One read of Claude Documentationclaude-docs-20261023T180724Z
267 pages moved out of 280 read.
Pages moved
267
significant first
Pages read
280
in this capture
Captured
18:07 UTC
Corpus hash
307a31a7094a
corpus-hash
What this read moved
51-75 of 267, page 3 of 11This capture is too large to show at once. Changes 51-75 of 267 are below, significant first; the rest are on the following screens.
claude-tag/admins/federated-access/gcp Changed · +19 / -19 lines
from line 10
1010>
1111> Google Cloud identities are connected on the [**Federated agent access**](https://claude.ai/admin-settings/claude-tag/federated-cloud-access) page, under **Claude Tag** in the admin settings sidebar. Use its **Cloud roles** section. Connecting an identity needs an organization Owner, or an admin with full Claude Tag management permission.
1212
13With a Google Cloud identity connection, Claude exchanges a short-lived identity token at a workload identity pool you create and calls Google Cloud APIs with the result. No service account key is stored in Claude. The token names your organization and the [agent](/docs/claude-tag/concepts/agent-identity.md) making the request (Claude's identity in one Slack channel), and your pool's attribute condition decides which tokens to accept. If someone else manages your Google Cloud project, give them the values from Claude's admin settings and the settings below; the console steps need an organization Owner or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration).
13With a Google Cloud identity connection, Claude exchanges a short-lived identity token at a workload identity pool you create and calls Google Cloud APIs with the result. No service account key is stored in Claude. The token names your organization and the [agent](https://claude.com/docs/claude-tag/concepts/agent-identity.md) making the request (Claude's identity in one Slack channel), and your pool's attribute condition decides which tokens to accept. If someone else manages your Google Cloud project, give them the values from Claude's admin settings and the settings below; the console steps need an organization Owner or a [Claude Tag admin](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration).
1414
1515Before you start, decide whether Claude acts as the federated identity itself, with roles granted to it directly, or as a service account you create. Both forms are covered below.
1616
from line 41
4141| Attribute mapping | `google.subject` = `assertion.sub`. You can also map `attribute.org` = `assertion.tenant`, which lets you grant roles to all of your organization's agents as one principal set in [Grant access](#grant-access). |
4242| Attribute condition | `assertion.sub == "<full subject>"` for one agent. To allow several agents, join one comparison per agent with CEL's or operator. To admit every agent in your organization instead, `assertion.sub.startsWith("wimse://identity.anthropic.com/org/<your organization ID>/agent/")`. |
4343
44Google doesn't require an attribute condition, and nothing checks it for you. Without one, agents of every other Claude Tag organization can authenticate to your pool, because every organization's tokens come from the same issuer; see [Authorize on the subject](/docs/claude-tag/admins/federated-access/token-reference.md#authorize-on-the-subject). The condition on `assertion.sub` is the subject check every connection type needs. The exact form accepts only the agents you list, and the prefix form accepts every agent in your organization, because every subject carries your organization ID between `/org/` and `/agent/`.
44Google doesn't require an attribute condition, and nothing checks it for you. Without one, agents of every other Claude Tag organization can authenticate to your pool, because every organization's tokens come from the same issuer; see [Authorize on the subject](https://claude.com/docs/claude-tag/admins/federated-access/token-reference.md#authorize-on-the-subject). The condition on `assertion.sub` is the subject check every connection type needs. The exact form accepts only the agents you list, and the prefix form accepts every agent in your organization, because every subject carries your organization ID between `/org/` and `/agent/`.
4545
4646Listing exact subjects is the strongest form. The prefix form is the minimum, and it admits every agent in your organization to the pool. With the prefix form, you can still grant IAM roles only to individual agents' `principal://` members, as shown under [Grant access](#grant-access). Claude's admin settings don't show agent IDs, so you learn a subject from Cloud Audit Logs after a first exchange, and you update the condition or the grants when a Slack channel is deleted and recreated, because the new channel's agent has a new ID.
4747
from line 88
8888The **Block requests that mint new credentials** checkbox is selected by default. With it selected:
8989
9090* Claude can't use this identity to call Google endpoints that create keys, tokens, or other credentials, even if IAM would allow the call.
91* Requests to a list of services that deal in credentials are refused entirely. See [what the credential-minting block refuses](/docs/claude-tag/admins/federated-access/limits.md#what-the-credential-minting-block-refuses) on the limits page.
91* Requests to a list of services that deal in credentials are refused entirely. See [what the credential-minting block refuses](https://claude.com/docs/claude-tag/admins/federated-access/limits.md#what-the-credential-minting-block-refuses) on the limits page.
9292* gRPC calls are refused, so tell Claude in the custom instructions to use the REST transport of client libraries such as Spanner, Bigtable, Firestore, and Pub/Sub.
9393
9494If Claude needs one of the refused services, clear the checkbox and rely on your IAM grants alone. The token exchange itself, including acting as the service account, happens inside Agent Proxy and isn't affected by this checkbox or by the allowed hosts.
from line 95
9595
9696**5. Narrow the allowed Google hosts**
9797
98Replace the prefilled `*.googleapis.com` entry in the **Allowed Google hosts** field with the hosts Claude needs, for example `storage.googleapis.com`. A wildcard as the leftmost label, such as `*.storage.googleapis.com`, matches any subdomain but not the name itself. Every host must be `googleapis.com`, a subdomain of it, or a subdomain of `clients6.google.com`. You can change the list later from the connection's [**Edit connection** dialog](/docs/claude-tag/admins/add-connections.md#set-allowed-websites), which you open from the connection's row on the **Connectors** tab; see [Manage federated connections on the Connectors tab](/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab).
98Replace the prefilled `*.googleapis.com` entry in the **Allowed Google hosts** field with the hosts Claude needs, for example `storage.googleapis.com`. A wildcard as the leftmost label, such as `*.storage.googleapis.com`, matches any subdomain but not the name itself. Every host must be `googleapis.com`, a subdomain of it, or a subdomain of `clients6.google.com`. You can change the list later from the connection's [**Edit connection** dialog](https://claude.com/docs/claude-tag/admins/add-connections.md#set-allowed-websites), which you open from the connection's row on the **Connectors** tab; see [Manage federated connections on the Connectors tab](https://claude.com/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab).
9999
100100**6. Confirm the attribute condition**
101101
from line 103
103103
104104**7. Choose a bundle and connect**
105105
106Choose a bundle from the **Access bundle** list, or create one: click **New bundle** if the dialog shows it, enter a **Bundle name**, and click **Create bundle**. Then click **Connect identity**. This creates a [connection](/docs/claude-tag/admins/add-connections.md) in that bundle, with the hosts you entered under **Allowed hosts**. The same provider can be connected more than once, for example once with a service account and once without, as long as no two Google Cloud connections in one bundle share a host under **Allowed hosts**. Each connection applies wherever its bundle applies.
106Choose a bundle from the **Access bundle** list, or create one: click **New bundle** if the dialog shows it, enter a **Bundle name**, and click **Create bundle**. Then click **Connect identity**. This creates a [connection](https://claude.com/docs/claude-tag/admins/add-connections.md) in that bundle, with the hosts you entered under **Allowed hosts**. The same provider can be connected more than once, for example once with a service account and once without, as long as no two Google Cloud connections in one bundle share a host under **Allowed hosts**. Each connection applies wherever its bundle applies.
