are managed on the [**Federated agent access**](https://claude.ai/admin-settings/claude-tag/federated-cloud-access) page, under **Claude Tag** in the admin settings sidebar. Connecting a gateway, cloud role, or authorization server needs an organization Owner, or an admin with full Claude Tag management permission.
1012
1113In Slack channels, Claude Tag acts under its own [agent identity](/docs/claude-tag/concepts/agent-identity) rather than as any person. Federated agent access lets that identity prove itself to your systems with a short-lived, signed identity token instead of a credential you store in Claude.
1214
claude-tag/admins/federated-access/token-reference Changed · +6 / -4 lines
from line 2
22
33> The claims, issuer, signing keys, lifetime, and subject format of the identity token Claude Tag presents to a gateway, cloud provider, or authorization server.
44
5export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
5> [!NOTE]
6>
7> Claude Tag is in public beta. Features and behavior described here may change before general availability.
68
7<BetaNote />
8
99When Claude calls a system you connected through Federated agent access, it proves who it is with a signed identity token instead of a stored credential. The token is a JSON Web Token (JWT) that names your organization and the agent making the request. A gateway you run receives it in the `Authorization: Bearer` header and verifies it directly. AWS, Google Cloud, or your authorization server receives it in a token exchange and returns one of its own credentials.
1010
1111This page lists what the token contains so the engineer who configures the verifying side can pin the right values. For setup steps, see [Connect a gateway](/docs/claude-tag/admins/federated-access/connect-a-gateway), [Connect an AWS role](/docs/claude-tag/admins/federated-access/aws), [Connect a Google Cloud identity](/docs/claude-tag/admins/federated-access/gcp), or [Connect an authorization server](/docs/claude-tag/admins/federated-access/authorization-server).
from line 101
101101
102102Authorize on `sub`, as described under [Authorize on the subject](#authorize-on-the-subject). A gateway or authorization server, which can read every claim, can use `tenant` and `agent_id` instead, because they repeat the subject's two parts. An AWS trust policy matches on `sub` and `aud` only; a Google Cloud attribute condition can read `sub` or `tenant`. The token carries no claim that names the person behind the request, and no `groups`, `roles`, or `scope` claims. A rule that needs `slack_workspace_id` or `slack_channel_id` should refuse a token that lacks them.
103103
104<Note>Anthropic may add claims to the token. A verifier must ignore claims it doesn't recognize and must never depend on a claim not listed here being present.</Note>
104> [!NOTE]
105>
106> Anthropic may add claims to the token. A verifier must ignore claims it doesn't recognize and must never depend on a claim not listed here being present.
105107
106108### Example payload
107109
claude-tag/admins/federated-access/troubleshooting Changed · +7 / -5 lines
from line 2
22
33> Errors from Claude Tag's federated agent access and what fixes each: console dialog messages, requests Claude reports as blocked or failed, and rejections your gateway, AWS, Google Cloud, or authorization server records.
44
5export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
5> [!NOTE]
6>
7> Claude Tag is in public beta. Features and behavior described here may change before general availability.
68
7<BetaNote />
8
9<Note>Federated connections are managed on the [**Federated agent access**](https://claude.ai/admin-settings/claude-tag/federated-cloud-access) page, under **Claude Tag** in the admin settings sidebar. Changing them needs an organization Owner, or an admin with full Claude Tag management permission.</Note>
9> [!NOTE]
10>
11> Federated connections are managed on the [**Federated agent access**](https://claude.ai/admin-settings/claude-tag/federated-cloud-access) page, under **Claude Tag** in the admin settings sidebar. Changing them needs an organization Owner, or an admin with full Claude Tag management permission.
1012
1113This page covers what goes wrong after you connect a gateway, AWS role, Google Cloud identity, or authorization server through **Federated agent access**. It's organized by where the problem shows up: a message in a console dialog, an error Claude reports in the thread, or a rejection in your own logs. The token terms used below are explained on the [identity token reference](/docs/claude-tag/admins/federated-access/token-reference).
1214
claude-tag/admins/for-slack-admins Changed · +3 / -3 lines
from line 2
22
33> What the Claude app reads and posts in Slack, the OAuth scopes it requests, and what installing it does not grant. Written for the Slack admin approving the install.
44
5export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
6
7<BetaNote />
5> [!NOTE]
6>
7> Claude Tag is in public beta. Features and behavior described here may change before general availability.
88
99You're approving the Claude app install for someone who's setting up Claude Tag. This page covers what the app can do in your Slack workspace. The rest of setup happens on their side, in the Claude console; you don't need a Claude account.
1010
claude-tag/admins/healthcare Changed · +18 / -20 lines
from line 2
22
33> Claude Tag is not covered by Anthropic's Business Associate Agreement. Configure it so protected health information never reaches a channel, direct message, or tool Claude can read: limit Claude to approved channels, turn off direct messages, and connect only PHI-free tools. Also covers what to do if PHI is posted where Claude can read it.
44
5export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
5> [!NOTE]
6>
7> Claude Tag is in public beta. Features and behavior described here may change before general availability.
68
7<BetaNote />
8
99Claude Tag, the Claude app that works in your Slack channels, is not covered by Anthropic's Business Associate Agreement (BAA). A healthcare organization can use it for work that doesn't involve protected health information (PHI) by configuring it so that PHI never enters a channel, direct message, or connected tool that Claude can read.
1010
1111If your Claude organization has the [HIPAA configuration](https://support.claude.com/en/articles/17318731) applied to Claude Code (local mode) and Cowork (local mode), Claude Tag isn't available in that organization. [Plan and organization requirements](#plan-and-organization-requirements) describes the alternative.
from line 42
4242
4343An Owner turns Claude off everywhere by default, turns it on only in channels approved as PHI-free, turns off direct messages, and blocks channel names that signal PHI. Every setting in these steps is at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), and the workspace and channel settings are on the **Channels** tab under **Claude's access**.
4444
45<Steps>
46 <Step title="Turn Claude off by default">
47 Go to [**Claude's access > Channels > Slack**](https://claude.ai/admin-settings/claude-tag/channels/slack) and turn off the **Respond in all channels** switch at the top of the **General** tab. [Limit Claude Tag to specific channels](/docs/claude-tag/admins/restrict-access#limit-claude-tag-to-specific-channels) has the full procedure.
48 </Step>
45**1. Turn Claude off by default**
4946
50 <Step title="Reset workspaces and channels that have their own setting">
51 A workspace's or channel's own **Enable Claude Tag** setting takes precedence over the **Slack** page, so a workspace or channel switched on during an earlier pilot keeps Claude active there. On the **Channels** tab, open each workspace's and channel's page that has its own setting, and click the **Use inherited setting** link under its switch.
52 </Step>
47Go to [**Claude's access > Channels > Slack**](https://claude.ai/admin-settings/claude-tag/channels/slack) and turn off the **Respond in all channels** switch at the top of the **General** tab. [Limit Claude Tag to specific channels](/docs/claude-tag/admins/restrict-access#limit-claude-tag-to-specific-channels) has the full procedure.
5348
54 <Step title="Turn Claude on in each approved channel">
55 On the **Channels** tab, open the approved channel's page and turn on its **Enable Claude Tag in this channel** switch. If the channel isn't listed on the **Channels** tab, [set it up](/docs/claude-tag/admins/attach-to-scope#attach-to-a-channel) first.
56 </Step>
49**2. Reset workspaces and channels that have their own setting**
5750
58 <Step title="Turn off direct messages">
59 On the same [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag) page, select **Edit** on the **Direct messages** row and turn off the [**Allow direct messages** toggle](/docs/claude-tag/admins/restrict-access#allow-or-disable-direct-messages). Claude is then reachable only in channels.
60 </Step>
51A workspace's or channel's own **Enable Claude Tag** setting takes precedence over the **Slack** page, so a workspace or channel switched on during an earlier pilot keeps Claude active there. On the **Channels** tab, open each workspace's and channel's page that has its own setting, and click the **Use inherited setting** link under its switch.
6152
62 <Step title="Block channel names that signal PHI">
63 Go to [**Claude's access > Channels > Slack**](https://claude.ai/admin-settings/claude-tag/channels/slack), open the **Advanced** tab, and under **Channels** add the naming patterns your workspace uses for clinical or patient channels to **Blocked channel patterns**, for example `*-patient-*`. Claude won't read or respond in a matching channel even if someone invites it. See [Block or auto-join channels by name](/docs/claude-tag/admins/restrict-access#block-or-auto-join-channels-by-name).
64 </Step>
65</Steps>
53**3. Turn Claude on in each approved channel**
54
55On the **Channels** tab, open the approved channel's page and turn on its **Enable Claude Tag in this channel** switch. If the channel isn't listed on the **Channels** tab, [set it up](/docs/claude-tag/admins/attach-to-scope#attach-to-a-channel) first.
56
57**4. Turn off direct messages**
58
59On the same [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag) page, select **Edit** on the **Direct messages** row and turn off the [**Allow direct messages** toggle](/docs/claude-tag/admins/restrict-access#allow-or-disable-direct-messages). Claude is then reachable only in channels.
60
61**5. Block channel names that signal PHI**
62
63Go to [**Claude's access > Channels > Slack**](https://claude.ai/admin-settings/claude-tag/channels/slack), open the **Advanced** tab, and under **Channels** add the naming patterns your workspace uses for clinical or patient channels to **Blocked channel patterns**, for example `*-patient-*`. Claude won't read or respond in a matching channel even if someone invites it. See [Block or auto-join channels by name](/docs/claude-tag/admins/restrict-access#block-or-auto-join-channels-by-name).
6664
6765Any member of the workspace can still invite `@Claude` to a channel that isn't approved. Claude stays silent there, and an @-mention gets a notice that Claude is disabled in that channel instead of a reply.
6866
claude-tag/admins/managed-by Changed · +58 / -64 lines
from line 2
22
33> Managed by lets a central team write a Slack channel's standing Claude instructions from its own channel. Covers setup, the Confirm card, and limits.
44
5export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
5> [!NOTE]
6>
7> Claude Tag is in public beta. Features and behavior described here may change before general availability.
68
7<BetaNote />
8
99**Managed by** is a channel setting that names other Slack channels whose members can write that channel's standing instructions for Claude. The channel that carries the setting is the managed channel, and each channel it names is a managing channel. People in a managing channel ask Claude to set or update the managed channel's instructions and confirm the change on a card, and Claude follows that text in every new conversation in the managed channel. This page is for admins who set up the pairing and for the people in a managing channel who write the instructions.
1010
1111On the Enterprise plan, an Owner of your Claude organization or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access#delegate-claude-tag-administration) sets up **Managed by** on the **Admin** tab of a channel's Configure page. The Team plan doesn't have the **Admin** tab. [When to use Managed by](#when-to-use-managed-by) lists the other places to keep instructions for a channel.
from line 41
4141
4242## Choose the managing channels
4343
44<Steps>
45 <Step title="Open the managed channel's Configure page">
46 In the channel whose instructions will be managed, select the **Configure** link in the footer of any Claude reply, or send [`@Claude !configure`](/docs/claude-tag/users/commands#get-the-link-to-configure-a-channel) and follow the link Claude posts. Go to the **Admin** tab.
47 </Step>
44**1. Open the managed channel's Configure page**
4845
49 <Step title="Select channels under Managed by">
50 Open the **Managed by** list and select up to five channels. The list shows channels that you and Claude are both in. It finds them through the Slack account connected to your Claude account, and it asks you to connect one if you haven't. The selection saves when you close the list.
51 </Step>
46In the channel whose instructions will be managed, select the **Configure** link in the footer of any Claude reply, or send [`@Claude !configure`](/docs/claude-tag/users/commands#get-the-link-to-configure-a-channel) and follow the link Claude posts. Go to the **Admin** tab.