107107
108108The **Cloud roles** table has **Role**, **Access bundle**, **Allowed hosts**, **Added**, and **Actions** columns. Each connection's name appears under **Role** with the provider and a **Google Cloud** chip beneath it, which also names the service account when the connection acts as one, and **Remove** is under **Actions**.
109109
110110## Let agents use the identity
111111
112Claude uses the identity in the channels where its bundle applies. A bundle you created in the connect dialog applies nowhere until you choose places; see [Manage federated connections on the Connectors tab](/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab).
112Claude uses the identity in the channels where its bundle applies. A bundle you created in the connect dialog applies nowhere until you choose places; see [Manage federated connections on the Connectors tab](https://claude.com/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab).
113113
114Claude also needs to know what the identity is for. Add a line like this to the scope's [custom instructions](/docs/claude-tag/admins/attach-to-scope.md#add-custom-instructions):
114Claude also needs to know what the identity is for. Add a line like this to the scope's [custom instructions](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#add-custom-instructions):
115115
116116```text wrap theme={null}
117117Use the Cloud Storage JSON API at storage.googleapis.com to read the bucket example-reports. Google Cloud access is already set up.
118118```
119119
120[Agent Proxy](/docs/claude-tag/concepts/agent-identity.md#agent-proxy) exchanges the token and attaches the resulting Google credential to each request at the network boundary, so the sandbox never holds it.
120[Agent Proxy](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy) exchanges the token and attaches the resulting Google credential to each request at the network boundary, so the sandbox never holds it.
121121
122New threads pick up the connection on their own. In a thread already running, ask Claude to use Google Cloud. If Claude still can't, send [`@Claude !restart`](/docs/claude-tag/users/commands#restart-a-stuck-or-wrong-context-session) in that thread. Claude then continues from a fresh session with your organization's current configuration.
122New threads pick up the connection on their own. In a thread already running, ask Claude to use Google Cloud. If Claude still can't, send [`@Claude !restart`](https://claude.com/docs/claude-tag/users/commands#restart-a-stuck-or-wrong-context-session) in that thread. Claude then continues from a fresh session with your organization's current configuration.
123123
124124## Verify the connection
125125
126[Federated connections](/docs/claude-tag/admins/federated-access/limits.md#where-federated-connections-work) work only in agent sessions, such as a Slack channel. A test from a personal session, such as a direct message with `@Claude`, won't work.
126[Federated connections](https://claude.com/docs/claude-tag/admins/federated-access/limits.md#where-federated-connections-work) work only in agent sessions, such as a Slack channel. A test from a personal session, such as a direct message with `@Claude`, won't work.
127127
128128In a channel where the identity's connection applies, start a new thread and ask Claude to run a connectivity check. The check reads a bucket's metadata, so the identity needs the `storage.buckets.get` permission on the bucket, and `storage.googleapis.com` must be under the connection's **Allowed hosts**. Send Claude this prompt, replacing `example-reports` with a bucket the identity can read:
129129
from line 142
142142* A token refused by your provider usually means the attribute condition didn't accept it. Check the organization ID in the condition, then the issuer URL and the allowed audience.
143143* A permission error on the API call means the role grant is missing or too narrow.
144144
145See [Troubleshoot federated agent access](/docs/claude-tag/admins/federated-access/troubleshooting.md) for the errors Claude shows and the other causes.
145See [Troubleshoot federated agent access](https://claude.com/docs/claude-tag/admins/federated-access/troubleshooting.md) for the errors Claude shows and the other causes.
146146
147147To disconnect an identity, click **Remove** in the identity's row of the **Cloud roles** table, then **Remove role** in the confirmation. Claude stops using the identity within about a minute, in existing threads as well as new ones, and the connection is removed from its bundle. A Google credential from an earlier exchange stays valid with Google until it expires, held only by Agent Proxy, never by Claude's sandbox. To end the trust on the Google side as well, delete the provider or remove the IAM bindings.
148148
from line 153
153153* **A message that a connection "already covers" a host "in this bundle"**: another Google Cloud connection in the bundle you chose already has that host under **Allowed hosts**, so Claude would never use the new connection for it. Remove the shared host or choose another bundle.
154154* **A rejected Workload identity provider or Service account to act as value**: the value doesn't match the form the field describes, usually because the resource name carries the project ID instead of the project number, or the service account is a default one.
155155
156For other dialog messages, see [Troubleshoot federated agent access](/docs/claude-tag/admins/federated-access/troubleshooting.md).
156For other dialog messages, see [Troubleshoot federated agent access](https://claude.com/docs/claude-tag/admins/federated-access/troubleshooting.md).
157157
158If Claude reports HTTP 403 with a reason that starts with [`request blocked: federated connections work only in agent sessions (such as a Slack channel), not in personal sessions (such as a direct message)`](/docs/claude-tag/admins/federated-access/troubleshooting#request-blocked-federated-connections-work-only-in-agent-sessions-such-as-a-slack-channel--not-in-personal-sessions-such-as-a-direct-message), the request came from a personal session, such as a direct message with `@Claude`. A personal session runs under a person's own account. [Federated connections](/docs/claude-tag/admins/federated-access/limits.md#where-federated-connections-work) work only in agent sessions, so test again from a new thread in a Slack channel where the connection [applies](/docs/claude-tag/admins/attach-to-scope.md#how-scopes-inherit).
158If Claude reports HTTP 403 with a reason that starts with [`request blocked: federated connections work only in agent sessions (such as a Slack channel), not in personal sessions (such as a direct message)`](https://claude.com/docs/claude-tag/admins/federated-access/troubleshooting#request-blocked-federated-connections-work-only-in-agent-sessions-such-as-a-slack-channel--not-in-personal-sessions-such-as-a-direct-message), the request came from a personal session, such as a direct message with `@Claude`. A personal session runs under a person's own account. [Federated connections](https://claude.com/docs/claude-tag/admins/federated-access/limits.md#where-federated-connections-work) work only in agent sessions, so test again from a new thread in a Slack channel where the connection [applies](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#how-scopes-inherit).
159159
160160## Related resources
161161
162* [Give Claude access](/docs/claude-tag/admins/add-connections.md): the bundle and connection model
163* [Attach a bundle to a scope](/docs/claude-tag/admins/attach-to-scope.md): where an identity connection applies
164* [Identity token reference](/docs/claude-tag/admins/federated-access/token-reference.md): every claim in the token, lifetimes, and key rotation
165* [Limits](/docs/claude-tag/admins/federated-access/limits.md): what the credential-minting block refuses, and the other limits for Google Cloud identities
166* [Troubleshoot federated agent access](/docs/claude-tag/admins/federated-access/troubleshooting.md): console and runtime errors for every connection type
167* [BigQuery](/docs/claude-tag/admins/connections/bigquery.md): the stored-key alternative for one Google service
162* [Give Claude access](https://claude.com/docs/claude-tag/admins/add-connections.md): the bundle and connection model
163* [Attach a bundle to a scope](https://claude.com/docs/claude-tag/admins/attach-to-scope.md): where an identity connection applies
164* [Identity token reference](https://claude.com/docs/claude-tag/admins/federated-access/token-reference.md): every claim in the token, lifetimes, and key rotation
165* [Limits](https://claude.com/docs/claude-tag/admins/federated-access/limits.md): what the credential-minting block refuses, and the other limits for Google Cloud identities
166* [Troubleshoot federated agent access](https://claude.com/docs/claude-tag/admins/federated-access/troubleshooting.md): console and runtime errors for every connection type
167* [BigQuery](https://claude.com/docs/claude-tag/admins/connections/bigquery.md): the stored-key alternative for one Google service
168168
claude-tag/admins/federated-access/limits Changed · +12 / -12 lines
from line 10
1010
1111## Where federated connections work
1212
13Federated connections are available to Claude in Slack channels, where it acts under your organization's [agent identity](/docs/claude-tag/concepts/agent-identity.md). They aren't available in one-to-one direct messages, which run on the individual's own claude.ai account, and they need an Anthropic-hosted environment; Claude can't use them in a [self-hosted environment](/docs/claude-tag/concepts/security-and-data.md).
13Federated connections are available to Claude in Slack channels, where it acts under your organization's [agent identity](https://claude.com/docs/claude-tag/concepts/agent-identity.md). They aren't available in one-to-one direct messages, which run on the individual's own claude.ai account, and they need an Anthropic-hosted environment; Claude can't use them in a [self-hosted environment](https://claude.com/docs/claude-tag/concepts/security-and-data.md).
1414
1515## Identity token
1616
from line 18
1818| :- | :- |
1919| Token lifetime | 10 minutes. Tokens can't be revoked before they expire. When you remove a gateway, Claude stops using it at once; when you remove a cloud role or authorization server, within about a minute (current behavior, may change). A token issued before the removal stays valid until it expires. |
2020| Signing algorithm | ES256 only. |
21| Claims | See the [identity token reference](/docs/claude-tag/admins/federated-access/token-reference.md#claims); verifiers must ignore claims they don't recognize. |
21| Claims | See the [identity token reference](https://claude.com/docs/claude-tag/admins/federated-access/token-reference.md#claims); verifiers must ignore claims they don't recognize. |
2222
2323## Gateways
2424
from line 27
2727| Registered addresses per organization | 5, counting gateways and authorization-server audience addresses together. |
2828| Token reuse | Claude reuses one token for a session's requests to the same gateway for about five minutes, half the token's lifetime, or until the gateway answers 401, and then requests a new one (current behavior, may change). A gateway sees the same `jti` on many requests. |
2929| Gateway address | An HTTPS host name only, with no path, port, query, or trailing slash. The host name needs a domain, like `gateway.example.com`, uses only letters, numbers, hyphens, and dots, and has at most 253 characters (current behavior, may change). The console rejects an IP address, a private-network name, an Anthropic-owned host, or a host cloud providers use for token exchange, and names the reason. The connection check also refuses a host name that resolves to a private address. |
30| [Allowed websites](/docs/claude-tag/admins/add-connections.md#set-allowed-websites) on the gateway's connection | Exactly the gateway's host, the only host Claude sends the token to. It can't be widened or given a wildcard. |
31| Connection check | Runs only against an HTTPS host with no path. The console sends two `POST` requests to the address, each with an empty body and a test token, doesn't follow redirects, and can take up to a minute. [Connect a gateway](/docs/claude-tag/admins/federated-access/connect-a-gateway.md) lists the expected responses. The console refuses a check that runs many times in quick succession and says how long to wait. |
30| [Allowed websites](https://claude.com/docs/claude-tag/admins/add-connections.md#set-allowed-websites) on the gateway's connection | Exactly the gateway's host, the only host Claude sends the token to. It can't be widened or given a wildcard. |
31| Connection check | Runs only against an HTTPS host with no path. The console sends two `POST` requests to the address, each with an empty body and a test token, doesn't follow redirects, and can take up to a minute. [Connect a gateway](https://claude.com/docs/claude-tag/admins/federated-access/connect-a-gateway.md) lists the expected responses. The console refuses a check that runs many times in quick succession and says how long to wait. |
3232| Same address twice in one organization | Entering an address that is already registered runs the connection check again (unless you skip it) without changing the stored result, then moves to the bundle step. The run counts toward the check limit. |
3333
3434## AWS roles
from line 38
3838| **Role ARN** | A commercial-partition IAM role, `arn:aws:iam::<account>:role/<name>`. AWS GovCloud and AWS China roles aren't supported. |
3939| **Allowed AWS hosts** | Hosts ending in `.amazonaws.com` only, for example `s3.us-east-1.amazonaws.com` or `*.amazonaws.com`. |
4040| Role session | 1 hour. The exchange doesn't ask for a longer session, so raising the role's maximum session duration has no effect. Claude reuses one session's credentials for the same agent until shortly before they expire, or until AWS answers a request with 403 (current behavior, may change). |
41| Token audience | `sts.amazonaws.com`, the same for every organization. Condition the trust policy on the `sub` claim as well as the audience; see [Authorize on the subject](/docs/claude-tag/admins/federated-access/token-reference.md#authorize-on-the-subject). |
41| Token audience | `sts.amazonaws.com`, the same for every organization. Condition the trust policy on the `sub` claim as well as the audience; see [Authorize on the subject](https://claude.com/docs/claude-tag/admins/federated-access/token-reference.md#authorize-on-the-subject). |
4242| One connection per role | A role can be connected once in your organization. |
4343
4444## Google Cloud identities
from line 48
4848| **Workload identity provider** | The full resource name of a provider in a workload identity pool under a numeric project, `//iam.googleapis.com/projects/<number>/locations/global/workloadIdentityPools/<pool>/providers/<provider>`. Workforce identity pools aren't supported. |
4949| **Service account to act as** | Optional. A service account, `<name>@<project>.iam.gserviceaccount.com`. Default compute and App Engine service accounts aren't accepted. Leave it empty to call Google Cloud as the federated identity itself. |
5050| **Allowed Google hosts** | `googleapis.com`, a subdomain of it, or a subdomain of `clients6.google.com`. |
51| OAuth scope | `https://www.googleapis.com/auth/cloud-platform`, always, with no setting to change it. On Google Cloud APIs, IAM decides what the credential can do. An API that needs an OAuth scope of its own answers 403 whatever IAM allows; see [The cloud API answers 403 after a successful exchange](/docs/claude-tag/admins/federated-access/troubleshooting.md#the-cloud-api-answers-403-after-a-successful-exchange). |
51| OAuth scope | `https://www.googleapis.com/auth/cloud-platform`, always, with no setting to change it. On Google Cloud APIs, IAM decides what the credential can do. An API that needs an OAuth scope of its own answers 403 whatever IAM allows; see [The cloud API answers 403 after a successful exchange](https://claude.com/docs/claude-tag/admins/federated-access/troubleshooting.md#the-cloud-api-answers-403-after-a-successful-exchange). |
5252| **Block requests that mint new credentials** | On by default. When on, requests to Google's credential-minting and credential-delivering endpoints are refused, including over gRPC; see [What the credential-minting block refuses](#what-the-credential-minting-block-refuses). The block is best effort and doesn't replace least-privilege IAM. |
5353| Google Cloud connections in one bundle | No two Google Cloud connections in the same bundle can cover the same host under **Allowed hosts**, whatever their providers or service accounts. A wildcard such as `*.googleapis.com` covers every subdomain but not `googleapis.com` itself. The same provider can be connected again with different hosts, or in another bundle. |
5454
from line 89
8989
9090## Related resources
9191
92* [Identity token reference](/docs/claude-tag/admins/federated-access/token-reference.md): claims, issuer, keys, and rotation
93* [Connect a gateway](/docs/claude-tag/admins/federated-access/connect-a-gateway.md)
94* [Connect an AWS role](/docs/claude-tag/admins/federated-access/aws.md)
95* [Connect a Google Cloud identity](/docs/claude-tag/admins/federated-access/gcp.md)
96* [Connect an authorization server](/docs/claude-tag/admins/federated-access/authorization-server.md)
97* [Network requirements](/docs/claude-tag/admins/network-requirements.md): Anthropic's egress range and internet reachability
92* [Identity token reference](https://claude.com/docs/claude-tag/admins/federated-access/token-reference.md): claims, issuer, keys, and rotation
93* [Connect a gateway](https://claude.com/docs/claude-tag/admins/federated-access/connect-a-gateway.md)
94* [Connect an AWS role](https://claude.com/docs/claude-tag/admins/federated-access/aws.md)
95* [Connect a Google Cloud identity](https://claude.com/docs/claude-tag/admins/federated-access/gcp.md)
96* [Connect an authorization server](https://claude.com/docs/claude-tag/admins/federated-access/authorization-server.md)
97* [Network requirements](https://claude.com/docs/claude-tag/admins/network-requirements.md): Anthropic's egress range and internet reachability
9898
claude-tag/admins/federated-access/overview Changed · +17 / -17 lines
from line 10
1010>
1111> Federated connections are managed on the [**Federated agent access**](https://claude.ai/admin-settings/claude-tag/federated-cloud-access) page, under **Claude Tag** in the admin settings sidebar. Connecting a gateway, cloud role, or authorization server needs an organization Owner, or an admin with full Claude Tag management permission.