5247
53 <Step title="Tell the managing channel">
54 Nothing is posted in the managing channel when you add it. Claude learns about the pairing at the start of a conversation, so ask people there to start a new thread before they make the first change, and point them to [Write or update managed instructions](#write-or-update-managed-instructions).
55 </Step>
56</Steps>
48**2. Select channels under Managed by**
5749
50Open the **Managed by** list and select up to five channels. The list shows channels that you and Claude are both in. It finds them through the Slack account connected to your Claude account, and it asks you to connect one if you haven't. The selection saves when you close the list.
51
52**3. Tell the managing channel**
53
54Nothing is posted in the managing channel when you add it. Claude learns about the pairing at the start of a conversation, so ask people there to start a new thread before they make the first change, and point them to [Write or update managed instructions](#write-or-update-managed-instructions).
55
5856To stop a channel managing another, clear it from the same list. Removing a channel works even when the pairing no longer meets the requirements.
5957
6058## Write or update managed instructions
from line 59
6159
6260A managing channel is a Slack channel that an Owner or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access#delegate-claude-tag-administration) selected under **Managed by** on another channel's Configure page. Any full member of the workspace who is in a managing channel can ask Claude there to change the managed channel's instructions. Guests and people from other organizations can't.
6361
64<Steps>
65 <Step title="Ask Claude in the managing channel">
66 Mention Claude, name the managed channel, and say what the instructions should be.
62**1. Ask Claude in the managing channel**
6763
68 ```text wrap theme={null}
69 @Claude set the instructions for #it-help to: Answer from the IT handbook first. For laptop requests, link the hardware form. If someone reports a security problem, tell them to page the on-call and stop.
70 ```
64Mention Claude, name the managed channel, and say what the instructions should be.
7165
72 Claude reads the managed channel's current text, then posts a card in the managing channel that shows every line the change adds or removes.
73 </Step>
66```text wrap theme={null}
67@Claude set the instructions for #it-help to: Answer from the IT handbook first. For laptop requests, link the hardware form. If someone reports a security problem, tell them to page the on-call and stop.
68```
7469
75 <Step title="Confirm the card">
76 Any full member of the managing channel can select **Confirm**. Nothing changes until someone selects it. **Cancel** drops the proposal.
77 </Step>
70Claude reads the managed channel's current text, then posts a card in the managing channel that shows every line the change adds or removes.
7871
79 <Step title="Check the result">
80 Start a new thread in the managed channel and ask Claude to repeat its admin instructions. The text you confirmed appears after your workspace's instructions and before the channel's own. You need to be a member of the managed channel to check.
81 </Step>
82</Steps>
72**2. Confirm the card**
8373
74Any full member of the managing channel can select **Confirm**. Nothing changes until someone selects it. **Cancel** drops the proposal.
75
76**3. Check the result**
77
78Start a new thread in the managed channel and ask Claude to repeat its admin instructions. The text you confirmed appears after your workspace's instructions and before the channel's own. You need to be a member of the managed channel to check.
79
8480To add long material as a [reference file](#how-managed-instructions-load), give the file a short name made of lowercase letters, digits, hyphens, or underscores.
8581
8682```text wrap theme={null}
from line 97
10197
10298Claude proposes the correction as a change to the managed channel's instructions. After you confirm, Claude follows the new text in [conversations that start afterward](#how-managed-instructions-load) in the managed channel. While a guest is present in a managed channel that runs with [channel-only access](/docs/claude-tag/admins/restrict-access#how-channel-only-works), Claude doesn't load managed instructions.
10399
104<Steps>
105 <Step title="Set up a private managing channel">
106 Skip this step if the managed channel already has a private managing channel that you're in. Otherwise, create a private channel in Slack and run `/invite @Claude` in it. Then an Owner or a Claude Tag admin who is a member of the private channel selects it, following [Choose the managing channels](#choose-the-managing-channels). If you're that person, you and Claude can be the private channel's only members.
100**1. Set up a private managing channel**
107101
108 To open the Configure page without posting in the managed channel, select the **Configure** link in the footer of a Claude reply there.
109 </Step>
102Skip this step if the managed channel already has a private managing channel that you're in. Otherwise, create a private channel in Slack and run `/invite @Claude` in it. Then an Owner or a Claude Tag admin who is a member of the private channel selects it, following [Choose the managing channels](#choose-the-managing-channels). If you're that person, you and Claude can be the private channel's only members.
110103
111 <Step title="Ask Claude in the private managing channel">
112 Start a new thread, mention Claude, tell it which thread it got wrong, and say what it should do next time.
104To open the Configure page without posting in the managed channel, select the **Configure** link in the footer of a Claude reply there.
113105
114 * **Public managed channel:** paste the thread's link. Claude can read the linked thread as long as the managing channel has no guests. If it has guests, describe what happened.
115 * **Private managed channel:** describe what happened, because Claude reads a private channel's threads only from inside that channel
106**2. Ask Claude in the private managing channel**
116107
117 ```text wrap theme={null}
118 @Claude in this #it-help thread you told someone to email IT about a new laptop: https://example.slack.com/archives/C0123456789/p1700000000000000
119 Add a rule to the instructions for #it-help that laptop requests get a link to the hardware form.
120 ```
108Start a new thread, mention Claude, tell it which thread it got wrong, and say what it should do next time.
121109
122 Claude reads any thread you linked and the managed channel's current text, then posts a card in the managing channel that shows every line the change adds or removes.
123 </Step>
110* **Public managed channel:** paste the thread's link. Claude can read the linked thread as long as the managing channel has no guests. If it has guests, describe what happened.
111* **Private managed channel:** describe what happened, because Claude reads a private channel's threads only from inside that channel
124112
125 <Step title="Confirm the card">
126 Select **Confirm** if the wording is right. To reword it, select **Cancel** and tell Claude what to change. The card expires 30 minutes after Claude posts it. After you confirm, the card says that the managed channel's instructions were updated.
127 </Step>
113```text wrap theme={null}
114@Claude in this #it-help thread you told someone to email IT about a new laptop: https://example.slack.com/archives/C0123456789/p1700000000000000
115Add a rule to the instructions for #it-help that laptop requests get a link to the hardware form.
116```
128117
129 <Step title="Read the text back">
130 In a new message in the managing channel, ask Claude to show the managed channel's instructions. Claude replies there with the current text.
131 </Step>
132</Steps>
118Claude reads any thread you linked and the managed channel's current text, then posts a card in the managing channel that shows every line the change adds or removes.
119
120**3. Confirm the card**
121
122Select **Confirm** if the wording is right. To reword it, select **Cancel** and tell Claude what to change. The card expires 30 minutes after Claude posts it. After you confirm, the card says that the managed channel's instructions were updated.
123
124**4. Read the text back**
125
126In a new message in the managing channel, ask Claude to show the managed channel's instructions. Claude replies there with the current text.
133127
134128People who are in the managed channel and not in the managing channel see only part of a correction.
135129
claude-tag/admins/migrate-from-earlier Changed · +25 / -23 lines
from line 2
22
33> Claude Tag replaces the earlier per-user Claude in Slack app in place. See what changes, what stays, how the version is chosen per channel, and what existing users notice.
44
5export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
5> [!NOTE]
6>
7> Claude Tag is in public beta. Features and behavior described here may change before general availability.
68
7<BetaNote />
8
99If your organization already used the earlier Claude in Slack, including [Claude Code in Slack](https://code.claude.com/docs/en/slack), Claude Tag replaces it. Your existing Slack app and `@Claude` handle stay, and no data migrates. What changes is who Claude acts as and who sets it up.
1010
11<Note>If your Team plan organization has the single [**Respond in channels** switch](/docs/claude-tag/admins/workspaces#turn-claude-tag-on-or-off-on-the-team-plan), it has no **Claude Tag version** controls and there is nothing to migrate.</Note>
11> [!NOTE]
12>
13> If your Team plan organization has the single [**Respond in channels** switch](/docs/claude-tag/admins/workspaces#turn-claude-tag-on-or-off-on-the-team-plan), it has no **Claude Tag version** controls and there is nothing to migrate.
1214
1315## Switch your workspace to Claude Tag
1416
15<Steps>
16 <Step title="Connect the workspace in the Claude console">
17 Open [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag). If your workspace isn't paired, run [setup](/docs/claude-tag/admins/setup-overview); otherwise you're already on Claude Tag. Once paired, channels and linked-user DMs answer with the New version by default; no per-channel action is needed.
18 </Step>
17**1. Connect the workspace in the Claude console**
1918
20 <Step title="Check for channels still on Legacy">
21 Pairing defaults every workspace and channel to **New**, so this is usually quick.
19Open [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag). If your workspace isn't paired, run [setup](/docs/claude-tag/admins/setup-overview); otherwise you're already on Claude Tag. Once paired, channels and linked-user DMs answer with the New version by default; no per-channel action is needed.
2220
23 1. Go to [**Claude's access > Channels**](https://claude.ai/admin-settings/claude-tag?access=channels). A workspace or channel set to Legacy shows **legacy Claude in Slack** in the **Changes from defaults** column.
24 2. Open each one, and on its **Advanced** tab set **Claude Tag version** to **New**.
25 3. The **Slack** row never shows that marker, so also go to [**Claude's access > Channels > Slack**](https://claude.ai/admin-settings/claude-tag/channels/slack) and set **Claude Tag version** on its **Advanced** tab to **New** if it shows **Legacy**.
26 </Step>
21**2. Check for channels still on Legacy**
2722
28 <Step title="Give Claude its connections">
29 The New version starts with no access of its own. GitHub repositories and other connections do not carry over from individual users' linked accounts, so code requests in a switched channel have nothing to clone until you configure them. Follow the [setup overview](/docs/claude-tag/admins/setup-overview) to add connections, and [GitHub access](/docs/claude-tag/admins/configure-github) for code work specifically.
23Pairing defaults every workspace and channel to **New**, so this is usually quick.
3024
31 If your teams keep custom skills in a repository's `.claude/skills/` folder, those skills apply only in threads that have the repository. Add the repository to a [bundle](/docs/claude-tag/concepts/glossary#access-bundle) that applies to the channel, and have users name it in the first message. To give skills to every channel in a workspace or in all of Slack, add them through a [skills repository](/docs/claude-tag/admins/skills-repo).
32 </Step>
251. Go to [**Claude's access > Channels**](https://claude.ai/admin-settings/claude-tag?access=channels). A workspace or channel set to Legacy shows **legacy Claude in Slack** in the **Changes from defaults** column.
262. Open each one, and on its **Advanced** tab set **Claude Tag version** to **New**.
273. The **Slack** row never shows that marker, so also go to [**Claude's access > Channels > Slack**](https://claude.ai/admin-settings/claude-tag/channels/slack) and set **Claude Tag version** on its **Advanced** tab to **New** if it shows **Legacy**.
3328
34 <Step title="Tell your users">
35 Send them [Get started](/docs/claude-tag/users/getting-started). The visible change is that work now belongs to the channel; see [What existing users notice after the switch](#what-existing-users-notice-after-the-switch) below.
36 </Step>
37</Steps>
29**3. Give Claude its connections**
3830
31The New version starts with no access of its own. GitHub repositories and other connections do not carry over from individual users' linked accounts, so code requests in a switched channel have nothing to clone until you configure them. Follow the [setup overview](/docs/claude-tag/admins/setup-overview) to add connections, and [GitHub access](/docs/claude-tag/admins/configure-github) for code work specifically.
32
33If your teams keep custom skills in a repository's `.claude/skills/` folder, those skills apply only in threads that have the repository. Add the repository to a [bundle](/docs/claude-tag/concepts/glossary#access-bundle) that applies to the channel, and have users name it in the first message. To give skills to every channel in a workspace or in all of Slack, add them through a [skills repository](/docs/claude-tag/admins/skills-repo).