1212
13In Slack channels, Claude Tag acts under its own [agent identity](/docs/claude-tag/concepts/agent-identity.md) rather than as any person. Federated agent access lets that identity prove itself to your systems with a short-lived, signed identity token instead of a credential you store in Claude.
13In Slack channels, Claude Tag acts under its own [agent identity](https://claude.com/docs/claude-tag/concepts/agent-identity.md) rather than as any person. Federated agent access lets that identity prove itself to your systems with a short-lived, signed identity token instead of a credential you store in Claude.
1414
15In the console, you connect your gateway, AWS role, Google Cloud identity, or authorization server under **Federated agent access**, add it to a [bundle](/docs/claude-tag/concepts/glossary.md#access-bundle), and [apply it to the channels](#manage-federated-connections-on-the-connectors-tab) where Claude should use it. Your cloud or gateway administrator configures that system to trust Anthropic's issuer and to check that each token's subject belongs to your organization, and the system then decides what the agent may do. To confirm the connection works, ask Claude in one of those channels to make a small request, then check its reply and your system's logs.
15In the console, you connect your gateway, AWS role, Google Cloud identity, or authorization server under **Federated agent access**, add it to a [bundle](https://claude.com/docs/claude-tag/concepts/glossary.md#access-bundle), and [apply it to the channels](#manage-federated-connections-on-the-connectors-tab) where Claude should use it. Your cloud or gateway administrator configures that system to trust Anthropic's issuer and to check that each token's subject belongs to your organization, and the system then decides what the agent may do. To confirm the connection works, ask Claude in one of those channels to make a small request, then check its reply and your system's logs.
1616
1717Federated agent access goes one way: Claude proves who it is to your systems. For your workloads proving who they are to the Claude API, see [Workload Identity Federation](https://platform.claude.com/docs/en/manage-claude/workload-identity-federation) on the Claude Developer Platform.
1818
from line 27
2727| **Google Cloud identity** | Google Cloud, through a workload identity pool. Google issues an access token for the federated identity, acting as a service account if you name one. | Claude should call Google Cloud APIs under an identity you govern with IAM. |
2828| **Authorization server** | Your OAuth 2.0 authorization server. It accepts the token as a JWT bearer grant (RFC 7523) and returns an access token for your APIs. | Your APIs are already protected by your own OAuth server and you'd rather issue its tokens than run a gateway. |
2929
30In every case the system on your side decides what the agent may do in your systems. Each connection type has its own setup page: [Connect a gateway](/docs/claude-tag/admins/federated-access/connect-a-gateway.md), [Connect an AWS role](/docs/claude-tag/admins/federated-access/aws.md), [Connect a Google Cloud identity](/docs/claude-tag/admins/federated-access/gcp.md), and [Connect an authorization server](/docs/claude-tag/admins/federated-access/authorization-server.md).
30In every case the system on your side decides what the agent may do in your systems. Each connection type has its own setup page: [Connect a gateway](https://claude.com/docs/claude-tag/admins/federated-access/connect-a-gateway.md), [Connect an AWS role](https://claude.com/docs/claude-tag/admins/federated-access/aws.md), [Connect a Google Cloud identity](https://claude.com/docs/claude-tag/admins/federated-access/gcp.md), and [Connect an authorization server](https://claude.com/docs/claude-tag/admins/federated-access/authorization-server.md).
3131
3232## How it works
3333
341. When a request from Claude's sandbox needs one of your systems, [Agent Proxy](/docs/claude-tag/concepts/agent-identity.md#agent-proxy) matches it by destination to a federated connection that applies to the channel. Until an admin connects a system in **Federated agent access** and applies the connection to the channel, nothing matches and no token is issued for Claude's requests.
341. When a request from Claude's sandbox needs one of your systems, [Agent Proxy](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy) matches it by destination to a federated connection that applies to the channel. Until an admin connects a system in **Federated agent access** and applies the connection to the channel, nothing matches and no token is issued for Claude's requests.
35352. Anthropic issues an identity token. The token is a JSON Web Token (JWT) signed by Anthropic and valid for 10 minutes. Its subject names your organization and the agent, in the form `wimse://identity.anthropic.com/org/<your organization ID>/agent/<agent ID>`, and its audience names the destination. Claude reuses one token for a session's requests to the same gateway for about five minutes, or until the gateway answers 401, and then requests a new one. The other connection types use a token once, in an exchange.
36363. Your side accepts the token. A gateway verifies it directly. AWS or Google Cloud exchanges it for a short-lived cloud credential. Your authorization server exchanges it for an access token. Agent Proxy attaches the result to Claude's request, or signs the request with it for AWS, and forwards the request. The model and the sandbox are never given the token or the credential that comes back.
3737
from line 42
4242* **Expiry**. This proves the token is fresh.
4343* **Subject**. This is what names your organization. Every Claude Tag organization's tokens come from the same issuer, and every organization's AWS tokens share the same audience, so the first four checks can pass for a token that belongs to someone else. Every connection type therefore requires a subject check. The strongest form accepts only the exact subjects of your own agents. The minimum form requires the subject to start with your **Subject prefix**, `wimse://identity.anthropic.com/org/<your organization ID>/agent/`, including the `/agent/`; a gateway, authorization server, or Google Cloud attribute condition can pin `iss` and `tenant` instead, since `tenant` carries the same organization ID.
4444
45The console shows the issuer, the signing-key location, and your **Subject prefix** with copy buttons, and each setup page says where they go. The [identity token reference](/docs/claude-tag/admins/federated-access/token-reference.md) lists every value and claim and [compares the two forms of the subject check](/docs/claude-tag/admins/federated-access/token-reference.md#authorize-on-the-subject).
45The console shows the issuer, the signing-key location, and your **Subject prefix** with copy buttons, and each setup page says where they go. The [identity token reference](https://claude.com/docs/claude-tag/admins/federated-access/token-reference.md) lists every value and claim and [compares the two forms of the subject check](https://claude.com/docs/claude-tag/admins/federated-access/token-reference.md#authorize-on-the-subject).
4646
47Anthropic stores no long-lived credential for your systems, and each call carries a short-lived signed token, so there is no key of yours to rotate or leak. Anthropic rotates its own signing keys, and the [token reference](/docs/claude-tag/admins/federated-access/token-reference.md#key-rotation) says how a verifier follows them.
47Anthropic stores no long-lived credential for your systems, and each call carries a short-lived signed token, so there is no key of yours to rotate or leak. Anthropic rotates its own signing keys, and the [token reference](https://claude.com/docs/claude-tag/admins/federated-access/token-reference.md#key-rotation) says how a verifier follows them.
4848
4949To cut off access, remove the connection in the console. These lifetimes then apply:
5050
from line 63
6363* **Federated agent access** appears under **Claude Tag** in the console's left navigation. It's missing for organizations whose compliance configuration excludes federated agent access.
6464* An organization Owner, or an admin with full Claude Tag management permission, makes the connection in the console.
6565* Your cloud or gateway administrator configures the system on your side: the gateway operator, your AWS or Google Cloud IAM administrator, or your authorization server's operator. Each setup page lists the values they configure.
66* You know which channels, workspaces, or all of Slack Claude should use the connection in. A connection applies wherever its [bundle](/docs/claude-tag/concepts/glossary.md#access-bundle) applies. A gateway can also be added to more than one bundle; an AWS role or authorization server is connected in one bundle only.
66* You know which channels, workspaces, or all of Slack Claude should use the connection in. A connection applies wherever its [bundle](https://claude.com/docs/claude-tag/concepts/glossary.md#access-bundle) applies. A gateway can also be added to more than one bundle; an AWS role or authorization server is connected in one bundle only.
6767
68Federated connections work in Slack channels, where Claude acts under your organization's agent identity. They don't work in one-to-one direct messages from members who have connected a Claude account, which run under [the individual's own account](/docs/claude-tag/concepts/agent-identity.md#direct-message-channels).
68Federated connections work in Slack channels, where Claude acts under your organization's agent identity. They don't work in one-to-one direct messages from members who have connected a Claude account, which run under [the individual's own account](https://claude.com/docs/claude-tag/concepts/agent-identity.md#direct-message-channels).
6969
7070## Manage federated connections on the Connectors tab
7171
from line 73
7373
7474The connection then also appears as a connector on the **Connectors** tab under **Claude's access** at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), where the tab's search finds it by name or host and its row in the connector's **Access from** table shows its type in the **Credential** column. Manage it from there:
7575
76* **Choose where it applies**: a bundle you create in the connect dialog applies nowhere until you choose places. The bundle is listed on the **Bundles** tab, where you add places under **Where it applies** and click **Save changes**. To choose places from the connector's page instead, see [Give Claude access](/docs/claude-tag/admins/add-connections.md).
76* **Choose where it applies**: a bundle you create in the connect dialog applies nowhere until you choose places. The bundle is listed on the **Bundles** tab, where you add places under **Where it applies** and click **Save changes**. To choose places from the connector's page instead, see [Give Claude access](https://claude.com/docs/claude-tag/admins/add-connections.md).
7777* **Edit its allowed hosts**: in the connector's **Access from** table, open the connection's **⋮** menu and choose **Edit** to open the **Edit connection** dialog.
7878* **Delete it from its bundle**: open the connection's bundle from the **Bundles** tab, and under **What's in it** choose **Remove credential** from the connection's **⋮** menu, then click **Delete** to confirm. The **Set by** column of the connector's **Access from** table names that bundle.
7979
8080## Related resources
8181
82* [How agent identity works](/docs/claude-tag/concepts/agent-identity.md): the identity these tokens represent, and how Agent Proxy attaches credentials
83* [Connect a gateway](/docs/claude-tag/admins/federated-access/connect-a-gateway.md): verify the token at a service you run
84* [Connect an AWS role](/docs/claude-tag/admins/federated-access/aws.md): the IAM OIDC provider and trust policy
85* [Connect a Google Cloud identity](/docs/claude-tag/admins/federated-access/gcp.md): the workload identity pool, provider, and attribute condition
86* [Connect an authorization server](/docs/claude-tag/admins/federated-access/authorization-server.md): accept the token as a JWT bearer grant
87* [Identity token reference](/docs/claude-tag/admins/federated-access/token-reference.md): every claim, the lifetime, and key rotation
88* [Limits](/docs/claude-tag/admins/federated-access/limits.md): counts, lengths, lifetimes, and unsupported configurations
89* [Troubleshoot federated agent access](/docs/claude-tag/admins/federated-access/troubleshooting.md): console messages, blocked requests, and rejections in your logs
82* [How agent identity works](https://claude.com/docs/claude-tag/concepts/agent-identity.md): the identity these tokens represent, and how Agent Proxy attaches credentials
83* [Connect a gateway](https://claude.com/docs/claude-tag/admins/federated-access/connect-a-gateway.md): verify the token at a service you run
84* [Connect an AWS role](https://claude.com/docs/claude-tag/admins/federated-access/aws.md): the IAM OIDC provider and trust policy
85* [Connect a Google Cloud identity](https://claude.com/docs/claude-tag/admins/federated-access/gcp.md): the workload identity pool, provider, and attribute condition
86* [Connect an authorization server](https://claude.com/docs/claude-tag/admins/federated-access/authorization-server.md): accept the token as a JWT bearer grant
87* [Identity token reference](https://claude.com/docs/claude-tag/admins/federated-access/token-reference.md): every claim, the lifetime, and key rotation
88* [Limits](https://claude.com/docs/claude-tag/admins/federated-access/limits.md): counts, lengths, lifetimes, and unsupported configurations
89* [Troubleshoot federated agent access](https://claude.com/docs/claude-tag/admins/federated-access/troubleshooting.md): console messages, blocked requests, and rejections in your logs
9090
claude-tag/admins/federated-access/token-reference Changed · +7 / -7 lines
from line 8
88
99When Claude calls a system you connected through Federated agent access, it proves who it is with a signed identity token instead of a stored credential. The token is a JSON Web Token (JWT) that names your organization and the agent making the request. A gateway you run receives it in the `Authorization: Bearer` header and verifies it directly. AWS, Google Cloud, or your authorization server receives it in a token exchange and returns one of its own credentials.