34
35**4. Tell your users**
36
37Send them [Get started](/docs/claude-tag/users/getting-started). The visible change is that work now belongs to the channel; see [What existing users notice after the switch](#what-existing-users-notice-after-the-switch) below.
38
3939**You'll see:** the workspace under **Connected workspaces** on the **Slack** page, **New** as the **Slack** page's **Claude Tag version**, and no row on the **Channels** tab showing **legacy Claude in Slack**.
4040
4141### If `@Claude` doesn't respond at all
from line 42
4242
4343On Enterprise Grid, an earlier install can lose its connection and stop responding in every workspace. See [Claude is silent everywhere on Enterprise Grid](/docs/claude-tag/admins/troubleshooting#claude-is-silent-everywhere-on-enterprise-grid) for the reinstall that refreshes it without uninstalling, then send `@Claude connect` again in a channel of that workspace and [pair the workspace](/docs/claude-tag/admins/setup-overview#pair-your-slack-workspace) with the new code.
4444
45<Warning>Since October 5, 2026, the earlier Claude in Slack app, shown as **Legacy** in admin settings, no longer answers in channels of a workspace paired with your Claude organization. A channel there that's still set to Legacy gets a notice that the legacy bot is retired, until you set **Claude Tag version** to **New** on the channel, or on its workspace if the channel inherits the setting. You also can't switch a workspace or channel to Legacy anymore. Direct messages aren't affected. In a workspace that isn't paired, Pro and Max users still get answers from the earlier app in channels, and anyone else with a connected Claude account gets the [workspace setup notice](/docs/claude-tag/admins/troubleshooting#this-workspace-isn%E2%80%99t-set-up-for-claude-tag-yet) instead.</Warning>
45> [!WARNING]
46>
47> Since October 5, 2026, the earlier Claude in Slack app, shown as **Legacy** in admin settings, no longer answers in channels of a workspace paired with your Claude organization. A channel there that's still set to Legacy gets a notice that the legacy bot is retired, until you set **Claude Tag version** to **New** on the channel, or on its workspace if the channel inherits the setting. You also can't switch a workspace or channel to Legacy anymore. Direct messages aren't affected. In a workspace that isn't paired, Pro and Max users still get answers from the earlier app in channels, and anyone else with a connected Claude account gets the [workspace setup notice](/docs/claude-tag/admins/troubleshooting#this-workspace-isn%E2%80%99t-set-up-for-claude-tag-yet) instead.
4648
4749## What stays the same
4850
claude-tag/admins/network-requirements Changed · +9 / -5 lines
from line 2
22
33> Claude Tag reaches your services from a published egress range, over HTTP and HTTPS only. See the IP block to allowlist and how the allowlist relates to the allowed-websites setting on a connection.
44
5export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
5> [!NOTE]
6>
7> Claude Tag is in public beta. Features and behavior described here may change before general availability.
68
7<BetaNote />
8
99If a service you want to connect (a data warehouse, an internal API, a GitHub organization with an IP allow list) restricts access by source IP, add Anthropic's egress range to its allowlist. Hand this page to the team that manages it.
1010
1111## Add Anthropic's egress range to your allowlist
from line 20
2020
2121The range is shared across Anthropic services, and dedicated per-organization egress addresses aren't available, so the allowlist entry admits Anthropic's infrastructure as a whole. Your credential's [allowed websites](/docs/claude-tag/admins/add-connections#set-allowed-websites) are what scope which of *your* systems Claude can call.
2222
23<Note>If your Google Cloud project uses VPC Service Controls, an IP-based access level doesn't admit Claude's queries through the [BigQuery connection](/docs/claude-tag/admins/connections/bigquery). See [Allow the connection through a VPC Service Controls perimeter](/docs/claude-tag/admins/connections/bigquery#allow-the-connection-through-a-vpc-service-controls-perimeter) on the BigQuery page.</Note>
23> [!NOTE]
24>
25> If your Google Cloud project uses VPC Service Controls, an IP-based access level doesn't admit Claude's queries through the [BigQuery connection](/docs/claude-tag/admins/connections/bigquery). See [Allow the connection through a VPC Service Controls perimeter](/docs/claude-tag/admins/connections/bigquery#allow-the-connection-through-a-vpc-service-controls-perimeter) on the BigQuery page.
2426
2527## Internet reachability
2628
27<Warning>A connected service must accept traffic from the internet (restricted by IP allowlist if you like). A service reachable only inside your private network can't be connected; private networking such as PrivateLink or VPC peering is not supported.</Warning>
29> [!WARNING]
30>
31> A connected service must accept traffic from the internet (restricted by IP allowlist if you like). A service reachable only inside your private network can't be connected; private networking such as PrivateLink or VPC peering is not supported.
2832
2933In an Anthropic-hosted environment, every request from a channel's sandbox to your service passes through [Agent Proxy](/docs/claude-tag/concepts/agent-identity#agent-proxy), which carries HTTP and HTTPS only. A service reachable only over another protocol, such as SSH or a database's native wire protocol, can't be connected; put an HTTP API in front of it instead.
3034
claude-tag/admins/restrict-access Changed · +66 / -68 lines
from line 2
22
33> Claude Tag responds only where it has been added and addressed. See who can invoke it, what changes in guest and Slack Connect channels, the per-scope version setting, how to limit it to chosen channels, how to delegate administration or a channel's setup, and how to quiet or remove it.
44
5export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
5> [!NOTE]
6>
7> Claude Tag is in public beta. Features and behavior described here may change before general availability.
68
7<BetaNote />
8
99In channels, Claude Tag responds only where it's been added and addressed, and the controls on this page narrow that further. One-to-one DMs are a separate surface. A DM from a member who has connected a Claude account runs on that member's own account; see [how DMs differ from channels](/docs/claude-tag/concepts/agent-identity#direct-message-channels). A [DM from a member who hasn't](#direct-messages-from-members-without-a-claude-account) can bill to your organization. In a [group DM](#group-dms), the work bills to your organization.
1010
11<Note>Most controls on this page require the Owner role in your Claude organization; the [permissions table](#permissions-by-role) lists which actions a channel manager or a channel member can take. On the Enterprise plan, an Owner can delegate many of these controls through the [**Claude Tag Admin** permission](#delegate-claude-tag-administration).</Note>
11> [!NOTE]
12>
13> Most controls on this page require the Owner role in your Claude organization; the [permissions table](#permissions-by-role) lists which actions a channel manager or a channel member can take. On the Enterprise plan, an Owner can delegate many of these controls through the [**Claude Tag Admin** permission](#delegate-claude-tag-administration).
1214
1315## Control who can invoke Claude Tag
1416
1517In channels where the app has been added, an @-mention guarantees a response; Claude may also respond to a message that doesn't mention it when it judges a reply is warranted, and once a thread is active it follows replies in that thread. By default, anyone in such a channel can address it. A single toggle narrows that to people in your Claude organization.
1618
17<a id="members" />
18
1919### Restrict who can use Claude
2020
2121Go to [**Claude's access > Channels > Slack**](https://claude.ai/admin-settings/claude-tag/channels/slack) and open the **Advanced** tab. Under **Access**, a toggle controls who in your Slack workspace can use Claude at all; its label depends on your plan. You must be an Owner of your Claude organization to change it.
from line 27
2727
2828The toggle applies to channels and DMs alike. While the toggle is off, a [DM from a member who hasn't connected a Claude account](#direct-messages-from-members-without-a-claude-account) can bill to your organization.
2929
30<Info>
31 You may see the earlier three-option **Members** dropdown instead of the toggle. The **Access** group keeps the dropdown while your organization's stored choice matches neither toggle state. That happens for an Enterprise organization that previously chose **Open to any organization member** (now marked deprecated), and for a Team organization still restricted by role from an earlier Enterprise plan. Switch to one of the toggle's two states. The dropdown is then replaced by the toggle, and the deprecated option is no longer offered.
32</Info>
30> [!NOTE]
31>
32> You may see the earlier three-option **Members** dropdown instead of the toggle. The **Access** group keeps the dropdown while your organization's stored choice matches neither toggle state. That happens for an Enterprise organization that previously chose **Open to any organization member** (now marked deprecated), and for a Team organization still restricted by role from an earlier Enterprise plan. Switch to one of the toggle's two states. The dropdown is then replaced by the toggle, and the deprecated option is no longer offered.
3333
3434#### Restrict by role on Enterprise
3535
from line 61
6161
6262When the toggle is on, a Slack user whose profile email isn't on one of the enterprise's verified domains can't link a Claude account to this organization; the sign-in is refused.
6363
64<Warning>Turning this on in any one organization also stops Slack users on a verified domain from linking a Claude account to any organization outside the enterprise.</Warning>
64> [!WARNING]
65>
66> Turning this on in any one organization also stops Slack users on a verified domain from linking a Claude account to any organization outside the enterprise.
6567
6668## Control where Claude Tag operates
6769
from line 103
101103
102104These steps need the per-scope switches. If the **Slack** page shows [**Respond in channels**](/docs/claude-tag/admins/workspaces#turn-claude-tag-on-or-off-on-the-team-plan) instead, you can't limit Claude this way. Use [blocked channel patterns](#block-or-auto-join-channels-by-name) to keep it out of specific channels.
103105
104<Note>Turning Claude off in a scope silences the earlier Claude in Slack there too.</Note>
106> [!NOTE]
107>
108> Turning Claude off in a scope silences the earlier Claude in Slack there too.
105109
106<Steps>
107 <Step title="Turn Claude Tag off in every channel">
108 Go to [**Claude's access > Channels > Slack**](https://claude.ai/admin-settings/claude-tag/channels/slack) and turn off the **Respond in all channels** switch at the top of the **General** tab.
109 </Step>
110**1. Turn Claude Tag off in every channel**
110111
111 <Step title="Reset the scopes that override it">
112 Open each workspace's or channel's page that has its own setting. Its switch shows **Set for this workspace** or **Set for this channel** underneath. Click the **Use inherited setting** link beside that line. The scope then follows the off state on the **Slack** page.
113 </Step>
112Go to [**Claude's access > Channels > Slack**](https://claude.ai/admin-settings/claude-tag/channels/slack) and turn off the **Respond in all channels** switch at the top of the **General** tab.
114113
115 <Step title="Switch each chosen channel back on">
116 On the **Channels** tab, find the channel with the search field; channels Claude was added to are already listed. If it isn't listed, set it up as described in [Attach to a channel](/docs/claude-tag/admins/attach-to-scope#attach-to-a-channel). Open the channel's page and turn on the **Enable Claude Tag in this channel** switch at the top of its **General** tab.
114**2. Reset the scopes that override it**
117115
118 A channel's own setting wins over the off setting above it, so Claude responds in the chosen channels and nowhere else.
119 </Step>
120</Steps>
116Open each workspace's or channel's page that has its own setting. Its switch shows **Set for this workspace** or **Set for this channel** underneath. Click the **Use inherited setting** link beside that line. The scope then follows the off state on the **Slack** page.
121117
118**3. Switch each chosen channel back on**
119
120On the **Channels** tab, find the channel with the search field; channels Claude was added to are already listed. If it isn't listed, set it up as described in [Attach to a channel](/docs/claude-tag/admins/attach-to-scope#attach-to-a-channel). Open the channel's page and turn on the **Enable Claude Tag in this channel** switch at the top of its **General** tab.
121
122A channel's own setting wins over the off setting above it, so Claude responds in the chosen channels and nowhere else.
123
122124If someone invites the app into another channel afterward, Claude stays silent there. Mentioning `@Claude` in that channel gets a notice that Claude is disabled in the channel, not a reply. In a Slack Connect channel, Claude posts no notice.
123125
124126One-to-one DMs, guest channels, and shared channels sit outside the per-scope switches:
from line 216
214216
215217Neither value adds private channels to workspace search. In a [channel that includes a guest](#restrict-guest-channels), workspace search is unavailable whichever value applies.
216218
217<a id="externally-shared-channels" />
218
219219### Slack Connect channels
220220
221221A Slack Connect channel is a channel your Slack workspace shares with another company. The [**How should Claude work in channels with guests**](#restrict-guest-channels) setting, the same one that governs channels that include guests, decides whether Claude answers in one:
from line 240
240240
241241When a bundle applies there, Claude can use the bundle's connectors for anyone it answers in the channel, including the other company's people.
242242
243<Warning>Treat the channel's instructions, and the connectors in its bundles, as available to the other company. Before you turn Claude on in a Slack Connect channel, or share a channel where it's already on, open the channel's page under [**Claude's access > Channels**](https://claude.ai/admin-settings/claude-tag?access=channels), check its bundles, and [remove the channel from any bundle](/docs/claude-tag/admins/attach-to-scope#choose-where-a-bundle-applies) you don't want used there.</Warning>
243> [!WARNING]
244>
245> Treat the channel's instructions, and the connectors in its bundles, as available to the other company. Before you turn Claude on in a Slack Connect channel, or share a channel where it's already on, open the channel's page under [**Claude's access > Channels**](https://claude.ai/admin-settings/claude-tag?access=channels), check its bundles, and [remove the channel from any bundle](/docs/claude-tag/admins/attach-to-scope#choose-where-a-bundle-applies) you don't want used there.
244246
245247When it answers there, Claude also has:
246248
from line 409
407409
408410### Give a member the Claude Tag Admin permission
409411
410<Steps>
411 <Step title="Create a role">
412 Go to [**Organization settings > Roles**](https://claude.ai/admin-settings/roles), select **Add role**, and give the role a name.
413 </Step>
412**1. Create a role**
414413
415 <Step title="Grant the permission">
416 On the role's **Admin permissions** tab, set **Claude Tag Admin**, under **Product admin**, to **Can manage**. Changing the member's role type to **Custom** takes them off the built-in Admin role, so if the member is an Admin today, also set **User Management** to **Can manage** and **Analytics** to **Can view**, both under **Organization admin**. Leave the **Capabilities** and **Connectors** tabs as they are, then select **Save**.
417 </Step>
414Go to [**Organization settings > Roles**](https://claude.ai/admin-settings/roles), select **Add role**, and give the role a name.
418415
419 <Step title="Assign the role through a group">
420 A custom role applies to the members of the groups it's assigned to. Go to [**Organization settings > Groups**](https://claude.ai/admin-settings/groups) and select **Add group**. Name the group and pick the new role under **Roles**. Add the member under **Members**, then select **Add group**. To use a group the member is already in, open the role on the [**Roles** page](https://claude.ai/admin-settings/roles) instead and add that group on its **Details** tab.
421 </Step>
416**2. Grant the permission**
422417
423 <Step title="Change the member's role to Custom">
424 On the [**Members** page](https://claude.ai/admin-settings/members), change the member's role to **Custom**. Custom roles apply only to members whose role type is **Custom**. If member roles are managed through your identity provider, make the change in the identity provider instead.
425 </Step>
418On the role's **Admin permissions** tab, set **Claude Tag Admin**, under **Product admin**, to **Can manage**. Changing the member's role type to **Custom** takes them off the built-in Admin role, so if the member is an Admin today, also set **User Management** to **Can manage** and **Analytics** to **Can view**, both under **Organization admin**. Leave the **Capabilities** and **Connectors** tabs as they are, then select **Save**.
426419
427 <Step title="Confirm the member's access">
428 The member can now open **Claude Tag** under **Products** in **Organization settings**. If it isn't listed for them yet, have them refresh the page.
429 </Step>
430</Steps>
420**3. Assign the role through a group**
431421
422A custom role applies to the members of the groups it's assigned to. Go to [**Organization settings > Groups**](https://claude.ai/admin-settings/groups) and select **Add group**. Name the group and pick the new role under **Roles**. Add the member under **Members**, then select **Add group**. To use a group the member is already in, open the role on the [**Roles** page](https://claude.ai/admin-settings/roles) instead and add that group on its **Details** tab.
423
424**4. Change the member's role to Custom**
425
426On the [**Members** page](https://claude.ai/admin-settings/members), change the member's role to **Custom**. Custom roles apply only to members whose role type is **Custom**. If member roles are managed through your identity provider, make the change in the identity provider instead.
427
428**5. Confirm the member's access**
429
430The member can now open **Claude Tag** under **Products** in **Organization settings**. If it isn't listed for them yet, have them refresh the page.
431
432432## Delegate channel setup to channel managers
433433
434434A channel manager is a member of your Claude organization who can set up Claude in specific channels without the Owner role. Channel managers are available on the Enterprise plan. An Owner can add or remove them, and so can a [Claude Tag admin](#delegate-claude-tag-administration) whose role also sets **Identity & Access** to **Can manage**.
from line 459
459459
460460Channel managers are built on [custom roles](https://claude.ai/admin-settings/roles). When you add the first manager to a channel, you create a custom role for it, named **Channel managers** plus the channel's name and ID, with the **Claude Tag channel setup** permission. A custom role works only for members on the **Custom roles** access level, so the last step below checks each manager's level.
461461
462<Steps>
463 <Step title="Open the channel's page">
464 Go to [**Claude's access > Channels**](https://claude.ai/admin-settings/claude-tag?access=channels) and open the channel's page. The channel must be a public or private channel. If it isn't listed, [add Claude to the channel](/docs/claude-tag/users/getting-started#add-claude-to-a-channel) in Slack first.
465 </Step>
462**1. Open the channel's page**
466463
467 <Step title="Add people or a group">
468 In the page's header, select **Add managers**. Search for people and groups, and select each one to add. People you add join the channel's default group. A group you pick comes from [`claude.ai/admin-settings/groups`](https://claude.ai/admin-settings/groups), and the same group can manage several channels.
469 </Step>
464Go to [**Claude's access > Channels**](https://claude.ai/admin-settings/claude-tag?access=channels) and open the channel's page. The channel must be a public or private channel. If it isn't listed, [add Claude to the channel](/docs/claude-tag/users/getting-started#add-claude-to-a-channel) in Slack first.
470465
471 <Step title="Check each manager's access level">
472 When you add a member on the User or Claude Code user level, you move them to the **Custom roles** level in the same step; if they already hold other custom roles, you confirm the move first. For a member on any other level, you see **Not in effect** until you change their level on the Members page. Adding a group changes nobody's level.
466**2. Add people or a group**
473467
474 If you're a Claude Tag admin, the move also needs **User Management** set to **Can manage** on your role. Without it, the member is still added but shows **Not in effect** until their access level is changed on the Members page.
468In the page's header, select **Add managers**. Search for people and groups, and select each one to add. People you add join the channel's default group. A group you pick comes from [`claude.ai/admin-settings/groups`](https://claude.ai/admin-settings/groups), and the same group can manage several channels.
475469
476 If your identity provider manages access levels, you can't change a level on the Members page, and the move doesn't happen. Put the channel managers in an identity provider group and map that group to the **Custom roles** level instead. If you turn on identity provider management after adding channel managers, the next sync sets every member's level from your group mappings, so managers you moved by hand show **Not in effect** until a mapped group covers them. The role and its group are kept; you don't need to add the managers again.
477 </Step>
478</Steps>
470**3. Check each manager's access level**
471
472When you add a member on the User or Claude Code user level, you move them to the **Custom roles** level in the same step; if they already hold other custom roles, you confirm the move first. For a member on any other level, you see **Not in effect** until you change their level on the Members page. Adding a group changes nobody's level.
473
474If you're a Claude Tag admin, the move also needs **User Management** set to **Can manage** on your role. Without it, the member is still added but shows **Not in effect** until their access level is changed on the Members page.
475
476If your identity provider manages access levels, you can't change a level on the Members page, and the move doesn't happen. Put the channel managers in an identity provider group and map that group to the **Custom roles** level instead. If you turn on identity provider management after adding channel managers, the next sync sets every member's level from your group mappings, so managers you moved by hand show **Not in effect** until a mapped group covers them. The role and its group are kept; you don't need to add the managers again.
479477
480478Owners can already configure every channel, so you see them as **Already has full access** and can't add them.
481479
claude-tag/admins/set-spend-limit Changed · +9 / -11 lines
from line 2
22
33> Claude Tag channel work bills to your organization's usage balance. Set the spend limit and see what happens when it's reached.
44
5export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
5> [!NOTE]
6>
7> Claude Tag is in public beta. Features and behavior described here may change before general availability.
68
7<BetaNote />
8
99Work Claude does in channels and group DMs bills to your **organization's usage balance**, not to individual seats. The **spend limit** is a cap you set on how much of that balance Claude Tag can use each month.
1010
1111## How Claude Tag usage is billed
from line 31
3131
3232Not every organization sees this page. A trial organization that hasn't enabled usage billing, a single-seat Team plan, an organization with a hybrid desktop deployment, or an admin whose role can't view billing is redirected to personal usage settings instead. If your organization bills through a reseller, the page is not available and these steps don't apply; your organization's usage is funded through the reseller instead.
3333
34<Steps>
35 <Step title="Open the usage page">
36 Go to [`claude.ai/admin-settings/usage/claude-tag`](https://claude.ai/admin-settings/usage/claude-tag).
37 </Step>
34**1. Open the usage page**
3835
39 <Step title="Enter an amount">
40 Enter an amount in your organization's billing currency. The spend limit resets at the start of each month and applies across every paired workspace. You can change it any time.
41 </Step>
42</Steps>
36Go to [`claude.ai/admin-settings/usage/claude-tag`](https://claude.ai/admin-settings/usage/claude-tag).
37
38**2. Enter an amount**
39
40Enter an amount in your organization's billing currency. The spend limit resets at the start of each month and applies across every paired workspace. You can change it any time.
4341
4442There's no published per-task cost guidance. For a pilot, set a spend limit you're comfortable with for the first month, then watch the per-channel usage breakdown on the same page and adjust. If a promotional credit covers the pilot's usage, that breakdown shows \$0.00. In that case, watch the **List price** column of the **Spend by channel** table at [`claude.ai/analytics/claude-tag`](https://claude.ai/analytics/claude-tag) instead.
4543
claude-tag/admins/setup-oncall Changed · +3 / -3 lines
from line 2
22
33> Put Claude on call for incident response in Slack: run setup at claude.ai/oncall, pick or auto-join incident channels, cap spend, and deploy.
44
5export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
6
7<BetaNote />
5> [!NOTE]
6>
7> Claude Tag is in public beta. Features and behavior described here may change before general availability.
88
99Claude Tag on-call puts Claude on call with your team for incident response in Slack. Claude watches your monitoring tools and posts what it finds, or joins your incident channels and investigates alongside your team. Your team keeps its own on-call rotation, and Claude works alongside whoever is on call. You set up on-call for your whole organization at [`claude.ai/oncall`](https://claude.ai/oncall).
1010
claude-tag/admins/setup-overview Changed · +111 / -115 lines
from line 2
22
33> Set up Claude Tag for your organization: pair your Slack workspace, add Claude to channels, launch, give Claude access to your tools, and check that it works.
44
5export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
5> [!NOTE]
6>
7> Claude Tag is in public beta. Features and behavior described here may change before general availability.
68
7<BetaNote />
8
99Claude Tag is Claude working in your team's Slack channels. Setup connects Claude to your Slack workspace and turns Claude Tag on. Claude gets access to your other tools, like your issue tracker or data warehouse, after setup. Running setup requires the Owner role in a Claude organization on a Team or Enterprise plan.