1010
11This page lists what the token contains so the engineer who configures the verifying side can pin the right values. For setup steps, see [Connect a gateway](/docs/claude-tag/admins/federated-access/connect-a-gateway.md), [Connect an AWS role](/docs/claude-tag/admins/federated-access/aws.md), [Connect a Google Cloud identity](/docs/claude-tag/admins/federated-access/gcp.md), or [Connect an authorization server](/docs/claude-tag/admins/federated-access/authorization-server.md).
11This page lists what the token contains so the engineer who configures the verifying side can pin the right values. For setup steps, see [Connect a gateway](https://claude.com/docs/claude-tag/admins/federated-access/connect-a-gateway.md), [Connect an AWS role](https://claude.com/docs/claude-tag/admins/federated-access/aws.md), [Connect a Google Cloud identity](https://claude.com/docs/claude-tag/admins/federated-access/gcp.md), or [Connect an authorization server](https://claude.com/docs/claude-tag/admins/federated-access/authorization-server.md).
1212
1313## Issuer and signing keys
1414
from line 51
5151* The organization ID starts with `org_` and the agent ID with `cagt_`. Both use only letters, digits, `_`, and `-`, so neither can contain `/` or `:`.
5252* The **Connect a gateway**, **Connect an AWS role**, **Connect a Google Cloud identity**, and **Connect an authorization server** dialogs show your organization's **Subject prefix**, `wimse://identity.anthropic.com/org/<your organization ID>/agent/`. Every one of your agents' subjects starts with this prefix.
5353* An agent belongs to one Slack channel. Deleting and recreating a channel creates a new agent with a new ID. The console doesn't show agent IDs; a verifier learns full subjects from the tokens it receives or from your cloud provider's logs.
54* The console's connection check for a gateway presents a token for a reserved test agent in your organization, shown in the **Connect a gateway** dialog as the **Control subject**. Your gateway must answer that token with a 2xx status so the check can pass, and must grant that subject no access. See [Connect a gateway](/docs/claude-tag/admins/federated-access/connect-a-gateway.md).
54* The console's connection check for a gateway presents a token for a reserved test agent in your organization, shown in the **Connect a gateway** dialog as the **Control subject**. Your gateway must answer that token with a 2xx status so the check can pass, and must grant that subject no access. See [Connect a gateway](https://claude.com/docs/claude-tag/admins/federated-access/connect-a-gateway.md).
5555
5656The `wimse://` form follows the IETF WIMSE working group's workload identifier specification.
5757
from line 149
149149
150150## Related resources
151151
152* [Connect a gateway](/docs/claude-tag/admins/federated-access/connect-a-gateway.md): verify the token yourself at a service you run
153* [Connect an AWS role](/docs/claude-tag/admins/federated-access/aws.md): the trust policy that pins these values
154* [Connect a Google Cloud identity](/docs/claude-tag/admins/federated-access/gcp.md): the attribute condition that pins these values
155* [Connect an authorization server](/docs/claude-tag/admins/federated-access/authorization-server.md): accept the token as a JWT bearer grant
156* [Limits](/docs/claude-tag/admins/federated-access/limits.md): lengths, counts, and lifetimes in one place
152* [Connect a gateway](https://claude.com/docs/claude-tag/admins/federated-access/connect-a-gateway.md): verify the token yourself at a service you run
153* [Connect an AWS role](https://claude.com/docs/claude-tag/admins/federated-access/aws.md): the trust policy that pins these values
154* [Connect a Google Cloud identity](https://claude.com/docs/claude-tag/admins/federated-access/gcp.md): the attribute condition that pins these values
155* [Connect an authorization server](https://claude.com/docs/claude-tag/admins/federated-access/authorization-server.md): accept the token as a JWT bearer grant
156* [Limits](https://claude.com/docs/claude-tag/admins/federated-access/limits.md): lengths, counts, and lifetimes in one place
157157* [Sample gateway](https://github.com/anthropics/claude-tag-wif-gateway-sample): a Python gateway that verifies the token and pins subjects exactly or by organization, with offline tests
158158
claude-tag/admins/federated-access/troubleshooting Changed · +22 / -22 lines
from line 10
1010>
1111> Federated connections are managed on the [**Federated agent access**](https://claude.ai/admin-settings/claude-tag/federated-cloud-access) page, under **Claude Tag** in the admin settings sidebar. Changing them needs an organization Owner, or an admin with full Claude Tag management permission.
1212
13This page covers what goes wrong after you connect a gateway, AWS role, Google Cloud identity, or authorization server through **Federated agent access**. It's organized by where the problem shows up: a message in a console dialog, an error Claude reports in the thread, or a rejection in your own logs. The token terms used below are explained on the [identity token reference](/docs/claude-tag/admins/federated-access/token-reference.md).
13This page covers what goes wrong after you connect a gateway, AWS role, Google Cloud identity, or authorization server through **Federated agent access**. It's organized by where the problem shows up: a message in a console dialog, an error Claude reports in the thread, or a rejection in your own logs. The token terms used below are explained on the [identity token reference](https://claude.com/docs/claude-tag/admins/federated-access/token-reference.md).
1414
1515First confirm two things that have nothing to do with federation:
1616
17* The connection applies to the channel, as [Manage federated connections on the Connectors tab](/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab) describes. For a gateway, the scope's custom instructions also [name the gateway's address](/docs/claude-tag/admins/federated-access/connect-a-gateway.md#let-agents-reach-the-gateway), so Claude knows the gateway exists.
18* You tested in a new thread. A thread already running isn't told about a connection added after it started; ask Claude for the service by name, or send [`@Claude !restart`](/docs/claude-tag/users/commands#restart-a-stuck-or-wrong-context-session) in that thread.
17* The connection applies to the channel, as [Manage federated connections on the Connectors tab](https://claude.com/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab) describes. For a gateway, the scope's custom instructions also [name the gateway's address](https://claude.com/docs/claude-tag/admins/federated-access/connect-a-gateway.md#let-agents-reach-the-gateway), so Claude knows the gateway exists.
18* You tested in a new thread. A thread already running isn't told about a connection added after it started; ask Claude for the service by name, or send [`@Claude !restart`](https://claude.com/docs/claude-tag/users/commands#restart-a-stuck-or-wrong-context-session) in that thread.
1919
20If Claude reports that a host isn't allowed before any request is sent, see [Claude says a host isn't allowed](/docs/claude-tag/admins/troubleshooting.md#claude-says-a-host-isn%E2%80%99t-allowed-or-it-can%E2%80%99t-reach-the-internet).
20If Claude reports that a host isn't allowed before any request is sent, see [Claude says a host isn't allowed](https://claude.com/docs/claude-tag/admins/troubleshooting.md#claude-says-a-host-isn%E2%80%99t-allowed-or-it-can%E2%80%99t-reach-the-internet).