1010
1111Go to [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag) and click **Start setup** (**Resume setup** if you started earlier). The setup page walks you through these steps in order.
from line 19
1919
2020When you've launched, [give Claude access to your tools](#give-claude-access-to-your-tools) and [verify your setup](#verify-your-setup).
2121
22<Accordion title="Before you start: check that you have what setup needs">
23 | Prerequisite | Why you need it | If you don't have it |
24 | :- | :- | :- |
25 | A **Team or Enterprise plan** on claude.ai | Claude Tag is available on Team and Enterprise plans, on Anthropic's first-party service. It isn't available on individual plans (Free, Pro, or Max), or for third-party deployments. | Start a Team or Enterprise plan at [claude.com/pricing](https://claude.com/pricing) |
26 | A Claude organization **without Zero Data Retention (ZDR), customer-managed encryption (CMEK), or the HIPAA configuration for Claude Code (local mode) and Cowork (local mode)** | Claude Tag stores channel memory and session transcripts, which ZDR doesn't permit. A CMEK policy and the HIPAA configuration don't allow Claude Tag either. | Claude Tag isn't available to organizations with any of these. See [Healthcare organizations](/docs/claude-tag/admins/healthcare#plan-and-organization-requirements) |
27 | **Routines** enabled for your Claude organization | Until it is, Claude answers every mention and DM with a reply that it's unavailable and does no work. | An admin turns on [**Admin settings > Capabilities > Remote sessions > Routines**](https://claude.ai/admin-settings/capabilities) |
28 | **Owner** role in the Claude organization you're setting up | Setup pairs a workspace and turns Claude Tag on, and only an Owner can do either. Roles are per organization, so being an Owner elsewhere doesn't carry over. | Ask an Owner to run setup, or have one promote you at [`claude.ai/admin-settings/members`](https://claude.ai/admin-settings/members) |
29 | A **Slack workspace admin** | Running `@Claude connect` requires a Slack workspace admin; installing the app usually does too. | If that's someone else, [send them the install request](#if-you-re-not-the-slack-workspace-admin) early (app approval can take time), and plan to be online together when you pair; pairing codes expire 15 minutes after they're issued |
30 | **Usage credits** (Team plans) | Channel work draws from your organization's usage balance; on a Team plan nothing runs until credits are loaded. | Buy credits at [`claude.ai/admin-settings/usage`](https://claude.ai/admin-settings/usage) |
31 | A **public channel** for Claude to join | The launch step asks you to select at least one public channel, and you can [verify your setup](#verify-your-setup) there. | Create a public Slack channel for the pilot, or pick any existing one |
22> **Before you start: check that you have what setup needs**
23>
24> | Prerequisite | Why you need it | If you don't have it |
25> | :- | :- | :- |
26> | A **Team or Enterprise plan** on claude.ai | Claude Tag is available on Team and Enterprise plans, on Anthropic's first-party service. It isn't available on individual plans (Free, Pro, or Max), or for third-party deployments. | Start a Team or Enterprise plan at [claude.com/pricing](https://claude.com/pricing) |
27> | A Claude organization **without Zero Data Retention (ZDR), customer-managed encryption (CMEK), or the HIPAA configuration for Claude Code (local mode) and Cowork (local mode)** | Claude Tag stores channel memory and session transcripts, which ZDR doesn't permit. A CMEK policy and the HIPAA configuration don't allow Claude Tag either. | Claude Tag isn't available to organizations with any of these. See [Healthcare organizations](/docs/claude-tag/admins/healthcare#plan-and-organization-requirements) |
28> | **Routines** enabled for your Claude organization | Until it is, Claude answers every mention and DM with a reply that it's unavailable and does no work. | An admin turns on [**Admin settings > Capabilities > Remote sessions > Routines**](https://claude.ai/admin-settings/capabilities) |
29> | **Owner** role in the Claude organization you're setting up | Setup pairs a workspace and turns Claude Tag on, and only an Owner can do either. Roles are per organization, so being an Owner elsewhere doesn't carry over. | Ask an Owner to run setup, or have one promote you at [`claude.ai/admin-settings/members`](https://claude.ai/admin-settings/members) |
30> | A **Slack workspace admin** | Running `@Claude connect` requires a Slack workspace admin; installing the app usually does too. | If that's someone else, [send them the install request](#if-you-re-not-the-slack-workspace-admin) early (app approval can take time), and plan to be online together when you pair; pairing codes expire 15 minutes after they're issued |
31> | **Usage credits** (Team plans) | Channel work draws from your organization's usage balance; on a Team plan nothing runs until credits are loaded. | Buy credits at [`claude.ai/admin-settings/usage`](https://claude.ai/admin-settings/usage) |
32> | A **public channel** for Claude to join | The launch step asks you to select at least one public channel, and you can [verify your setup](#verify-your-setup) there. | Create a public Slack channel for the pilot, or pick any existing one |
33>
34> If any of your services restrict traffic by IP, file the [network requirements](/docs/claude-tag/admins/network-requirements) request with your network team early; in many organizations, IP allowlist changes take days to approve.
35>
36> If you see **View setup guide** and **Go to chat** buttons instead of **Start setup**, your signed-in account can't run setup. See [Common setup issues](#common-setup-issues).
3237
33 If any of your services restrict traffic by IP, file the [network requirements](/docs/claude-tag/admins/network-requirements) request with your network team early; in many organizations, IP allowlist changes take days to approve.
38> [!NOTE]
39>
40> If your team already uses the earlier Claude in Slack, the same steps apply and your existing app stays; see [Migrate from the earlier app](/docs/claude-tag/admins/migrate-from-earlier) for what changes.
3441
35 If you see **View setup guide** and **Go to chat** buttons instead of **Start setup**, your signed-in account can't run setup. See [Common setup issues](#common-setup-issues).
36</Accordion>
37
38<Note>If your team already uses the earlier Claude in Slack, the same steps apply and your existing app stays; see [Migrate from the earlier app](/docs/claude-tag/admins/migrate-from-earlier) for what changes.</Note>
39
4042## Pair your Slack workspace
4143
4244Install the Claude app in Slack, get a pairing code from Slack, and paste it on the setup page.
4345
44<Steps>
45 <Step title="Add the Claude app to Slack">
46 **Where:** the Slack Marketplace, at [claude.com/claude-for-slack](https://claude.com/claude-for-slack).
46**1. Add the Claude app to Slack**
4747
48 Click **Add the Claude app** on the setup page to open the listing, then click **Add to Slack** and approve the permissions. If the app is already installed, click **Add to Slack** anyway: you reinstall over the existing app with its current permissions and keep your settings.
48**Where:** the Slack Marketplace, at [claude.com/claude-for-slack](https://claude.com/claude-for-slack).
4949
50 On Slack Enterprise Grid, installing takes two Slack actions. See [Set up Claude Tag on Enterprise Grid](/docs/claude-tag/admins/workspaces#set-up-claude-tag-on-enterprise-grid) for the steps.
51 </Step>
50Click **Add the Claude app** on the setup page to open the listing, then click **Add to Slack** and approve the permissions. If the app is already installed, click **Add to Slack** anyway: you reinstall over the existing app with its current permissions and keep your settings.
5251
53 <Step title="Send @Claude connect in any channel">
54 **Where:** Slack, in the workspace you just installed the app in.
52On Slack Enterprise Grid, installing takes two Slack actions. See [Set up Claude Tag on Enterprise Grid](/docs/claude-tag/admins/workspaces#set-up-claude-tag-on-enterprise-grid) for the steps.
5553
56 Open any channel and add Claude to it with `/invite @Claude`. Claude posts a short welcome message when it joins. Then send `@Claude connect` as a new message with no other text. Claude replies in the channel with a message only you can see, containing the pairing code:
54**2. Send @Claude connect in any channel**
5755
58 > Connect **this workspace** (Acme) to your Claude organization for billing: have a Claude **organization admin** redeem this code in Claude admin settings. The code works once and expires in 15 minutes.
59 >
60 > `workspace_a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6`
61 >
62 > *Once connected, Claude usage in this workspace is billed to that organization.*
56**Where:** Slack, in the workspace you just installed the app in.
6357
64 Only a Slack workspace admin (or Grid org admin) can run this command; anyone else gets a message naming who to ask.
58Open any channel and add Claude to it with `/invite @Claude`. Claude posts a short welcome message when it joins. Then send `@Claude connect` as a new message with no other text. Claude replies in the channel with a message only you can see, containing the pairing code:
6559
66 If you skip the invite, Slack shows you a notice that Claude isn't in the channel, with an **Add Them** button. Click it, then send `@Claude connect` again.
67 </Step>
60> Connect **this workspace** (Acme) to your Claude organization for billing: have a Claude **organization admin** redeem this code in Claude admin settings. The code works once and expires in 15 minutes.
61>
62> `workspace_a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6`
63>
64> *Once connected, Claude usage in this workspace is billed to that organization.*
6865
69 <Step title="Paste the pairing code">
70 **Where:** the Claude Tag setup page at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag).
66Only a Slack workspace admin (or Grid org admin) can run this command; anyone else gets a message naming who to ask.
7167
72 Paste the pairing code Claude sent into the **Paste the pairing code** field. **Connected to** followed by your workspace name appears under it when the code is accepted.
73 </Step>
68If you skip the invite, Slack shows you a notice that Claude isn't in the channel, with an **Add Them** button. Click it, then send `@Claude connect` again.
7469
75 <Step title="Click Pair workspace">
76 The setup page continues to the next step that applies to your organization.
77 </Step>
78</Steps>
70**3. Paste the pairing code**
7971
72**Where:** the Claude Tag setup page at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag).
73
74Paste the pairing code Claude sent into the **Paste the pairing code** field. **Connected to** followed by your workspace name appears under it when the code is accepted.
75
76**4. Click Pair workspace**
77
78The setup page continues to the next step that applies to your organization.
79
8080Pairing covers the whole workspace. Claude doesn't answer mentions in Slack until you finish [Launch Claude Tag](#launch-claude-tag). A mention before then gets a notice that starts "Claude isn't on in this channel yet."
8181
8282After launch, people can tag Claude in any channel it has joined. To keep Claude to certain channels, see [Limit Claude Tag to specific channels](/docs/claude-tag/admins/restrict-access#limit-claude-tag-to-specific-channels).
8383
84<Accordion title="If you're not the Slack workspace admin">
85 Only a Slack workspace admin can run `@Claude connect`, and in most workspaces only an admin can install the app. If that's not you, send the Slack admin the message below and have them return the pairing code:
84> **If you're not the Slack workspace admin**
85>
86> Only a Slack workspace admin can run `@Claude connect`, and in most workspaces only an admin can install the app. If that's not you, send the Slack admin the message below and have them return the pairing code:
87>
88> ```text wrap theme={null}
89> Please install the Claude app (https://claude.com/claude-for-slack) in [workspace]. When that's done, let me know a time that works for the next part: in any channel, run /invite @Claude, then post "@Claude connect" with no other text and send me the code it returns. Pick a channel that belongs to just [workspace]. The code expires 15 minutes after Claude posts it, so I'll redeem it right away. What it can access: https://claude.com/docs/claude-tag/admins/for-slack-admins
90> ```
8691
87 ```text wrap theme={null}
88 Please install the Claude app (https://claude.com/claude-for-slack) in [workspace]. When that's done, let me know a time that works for the next part: in any channel, run /invite @Claude, then post "@Claude connect" with no other text and send me the code it returns. Pick a channel that belongs to just [workspace]. The code expires 15 minutes after Claude posts it, so I'll redeem it right away. What it can access: https://claude.com/docs/claude-tag/admins/for-slack-admins
89 ```
90</Accordion>
92> **If your Slack is on Enterprise Grid**
93>
94> When a Slack Org Owner or Org Admin sends `@Claude connect`, the reply includes two codes. One begins `workspace_` and pairs only the workspace the admin sent the command in, and one begins `enterprise_` and pairs the whole Grid. Paste the `enterprise_` code. See [Pair an Enterprise Grid](/docs/claude-tag/admins/workspaces#pair-an-enterprise-grid).
9195
92<Accordion title="If your Slack is on Enterprise Grid">
93 When a Slack Org Owner or Org Admin sends `@Claude connect`, the reply includes two codes. One begins `workspace_` and pairs only the workspace the admin sent the command in, and one begins `enterprise_` and pairs the whole Grid. Paste the `enterprise_` code. See [Pair an Enterprise Grid](/docs/claude-tag/admins/workspaces#pair-an-enterprise-grid).
94</Accordion>
95
9696## Buy usage credits
9797
9898**Where:** the Claude Tag setup page at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag).
from line 112
112112* **Channel work**: draws from that balance, not from individual seats
113113* **Direct messages (DMs)**: One-to-one DMs from members who have connected a Claude account run on the member's own claude.ai account and aren't capped by this limit. For members who haven't connected one, see [Direct messages from members without a Claude account](/docs/claude-tag/admins/restrict-access#direct-messages-from-members-without-a-claude-account).
114114
115<Steps>
116 <Step title="Set monthly spend limits">
117 If setup included the [**Buy usage credits**](#buy-usage-credits) step, the launch step has no spend limit picker. Set a limit after launch at [`claude.ai/admin-settings/usage/claude-tag`](https://claude.ai/admin-settings/usage/claude-tag).
115**1. Set monthly spend limits**
118116
119 Otherwise, choose from `$500`, `$1,000`, `$2,500`, `$5,000`, **Unlimited**, or **Custom** (a US-dollar amount up to `$1,000,000`). `$2,500` is preselected unless your organization already has a Claude Tag spend limit. Usage bills against your organization's balance up to that amount each month. See [Set a spend limit](/docs/claude-tag/admins/set-spend-limit) for what counts toward the cap, per-channel limits, and what users see when it's reached.
120 </Step>
117If setup included the [**Buy usage credits**](#buy-usage-credits) step, the launch step has no spend limit picker. Set a limit after launch at [`claude.ai/admin-settings/usage/claude-tag`](https://claude.ai/admin-settings/usage/claude-tag).
121118
122 <Step title="Add Claude to your channels">
123 Choose which channels Claude joins when you launch.
119Otherwise, choose from `$500`, `$1,000`, `$2,500`, `$5,000`, **Unlimited**, or **Custom** (a US-dollar amount up to `$1,000,000`). `$2,500` is preselected unless your organization already has a Claude Tag spend limit. Usage bills against your organization's balance up to that amount each month. See [Set a spend limit](/docs/claude-tag/admins/set-spend-limit) for what counts toward the cap, per-channel limits, and what users see when it's reached.
124120
125 * **If the launch step lists public channels from the workspace you paired**: select at least one. **Launch Claude Tag** stays unavailable until you do. Claude joins the channels you selected when you launch, so people can tag it there right away.
126 * **If the launch step shows no channel list**: launch, then run `/invite @Claude` in a channel in Slack.
121**2. Add Claude to your channels**
127122
128 To add Claude to a private channel, or to more channels later, run `/invite @Claude` in that channel.
129 </Step>
123Choose which channels Claude joins when you launch.
130124
131 <Step title="Let members know they can now tag Claude">
132 If you paired a whole Enterprise Grid, skip this step. The launch step doesn't show the toggle, launching doesn't send the DMs, and the admin page has no row for them.
125* **If the launch step lists public channels from the workspace you paired**: select at least one. **Launch Claude Tag** stays unavailable until you do. Claude joins the channels you selected when you launch, so people can tag it there right away.
126* **If the launch step shows no channel list**: launch, then run `/invite @Claude` in a channel in Slack.
133127
134 Otherwise, the **Let members know they can now tag Claude** toggle is on by default. After launch, Claude DMs each member of the workspace to help them get started. Those DMs don't count toward your usage. Turn the toggle off to skip them.
128To add Claude to a private channel, or to more channels later, run `/invite @Claude` in that channel.
135129
136 The admin page has a matching row, **Let people know they can talk to Claude**. To send the DMs from the admin page, select **Notify members now** on that row and confirm. The row reads **Members notified** once the DMs have gone out.
137 </Step>
130**3. Let members know they can now tag Claude**
138131
139 <Step title="Click Launch Claude Tag">
140 Claude Tag turns on. From here on, Claude answers mentions in the workspace you paired. The setup page shows **You're set**. Click **Done** to open the Claude Tag admin page.
141 </Step>
142</Steps>
132If you paired a whole Enterprise Grid, skip this step. The launch step doesn't show the toggle, launching doesn't send the DMs, and the admin page has no row for them.
143133
134Otherwise, the **Let members know they can now tag Claude** toggle is on by default. After launch, Claude DMs each member of the workspace to help them get started. Those DMs don't count toward your usage. Turn the toggle off to skip them.
135
136The admin page has a matching row, **Let people know they can talk to Claude**. To send the DMs from the admin page, select **Notify members now** on that row and confirm. The row reads **Members notified** once the DMs have gone out.
137
138**4. Click Launch Claude Tag**
139
140Claude Tag turns on. From here on, Claude answers mentions in the workspace you paired. The setup page shows **You're set**. Click **Done** to open the Claude Tag admin page.
141
144142To stop before launching, leave the setup page. Your pairing is saved, and your choices on the launch step aren't.
145143
146144## Give Claude access to your tools
from line 164
166164
167165Work through one tool end to end before starting the next.
168166
169<Steps>
170 <Step title="Create an email address for Claude">
171 In your company's email admin console, create a new user for Claude with any address, for example `[email protected]`, the same way you'd create a mailbox for a new hire. Every tool invitation and verification email for Claude lands in that inbox.
172 </Step>
167**1. Create an email address for Claude**
173168
174 <Step title="Add Claude to the tool as a member">
175 In the tool's member or user settings, invite `[email protected]` the way you'd add a new teammate. Open the invitation from Claude's inbox and finish creating the account, including a password. Give the account the narrowest role that covers the work, read-only where the tool offers it.
169In your company's email admin console, create a new user for Claude with any address, for example `[email protected]`, the same way you'd create a mailbox for a new hire. Every tool invitation and verification email for Claude lands in that inbox.
176170
177 For a tool that offers service accounts, create one in the tool's admin settings instead of inviting the email address, scoped read-only or to the specific project.
178 </Step>
171**2. Add Claude to the tool as a member**
179172
180 <Step title="Create an API key in Claude's account">
181 Sign in to the tool as Claude and create the credential that tool's [connection guide](/docs/claude-tag/admins/connections/overview) names, usually an API key or personal access token from the tool's settings. Copy it. The credential belongs to Claude's account, so Claude's actions show up in the tool's audit log under Claude's name.
182 </Step>
173In the tool's member or user settings, invite `[email protected]` the way you'd add a new teammate. Open the invitation from Claude's inbox and finish creating the account, including a password. Give the account the narrowest role that covers the work, read-only where the tool offers it.
183174
184 <Step title="Add the key as a connector">
185 Go to [**Organization settings > Claude Tag**](https://claude.ai/admin-settings/claude-tag). Under **Claude's access**, select the **Connectors** tab and click **Add**. Then [add a connector](/docs/claude-tag/admins/add-connections#add-a-connection) for the tool and paste the key you created. The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](/docs/claude-tag/admins/add-connections#add-a-connection) before you save the connector.
175For a tool that offers service accounts, create one in the tool's admin settings instead of inviting the email address, scoped read-only or to the specific project.
186176
187 For the next tool, start again from **Add Claude to the tool as a member**. Claude keeps the one email address for every tool.
188 </Step>
189</Steps>
177**3. Create an API key in Claude's account**
178
179Sign in to the tool as Claude and create the credential that tool's [connection guide](/docs/claude-tag/admins/connections/overview) names, usually an API key or personal access token from the tool's settings. Copy it. The credential belongs to Claude's account, so Claude's actions show up in the tool's audit log under Claude's name.
180
181**4. Add the key as a connector**
182
183Go to [**Organization settings > Claude Tag**](https://claude.ai/admin-settings/claude-tag). Under **Claude's access**, select the **Connectors** tab and click **Add**. Then [add a connector](/docs/claude-tag/admins/add-connections#add-a-connection) for the tool and paste the key you created. The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](/docs/claude-tag/admins/add-connections#add-a-connection) before you save the connector.
184
185For the next tool, start again from **Add Claude to the tool as a member**. Claude keeps the one email address for every tool.
190186
191187See [Give Claude access](/docs/claude-tag/admins/add-connections) for which services to connect first and what access to give each account, and the [per-service connection guides](/docs/claude-tag/admins/connections/overview) for the credential fields per tool.
192188
claude-tag/admins/skills-repo Changed · +16 / -18 lines
from line 2
22
33> Put your org's Claude Tag skills in a git repository with auto-sync, grant Claude write access, and Claude can open pull requests to improve its own skills from what it learns in channels.
44
5export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
5> [!NOTE]
6>
7> Claude Tag is in public beta. Features and behavior described here may change before general availability.
68
7<BetaNote />
8
99A **skill** is a set of instructions that teaches Claude how to use a specific tool or follow a specific process (for example, which Datadog endpoints answer which questions, or your org's incident-response runbook). Claude Tag uses the same [skills format as Claude Code](https://code.claude.com/docs/en/skills). A **plugin** bundles one or more skills together.
1010
1111You can upload skills one at a time in the console, but putting them in a git repository means Claude can open pull requests to improve them from what it learns working in your channels. You review the PR; once merged, every channel picks up the update.
from line 12
1212
1313## Set up the skills repository
1414
15<Steps>
16 <Step title="Create the repository">
17 A private or internal GitHub repository, laid out as a [Claude Code plugin marketplace](https://code.claude.com/docs/en/plugin-marketplaces): a `.claude-plugin/marketplace.json` file at the root that lists each plugin, and one folder per plugin. Each plugin bundles one or more skills. A public repository can't be selected in the next step; fork it into a private one first.
18 </Step>
15**1. Create the repository**
1916
20 <Step title="Register the repository as a plugin marketplace">
21 For a github.com repository, the GitHub connector must be enabled for your organization. In [**Organization settings > Plugins & skills**](https://claude.ai/admin-settings/skills?tab=inventory), click **Add** and choose **Sync from GitHub**. Select the repository, leave **Sync automatically** on (the default), and click **Create**.
17A private or internal GitHub repository, laid out as a [Claude Code plugin marketplace](https://code.claude.com/docs/en/plugin-marketplaces): a `.claude-plugin/marketplace.json` file at the root that lists each plugin, and one folder per plugin. Each plugin bundles one or more skills. A public repository can't be selected in the next step; fork it into a private one first.
2218
23 When you click **Create**, and on every sync after that, the whole repository is downloaded as one archive, and the archive can't be larger than 512 MiB. A repository over that size, such as a large monorepo, is rejected with `Download too large (>536.9MB)` even when the plugins in it are small. Put the plugins in a smaller dedicated repository, or [upload the plugin as a zip file](#upload-a-plugin-as-a-zip-file) instead.
24 </Step>
19**2. Register the repository as a plugin marketplace**
2520
26 <Step title="Grant Claude write access to the repository">
27 At [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), open a [bundle](/docs/claude-tag/admins/add-connections) on the **Bundles** tab under **Claude's access**. In its **What's in it** section, select **Add**, then **Repository**, and pick the repository. The Claude GitHub App must already be linked to your GitHub organization; see [Configure GitHub access](/docs/claude-tag/admins/configure-github).
28 </Step>
21For a github.com repository, the GitHub connector must be enabled for your organization. In [**Organization settings > Plugins & skills**](https://claude.ai/admin-settings/skills?tab=inventory), click **Add** and choose **Sync from GitHub**. Select the repository, leave **Sync automatically** on (the default), and click **Create**.