2121
2222## Messages in the console
2323
from line 32
3232| A dialog message containing "isn't enabled for your organization yet", or **Federated agent access** is missing under **Claude Tag** in the left navigation | Federated agent access isn't available to organizations whose compliance configuration excludes it. The navigation item is also hidden from channel managers and from admins whose Claude Tag permission covers specific channels only, because connecting a system needs full Claude Tag management permission. | Ask an organization Owner, or an admin with full Claude Tag management permission, to open the page. If it's missing for them too, your organization's compliance configuration excludes the feature. |
3333| "This organization has reached its limit of 5 gateways. Remove one to connect another." or, in the **Connect an authorization server** dialog, "…limit of 5 registered gateways, which includes token endpoints." | An organization can register 5 addresses. An authorization server's audience address, its **Issuer URL** value or its token endpoint, is also registered as a gateway, so it counts toward the same 5 and appears in the **Gateways** table marked "Used by a connected authorization server. Manage it from the Authorization servers section." An address is either a gateway or a token endpoint in your organization, not both. | In the **Gateways** table, click **Remove** in the row of a gateway you no longer use. To free an authorization server's row, click **Remove** in the server's row of the **Authorization servers** table first, then remove its address from the **Gateways** table. See [Removing and reconnecting a gateway](#removing-and-reconnecting-a-gateway). |
3434| "This gateway is already registered. Close this dialog and pick it from the list to add it to a bundle." | The address is already registered in your organization, and the dialog couldn't load its row to continue. This message is rare: entering a registered address normally runs the connection check again without changing the stored result, then moves on to the bundle step. | Click **Cancel**, then click **Add to bundle** (**Add to another bundle** on a row already in one) in the gateway's row of the **Gateways** table. |
35| "This role is already connected in the bundle `<bundle>`." or "This token endpoint is already connected in the bundle `<bundle>`." | An AWS role or token endpoint can be connected in only one bundle, and this one already is. | To use the connection in more channels, apply that bundle in more places instead. To move it, delete the connection from its bundle, as [Manage federated connections on the Connectors tab](/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab) describes. Then connect it again from its own dialog and pick the new bundle. |
36| "`<name>` already covers `<host>` in this bundle, so Claude would never use this connection for the hosts they share. Change the hosts or choose another bundle." in the **Connect a Google Cloud identity** dialog | Another Google Cloud connection in the bundle you chose already has that host under **Allowed hosts**, whatever its provider or service account. Claude uses the first connection in a bundle whose hosts match a request, so the new connection would never be used for the shared host. A wildcard such as `*.googleapis.com` covers every subdomain but not `googleapis.com` itself. The dialog won't connect until the overlap is gone. | Remove the shared host from the new connection's **Allowed Google hosts**, or choose another bundle. To give the host to the new connection instead, first narrow the existing one's **Allowed hosts** in its **Edit connection** dialog, as [Manage federated connections on the Connectors tab](/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab) describes. |
35| "This role is already connected in the bundle `<bundle>`." or "This token endpoint is already connected in the bundle `<bundle>`." | An AWS role or token endpoint can be connected in only one bundle, and this one already is. | To use the connection in more channels, apply that bundle in more places instead. To move it, delete the connection from its bundle, as [Manage federated connections on the Connectors tab](https://claude.com/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab) describes. Then connect it again from its own dialog and pick the new bundle. |
36| "`<name>` already covers `<host>` in this bundle, so Claude would never use this connection for the hosts they share. Change the hosts or choose another bundle." in the **Connect a Google Cloud identity** dialog | Another Google Cloud connection in the bundle you chose already has that host under **Allowed hosts**, whatever its provider or service account. Claude uses the first connection in a bundle whose hosts match a request, so the new connection would never be used for the shared host. A wildcard such as `*.googleapis.com` covers every subdomain but not `googleapis.com` itself. The dialog won't connect until the overlap is gone. | Remove the shared host from the new connection's **Allowed Google hosts**, or choose another bundle. To give the host to the new connection instead, first narrow the existing one's **Allowed hosts** in its **Edit connection** dialog, as [Manage federated connections on the Connectors tab](https://claude.com/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab) describes. |
3737| "Couldn't connect the gateway. Try again.", "Couldn't add the gateway to the bundle.", "Couldn't connect the role. Try again.", "Couldn't connect the identity. Try again.", "Couldn't register the authorization server. Try again.", or "Couldn't connect the authorization server. Try again." | The request failed for a reason the dialog doesn't name, most often a temporary one. | Try once more. If the message persists, contact your Anthropic account team with the details under [Contact Anthropic](#contact-anthropic). |
3838| "The issuer URL must be an https URL on the same host as the token endpoint. Leave it empty to use the token endpoint as the audience." in the **Connect an authorization server** dialog | The **Issuer URL** value must be an HTTPS URL on the same host as the token endpoint, or empty. The token is only ever presented to that server, so its audience must name that server. | Enter the issuer identifier your authorization server uses, on the token endpoint's host, or clear the field to use the token endpoint as the audience. |
3939| "This token endpoint is already connected. Manage it from the Authorization servers section." in the **Connect an authorization server** dialog | An authorization server with this token endpoint is already connected in one of your organization's bundles, and a server can be connected only once. The dialog checks this before it registers anything. | To use the server in more channels, apply its bundle in more places. To connect it again, remove it first: in the **Authorization servers** table, click **Remove** in the server's row. |
40| "That address is already connected as a gateway. Enter your authorization server's own addresses, or remove the gateway first." in the **Connect an authorization server** dialog | The token endpoint, or the **Issuer URL** value, is the address of a gateway connected in one of your organization's bundles. One address can't be both, because a token sent to the gateway could be replayed to the server as a grant. | Enter the token endpoint and issuer identifier your authorization server publishes. To use that address for the server instead, remove the gateway first: delete the gateway's connection from its bundle, as [Manage federated connections on the Connectors tab](/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab) describes. Then, in the **Gateways** table under **Federated agent access**, click **Remove** in the gateway's row. |
40| "That address is already connected as a gateway. Enter your authorization server's own addresses, or remove the gateway first." in the **Connect an authorization server** dialog | The token endpoint, or the **Issuer URL** value, is the address of a gateway connected in one of your organization's bundles. One address can't be both, because a token sent to the gateway could be replayed to the server as a grant. | Enter the token endpoint and issuer identifier your authorization server publishes. To use that address for the server instead, remove the gateway first: delete the gateway's connection from its bundle, as [Manage federated connections on the Connectors tab](https://claude.com/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab) describes. Then, in the **Gateways** table under **Federated agent access**, click **Remove** in the gateway's row. |
4141| "That address is registered by a connected authorization server. Enter your gateway's address, or remove the server first." in the **Connect a gateway** dialog | The address you entered is a connected authorization server's token endpoint or audience, for example a server whose **Issuer URL** is the bare host `https://auth.example.com`. One address can't be both, because a token sent to the gateway could be replayed to that server as a grant. | Enter the host your gateway answers on. To use that address for a gateway instead, remove the server first: in the **Authorization servers** table, click **Remove** in the server's row. |
4242| "That address is already a connected authorization server's audience. Enter this server's own issuer URL." in the **Connect an authorization server** dialog | The **Issuer URL** value (or the token endpoint, when **Issuer URL** is empty) is already another connected authorization server's audience or token endpoint. Two servers can't share an audience, because a token minted for one would be valid at the other. | In the **Issuer URL** field, enter the issuer identifier this server publishes. If the other server holds this identifier by mistake, remove that server first: in the **Authorization servers** table, click **Remove** in its row, then connect it again with its own issuer URL. |
4343| "The address is too long. Issuer URLs have at most 256 characters." under the **Issuer URL** field of the **Connect an authorization server** dialog | The **Issuer URL** field accepts at most 256 characters, the same limit as the **Token endpoint** field. | Check that the field holds only the issuer identifier, for example `https://auth.example.com`, and not a longer value pasted by mistake. |
from line 89
8989
9090**What it means**
9191
92Federated connections work only in agent sessions, such as a Slack channel, where Claude acts under your organization's [agent identity](/docs/claude-tag/concepts/agent-identity.md). The request came from a personal session, such as a [direct message](/docs/claude-tag/concepts/agent-identity.md#direct-message-channels) with `@Claude`. A personal session runs under a person's own account and has no agent identity for the token to name.