2922
30 <Step title="Add the plugins to the bundle">
31 On the same bundle's page, select **Add**, then **Plugin**, and pick each plugin from your new marketplace. A plugin isn't in the bundle until you add it, and the bundle's plugins apply wherever the bundle applies; see [Choose where a bundle applies](/docs/claude-tag/admins/attach-to-scope#attach-the-bundle) and [Attach plugins](/docs/claude-tag/admins/add-connections#attach-plugins).
32 </Step>
33</Steps>
23When you click **Create**, and on every sync after that, the whole repository is downloaded as one archive, and the archive can't be larger than 512 MiB. A repository over that size, such as a large monorepo, is rejected with `Download too large (>536.9MB)` even when the plugins in it are small. Put the plugins in a smaller dedicated repository, or [upload the plugin as a zip file](#upload-a-plugin-as-a-zip-file) instead.
24
25**3. Grant Claude write access to the repository**
26
27At [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), open a [bundle](/docs/claude-tag/admins/add-connections) on the **Bundles** tab under **Claude's access**. In its **What's in it** section, select **Add**, then **Repository**, and pick the repository. The Claude GitHub App must already be linked to your GitHub organization; see [Configure GitHub access](/docs/claude-tag/admins/configure-github).
28
29**4. Add the plugins to the bundle**
30
31On the same bundle's page, select **Add**, then **Plugin**, and pick each plugin from your new marketplace. A plugin isn't in the bundle until you add it, and the bundle's plugins apply wherever the bundle applies; see [Choose where a bundle applies](/docs/claude-tag/admins/attach-to-scope#attach-the-bundle) and [Attach plugins](/docs/claude-tag/admins/add-connections#attach-plugins).
3432
3533**You'll see:** the repository and the plugins appear in the bundle's **What's in it** table, with **Repository** or **Plugin** as each row's type.
3634
claude-tag/admins/troubleshooting Changed · +15 / -13 lines
from line 2
22
33> Error messages from Claude Tag setup and what fixes each. Covers permission mismatches, GitHub access gaps, session start failures, and account errors.
44
5export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
5> [!NOTE]
6>
7> Claude Tag is in public beta. Features and behavior described here may change before general availability.
68
7<BetaNote />
8
99This page covers errors you might hit setting up and administering Claude Tag: Slack app permissions, guest and shared channels, console errors, channels and threads where nothing responds, access and connections, and session starts.
1010
11<Note>For problems people can resolve on their own in a channel, like a missing reply or a thread that lost its work, see [Troubleshoot Claude Tag in channels and DMs](/docs/claude-tag/users/troubleshooting).</Note>
11> [!NOTE]
12>
13> For problems people can resolve on their own in a channel, like a missing reply or a thread that lost its work, see [Troubleshoot Claude Tag in channels and DMs](/docs/claude-tag/users/troubleshooting).
1214
1315If someone reports that Claude can't reach a service you connected, check two things before anything else:
1416
from line 340
3383402. Have an Owner in that organization [disconnect the workspace](/docs/claude-tag/admins/workspaces#revoke-a-pairing) under **Connected workspaces** on their **Slack** page.
3393413. Send `@Claude connect` again for a fresh code and redeem it here.
340342
341<Warning>
342 Disconnecting deletes the workspace's Claude data, including its memory, channel configurations, sessions, and the routines set up in its channels. The deletion can't be undone. See [Data lifecycle and deletion](/docs/claude-tag/concepts/data-lifecycle) for the full list of what's deleted.
343</Warning>
343> [!WARNING]
344>
345> Disconnecting deletes the workspace's Claude data, including its memory, channel configurations, sessions, and the routines set up in its channels. The deletion can't be undone. See [Data lifecycle and deletion](/docs/claude-tag/concepts/data-lifecycle) for the full list of what's deleted.
344346
345347### This workspace is connected to a different Claude organization
346348
from line 373
3713733. Select **Connect Claude account**.
3723744. Sign in with an account from the paired organization.
373375
374<a id="claim-code-invalid" />
375
376376### Claim code is invalid, expired, or already used
377377
378378**What you see**
from line 412
412412
413413Have someone in the thread send [`@Claude !restart`](/docs/claude-tag/users/commands#restart-a-stuck-or-wrong-context-session). The command archives the stuck session and starts a fresh one that rereads the thread, so a follow-up message in the same thread gets an answer. Starting a new thread and restating the request also works.
414414
415<Warning>Restarting abandons whatever the session was midway through, and there's no way to resume it. A silent session may still be working through a long task, so treat `!restart` as a last resort.</Warning>
415> [!WARNING]
416>
417> Restarting abandons whatever the session was midway through, and there's no way to resume it. A silent session may still be working through a long task, so treat `!restart` as a last resort.
416418
417419If the same request stalls again on the fresh session, send [feedback](/docs/claude-tag/users/commands#send-feedback) from that thread so Anthropic can investigate.
418420
from line 540
5385402. If the message persists, check which Claude organization the workspace is paired to. If your company has more than one (a trial organization alongside the main one, for example), an Owner in the wrong organization can [revoke the pairing](/docs/claude-tag/admins/workspaces#revoke-a-pairing) so you can pair the workspace to the right one.
5395413. If the right organization has the switch on and the message persists, contact your account team to confirm Claude Tag is enabled for it.
540542
541<Warning>
542 Revoking the pairing deletes the workspace's Claude data, including its memory, channel configurations, sessions, and the routines set up in its channels. The deletion can't be undone. See [Data lifecycle and deletion](/docs/claude-tag/concepts/data-lifecycle) for the full list of what's deleted.
543</Warning>
543> [!WARNING]
544>
545> Revoking the pairing deletes the workspace's Claude data, including its memory, channel configurations, sessions, and the routines set up in its channels. The deletion can't be undone. See [Data lifecycle and deletion](/docs/claude-tag/concepts/data-lifecycle) for the full list of what's deleted.
544546
545547### Claude Tag is unavailable because Routines are not enabled
546548
claude-tag/admins/workspaces Changed · +40 / -40 lines
from line 2
22
33> Connect more Slack workspaces or an Enterprise Grid to Claude Tag, choose which Claude Tag version each channel uses, and disconnect a workspace.
44
5export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
5> [!NOTE]
6>
7> Claude Tag is in public beta. Features and behavior described here may change before general availability.
68
7<BetaNote />
8
99This page covers managing Slack workspace pairings after initial setup: adding more workspaces, installing the app and pairing across a Slack Enterprise Grid, choosing which Claude Tag version each one runs, turning Claude on or off on the Team plan, and disconnecting a workspace.
1010
1111A workspace pairing links one Slack workspace (or Enterprise Grid) to your Claude organization so `@Claude` can run there. Your first pairing was created during [setup](/docs/claude-tag/admins/setup-overview). To add more, you must be an Owner in your Claude organization, and a Workspace Admin (or Grid Org Admin) in the Slack workspace you're adding.
from line 20
2020
2121If your company has more than one Claude organization (a subsidiary with its own, for example), agree on which one holds the pairing before connecting.
2222
23<Steps>
24 <Step title="Open the pairing dialog">
25 Go to [**Claude's access > Channels > Slack**](https://claude.ai/admin-settings/claude-tag/channels/slack). On the **General** tab, under **Connected workspaces**, click **Connect new**.
26 </Step>
23**1. Open the pairing dialog**
2724
28 <Step title="Get a pairing code from Slack">
29 In any channel of the new workspace, send `@Claude connect` with no other text, as a new top-level message or in a thread where Claude isn't already working, then paste the code Claude sends you into the dialog.
25Go to [**Claude's access > Channels > Slack**](https://claude.ai/admin-settings/claude-tag/channels/slack). On the **General** tab, under **Connected workspaces**, click **Connect new**.
3026
31 Pick a channel that belongs to just the new workspace. Claude can decline to reply in [guest and shared channels](/docs/claude-tag/admins/troubleshooting#guest-and-shared-channels).
32 </Step>
27**2. Get a pairing code from Slack**
3328
34 <Step title="Finish the dialog and launch">
35 Once the code is accepted, click **Next**, work through the dialog's remaining steps, and click **Launch Claude** on the last one.
36 </Step>
37</Steps>
29In any channel of the new workspace, send `@Claude connect` with no other text, as a new top-level message or in a thread where Claude isn't already working, then paste the code Claude sends you into the dialog.
3830
39<Note>If your organization used the earlier Claude in Slack app, the new workspace is added alongside your existing one, not in place of it.</Note>
31Pick a channel that belongs to just the new workspace. Claude can decline to reply in [guest and shared channels](/docs/claude-tag/admins/troubleshooting#guest-and-shared-channels).
4032
33**3. Finish the dialog and launch**
34
35Once the code is accepted, click **Next**, work through the dialog's remaining steps, and click **Launch Claude** on the last one.
36
37> [!NOTE]
38>
39> If your organization used the earlier Claude in Slack app, the new workspace is added alongside your existing one, not in place of it.
40
4141**You'll see:** the new workspace in the **Connected workspaces** list with the status **Active**, and as a row on the **Channels** tab.
4242
4343## Set up Claude Tag on Enterprise Grid
from line 46
4646
4747### Install the app across the Grid
4848
49<Steps>
50 <Step title="Sign in to a workspace in the Grid">
51 As a Slack Org Owner or Org Admin, sign in to one of the Grid's workspaces rather than the Slack organization admin dashboard. Slack offers **Install to entire organization** only when you start from inside a workspace.
52 </Step>
49**1. Sign in to a workspace in the Grid**
5350
54 <Step title="Install to the entire organization">
55 On the [Claude for Slack](https://claude.com/claude-for-slack) listing, select **Add to Slack > Install to entire organization**.
51As a Slack Org Owner or Org Admin, sign in to one of the Grid's workspaces rather than the Slack organization admin dashboard. Slack offers **Install to entire organization** only when you start from inside a workspace.
5652
57 If some workspaces in the Grid already installed the app on their own, leave those installations in place and choose **Install to entire organization** anyway. Don't uninstall first, because uninstalling the app from a workspace [deletes that workspace's Claude data](/docs/claude-tag/concepts/data-lifecycle#actions-in-slack).
58 </Step>
53**2. Install to the entire organization**
5954
60 <Step title="Add the app to each workspace">
61 From the Slack organization admin dashboard, add the Claude app to each workspace where people will use Claude. Each workspace still needs the app added before people there can invite and mention `@Claude`.
62 </Step>
63</Steps>
55On the [Claude for Slack](https://claude.com/claude-for-slack) listing, select **Add to Slack > Install to entire organization**.
6456
57If some workspaces in the Grid already installed the app on their own, leave those installations in place and choose **Install to entire organization** anyway. Don't uninstall first, because uninstalling the app from a workspace [deletes that workspace's Claude data](/docs/claude-tag/concepts/data-lifecycle#actions-in-slack).
58
59**3. Add the app to each workspace**
60
61From the Slack organization admin dashboard, add the Claude app to each workspace where people will use Claude. Each workspace still needs the app added before people there can invite and mention `@Claude`.
62
6563### Pair an Enterprise Grid
6664
6765To get the Grid's pairing codes, a Slack Org Owner or Org Admin sends `@Claude connect`, with no other text, in a channel of any workspace in the Grid. Claude's reply includes two codes, one beginning `enterprise_` and one beginning `workspace_`. The `enterprise_` code pairs every workspace in the Grid that isn't already paired on its own. The `workspace_` code pairs only the workspace where `@Claude connect` was sent.
from line 69
7169* **During setup:** paste the code into the **Paste the pairing code** field on the [setup page](/docs/claude-tag/admins/setup-overview#pair-your-slack-workspace)
7270* **After setup:** click **Connect new** under **Connected workspaces** on the **Slack** page, as in [Pair another workspace](#pair-another-workspace), and paste the code into the dialog. If a workspace you've already paired belongs to a Grid you haven't paired, the list also has an **Enterprise Grid** row with the status **Not connected**, and **Connect** on that row opens the same dialog.
7371
74<Note>Leave the workspaces you've already paired connected while you pair the Grid. They stay paired and keep their Claude data.</Note>
72> [!NOTE]
73>
74> Leave the workspaces you've already paired connected while you pair the Grid. They stay paired and keep their Claude data.
7575
7676**You'll see:** the Grid in the **Connected workspaces** list with **Enterprise Grid** and **Active** in the **Status** column.
7777
from line 156
156156
157157Claude stops responding in that workspace's channels immediately, and your organization is no longer billed for Claude usage there. One-to-one direct messages from members who have connected a Claude account run on the member's own account, so they keep working until the deletion below removes the member's account link. A member who reconnects their account afterward can use direct messages again while the app stays installed.
158158
159<Warning>
160 When you disconnect a workspace, Anthropic deletes its Claude data:
161
162 * The workspace's sessions and their transcripts, including members' direct-message conversations with Claude in that workspace
163 * Its channel, workspace, and direct-message memory
164 * The routines set up in its channels, and the artifacts published from them
165 * Its scopes, with their instructions and bundle bindings
166 * The links between members' Slack and Claude accounts
167
168 Deletion starts as soon as you confirm and runs to completion in the background. This can't be undone. Routines a person set up in a one-to-one direct message with Claude belong to that person's account and keep running.
169</Warning>
159> [!WARNING]
160>
161> When you disconnect a workspace, Anthropic deletes its Claude data:
162>
163> * The workspace's sessions and their transcripts, including members' direct-message conversations with Claude in that workspace
164> * Its channel, workspace, and direct-message memory
165> * The routines set up in its channels, and the artifacts published from them
166> * Its scopes, with their instructions and bundle bindings
167> * The links between members' Slack and Claude accounts
168>
169> Deletion starts as soon as you confirm and runs to completion in the background. This can't be undone. Routines a person set up in a one-to-one direct message with Claude belong to that person's account and keep running.
170170
171171Bundles belong to your organization, not to a workspace, so they stay available to add to other workspaces and channels; only their bindings to the deleted workspace and its channels go.
172172
claude-tag/concepts/agent-identity Changed · +22 / -30 lines
from line 2
22
33> Claude Tag acts under its own service accounts in Slack channels, not as you. See how channel access is bounded, how credentials reach it, how Claude uses your personal connectors for your own tasks in a channel, and why DMs differ.
44
5export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
5> [!NOTE]
6>
7> Claude Tag is in public beta. Features and behavior described here may change before general availability.
68
7<BetaNote />
8
99Claude Tag's identity depends on where you message it.
1010
1111In Slack channels, and in [group DMs](#group-dms) that include Claude, Claude acts with its own service accounts, rather than as a specific user. An organization Owner [provisions this identity](/docs/claude-tag/admins/setup-overview#give-claude-access-to-your-tools), so Claude has its own account in each system it works in: the Claude app in Slack, the Claude GitHub App on GitHub, and a service account in every other connected tool. Actions it takes are attributed to those accounts; for example, posts come from the Claude app and pull requests show the Claude GitHub App as the author. Claude can also use your own claude.ai connectors for a task you hand it in a channel, after you allow it. See [Personal connectors in a channel](#personal-connectors-in-a-channel).
from line 12
1212
1313In one-to-one direct messages (DMs) between `@Claude` and a user who has connected a Claude account, the session runs on [the individual's own claude.ai account](#direct-message-channels), with their personal connectors. A pull request opened from a DM is authored by the Claude GitHub App, the same as in channels, though the session can only work with repositories connected on that user's own account. An Owner can turn off DMs for the whole organization; see [Allow or disable direct messages](/docs/claude-tag/admins/restrict-access#allow-or-disable-direct-messages). For DMs from users who haven't connected a Claude account, see [Direct messages from members without a Claude account](/docs/claude-tag/admins/restrict-access#direct-messages-from-members-without-a-claude-account).
1414
15<Note>
16 How Claude behaves in channels (its standing instructions, plugins, and channel memory) is configured separately from its identity; see [custom instructions](/docs/claude-tag/admins/attach-to-scope#add-custom-instructions), [plugins](/docs/claude-tag/admins/add-connections#attach-plugins), and [memory](/docs/claude-tag/users/memory) for more information.
17</Note>
15> [!NOTE]
16>
17> How Claude behaves in channels (its standing instructions, plugins, and channel memory) is configured separately from its identity; see [custom instructions](/docs/claude-tag/admins/attach-to-scope#add-custom-instructions), [plugins](/docs/claude-tag/admins/add-connections#attach-plugins), and [memory](/docs/claude-tag/users/memory) for more information.
1818
1919## Channel sessions
2020
from line 26
2626
2727The diagram below traces one request through this process.
2828
29<img className="block dark:hidden" src="https://mintcdn.com/claude-ai/lijct3C2aoA3LHFn/images/claude-tag/diagrams/request-path.svg?fit=max&auto=format&n=lijct3C2aoA3LHFn&q=85&s=10d796e77738a52a505dcab2c9950cda" alt="Diagram showing the request path across three zones, labeled your Slack workspace, Anthropic's infrastructure, and your systems. A task mentioned in the Slack workspace runs in a session sandbox in the middle zone, one sandbox per thread, holding no stored credentials. Outbound requests pass to Agent Proxy, which injects the credential drawn from the credential store; a request that no rule, domain entry, or environment network access setting allows is blocked. Credentialed requests reach your systems, like GitHub, a data warehouse, monitoring, or any HTTP API. A dashed return path shows results posting back in the thread, as Claude." width="1000" height="440" data-path="images/claude-tag/diagrams/request-path.svg" />
29
3030
31<img className="hidden dark:block" src="https://mintcdn.com/claude-ai/lijct3C2aoA3LHFn/images/claude-tag/diagrams/request-path-dark.svg?fit=max&auto=format&n=lijct3C2aoA3LHFn&q=85&s=613ad7bf32eee0f85bd3a26064dcc74a" alt="Diagram showing the request path across three zones, labeled your Slack workspace, Anthropic's infrastructure, and your systems. A task mentioned in the Slack workspace runs in a session sandbox in the middle zone, one sandbox per thread, holding no stored credentials. Outbound requests pass to Agent Proxy, which injects the credential drawn from the credential store; a request that no rule, domain entry, or environment network access setting allows is blocked. Credentialed requests reach your systems, like GitHub, a data warehouse, monitoring, or any HTTP API. A dashed return path shows results posting back in the thread, as Claude." width="1000" height="440" data-path="images/claude-tag/diagrams/request-path-dark.svg" />
31**1. Tag Claude in a channel**
3232
33<Steps>
34 <Step title="Tag Claude in a channel">
35 A user asks Claude to chart last week's signups or fix a deploy test. The task gets a session in a thread under the message.
36 </Step>
33A user asks Claude to chart last week's signups or fix a deploy test. The task gets a session in a thread under the message.
3734
38 <Step title="The session sandbox starts">
39 Claude does the work in an isolated environment built for this thread, reading files, writing documents, and running code. The credentials you provision are not placed in the sandbox; they stay in the credential store and are injected at the proxy.
40 </Step>
35**2. The session sandbox starts**
4136
42 <Step title="The request crosses Agent Proxy">
43 When the work needs something outside the sandbox, like calling the GitHub API or querying a warehouse, the request crosses Agent Proxy, the network boundary between the sandbox and everything else. Agent Proxy checks it against the rules an admin configured, and decides whether it proceeds and what credential, if any, travels with it.
44 </Step>
37Claude does the work in an isolated environment built for this thread, reading files, writing documents, and running code. The credentials you provision are not placed in the sandbox; they stay in the credential store and are injected at the proxy.
4538
46 <Step title="Agent Proxy attaches a credential">
47 A matching credential comes from the credential store, which keeps the credentials of the [connectors](/docs/claude-tag/admins/add-connections) an admin added. Once saved, a credential is never displayed again; Agent Proxy retrieves it only at the moment of injection and attaches it to the request at the boundary, so the model and the sandbox itself are not given the key.
48 </Step>
39**3. The request crosses Agent Proxy**
4940
50 <Step title="The result posts back, as Claude">
51 The credentialed request reaches your system, like GitHub or the warehouse, and the result returns to the thread.
52 </Step>
53</Steps>
41When the work needs something outside the sandbox, like calling the GitHub API or querying a warehouse, the request crosses Agent Proxy, the network boundary between the sandbox and everything else. Agent Proxy checks it against the rules an admin configured, and decides whether it proceeds and what credential, if any, travels with it.
5442
43**4. Agent Proxy attaches a credential**
44
45A matching credential comes from the credential store, which keeps the credentials of the [connectors](/docs/claude-tag/admins/add-connections) an admin added. Once saved, a credential is never displayed again; Agent Proxy retrieves it only at the moment of injection and attaches it to the request at the boundary, so the model and the sandbox itself are not given the key.
46
47**5. The result posts back, as Claude**
48
49The credentialed request reaches your system, like GitHub or the warehouse, and the result returns to the thread.
50
5551### Agent Proxy
5652
5753For each outbound request from the sandbox, Agent Proxy checks the destination against three allow layers. A request goes through if any one of them allows it; a host that none of them allows is blocked.
from line 71
7571
7672A host that none of the three layers above allows is blocked, and Claude names the blocked host in the thread so an admin can add it; see [Give Claude access to your tools](/docs/claude-tag/admins/add-connections).
7773
78<a id="web-search-vs-network-requests" />
79
8074### Web search vs. network requests
8175
8276Claude can search the web from a channel without any Domains entry. Web search is [Anthropic's built-in web search tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-search-tool), which runs on Anthropic's servers, not code running in the channel's sandbox.
from line 104
110104
111105A one-to-one DM with Claude works differently from a channel. A DM session runs with your own claude.ai account, the same way a Claude Code session on the web does, using your own connectors and credentials, with results attributed to you (pull requests excepted; the Claude GitHub App authors those from DMs too). The diagram contrasts with the channel path above.
112106
113<img className="block dark:hidden" src="https://mintcdn.com/claude-ai/5JFKyLlO7sHMMf5J/images/claude-tag/diagrams/dm-identity.svg?fit=max&auto=format&n=5JFKyLlO7sHMMf5J&q=85&s=d4089034f46e4a760f9fac9d36a689cc" alt="Diagram showing how a DM session reaches your systems. A message to Claude in a direct message runs in a session sandbox, in a zone labeled Anthropic's infrastructure, the same engine as a channel session, but it runs with your identity. From there it reaches your systems through your own connectors and accounts, like GitHub or Drive, using your own credentials. A dashed return path shows results posting back in the DM, as you." width="1000" height="270" data-path="images/claude-tag/diagrams/dm-identity.svg" />
114
115<img className="hidden dark:block" src="https://mintcdn.com/claude-ai/5JFKyLlO7sHMMf5J/images/claude-tag/diagrams/dm-identity-dark.svg?fit=max&auto=format&n=5JFKyLlO7sHMMf5J&q=85&s=a3ca3c8aa926704742402882f4345b1b" alt="Diagram showing how a DM session reaches your systems. A message to Claude in a direct message runs in a session sandbox, in a zone labeled Anthropic's infrastructure, the same engine as a channel session, but it runs with your identity. From there it reaches your systems through your own connectors and accounts, like GitHub or Drive, using your own credentials. A dashed return path shows results posting back in the DM, as you." width="1000" height="270" data-path="images/claude-tag/diagrams/dm-identity-dark.svg" />
107
116108
117109The table lines up the two paths on the four dimensions that differ.
118110