92Federated connections work only in agent sessions, such as a Slack channel, where Claude acts under your organization's [agent identity](https://claude.com/docs/claude-tag/concepts/agent-identity.md). The request came from a personal session, such as a [direct message](https://claude.com/docs/claude-tag/concepts/agent-identity.md#direct-message-channels) with `@Claude`. A personal session runs under a person's own account and has no agent identity for the token to name.
9393
9494**How to resolve**
9595
from line 107
107107
108108**How to resolve**
109109
110To keep the gateway, register the same address again; see [Removing and reconnecting a gateway](#removing-and-reconnecting-a-gateway). To drop it, delete the connection from its bundle, as [Manage federated connections on the Connectors tab](/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab) describes.
110To keep the gateway, register the same address again; see [Removing and reconnecting a gateway](#removing-and-reconnecting-a-gateway). To drop it, delete the connection from its bundle, as [Manage federated connections on the Connectors tab](https://claude.com/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab) describes.
111111
112112### Claude says Google credentials are not enabled for this organization
113113
from line 163
163163
164164**How to resolve**
165165
166Open the connection's **Edit connection** dialog, as [Manage federated connections on the Connectors tab](/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab) describes, and set **Allowed hosts** to only the APIs Claude calls with the returned token, for example `api.example.com`, with no wildcard that covers the token endpoint's host. If the API and the token endpoint share a host, use a different host for one of them, or [remove the server](/docs/claude-tag/admins/federated-access/authorization-server.md#remove-the-server) and connect it again with **Allowed API paths** listed.
166Open the connection's **Edit connection** dialog, as [Manage federated connections on the Connectors tab](https://claude.com/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab) describes, and set **Allowed hosts** to only the APIs Claude calls with the returned token, for example `api.example.com`, with no wildcard that covers the token endpoint's host. If the API and the token endpoint share a host, use a different host for one of them, or [remove the server](https://claude.com/docs/claude-tag/admins/federated-access/authorization-server.md#remove-the-server) and connect it again with **Allowed API paths** listed.
167167
168168### credential injection temporarily unavailable; retry the request
169169
from line 209
209209
210210**What it means**
211211
212The sign-in worked, but [Agent Proxy](/docs/claude-tag/concepts/agent-identity.md#agent-proxy) couldn't sign the request with the role's credentials, so it never left for AWS. The reason text after the connection name says which of these applies:
212The sign-in worked, but [Agent Proxy](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy) couldn't sign the request with the role's credentials, so it never left for AWS. The reason text after the connection name says which of these applies:
213213
214* **A hostname with no usable region.** Agent Proxy reads the AWS service and signing region from the hostname, so the region must be the last label before `amazonaws.com`, as in `service.region.amazonaws.com`, `my-bucket.s3.us-east-1.amazonaws.com`, or `api.ecr.us-east-1.amazonaws.com`. The [AWS SigV4 credential](/docs/claude-tag/admins/connections/custom.md#aws-sigv4) section lists the hostname forms Agent Proxy signs, including the services it signs with no region.
214* **A hostname with no usable region.** Agent Proxy reads the AWS service and signing region from the hostname, so the region must be the last label before `amazonaws.com`, as in `service.region.amazonaws.com`, `my-bucket.s3.us-east-1.amazonaws.com`, or `api.ecr.us-east-1.amazonaws.com`. The [AWS SigV4 credential](https://claude.com/docs/claude-tag/admins/connections/custom.md#aws-sigv4) section lists the hostname forms Agent Proxy signs, including the services it signs with no region.
215215* **A large request to a service other than S3 with no content hash.** When a request has no `x-amz-content-sha256` header, Agent Proxy hashes the body before signing and refuses a body over 1 MB (1,048,576 bytes). The AWS CLI and SDKs add that header for S3 but usually not for other services.
216216* **An S3 upload with signed chunks.** Agent Proxy signs the uploads the AWS CLI and SDKs send by default, including an upload sent in chunks with a checksum trailer. It can't sign an upload whose chunks the client signs one by one, which the CLI and SDKs do only when payload signing is turned on for the profile. The reason text reads `chunked signing (<mode>) is not supported through the proxy`.
217217
from line 241
241241**How to resolve**
242242
243243* **A missing permission.** Grant the IAM permission to the AWS role, the Google Cloud service account, or the federated identity when no service account is named. For AWS, a 403 also makes Claude assume the role again on the next request, so a fix takes effect on the next try.
244* **A Google API that needs an OAuth scope of its own.** A federated connection can't reach that API. To connect Google Drive, Calendar, or Gmail another way, see [Choose OAuth or a service account](/docs/claude-tag/admins/connections/google.md#choose-oauth-or-a-service-account). If a channel gets both that connection and the federated connection, keep the two from covering the same host; see [Which credential wins](/docs/claude-tag/admins/attach-to-scope.md#which-credential-wins).
244* **A Google API that needs an OAuth scope of its own.** A federated connection can't reach that API. To connect Google Drive, Calendar, or Gmail another way, see [Choose OAuth or a service account](https://claude.com/docs/claude-tag/admins/connections/google.md#choose-oauth-or-a-service-account). If a channel gets both that connection and the federated connection, keep the two from covering the same host; see [Which credential wins](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#which-credential-wins).
245245
246246## Rejections in your own logs
247247
from line 253
253253
254254**What it means**
255255
256One of the standard checks is configured with the wrong value. Your gateway's log of the failing check is the fastest route; if it logs nothing, work down the list. The values to compare against are shown in the **Connect a gateway** dialog before you enter an address, as described on [Connect a gateway](/docs/claude-tag/admins/federated-access/connect-a-gateway.md#copy-the-values-and-deploy-the-gateway).
256One of the standard checks is configured with the wrong value. Your gateway's log of the failing check is the fastest route; if it logs nothing, work down the list. The values to compare against are shown in the **Connect a gateway** dialog before you enter an address, as described on [Connect a gateway](https://claude.com/docs/claude-tag/admins/federated-access/connect-a-gateway.md#copy-the-values-and-deploy-the-gateway).
257257
258258**How to resolve**
259259
from line 325
325325
326326**How to resolve**
327327
328Google records the reason in your Cloud Audit Logs. The Security Token Service API entry covers the token exchange, and, if you named a service account, the IAM Service Account Credentials API entry covers the impersonation. Both are Data Access audit logs, which Google keeps off by default, as described under [Verify the connection](/docs/claude-tag/admins/federated-access/gcp.md#verify-the-connection). If the logs were on and show no entry at the time of the request, the token wasn't issued; see [injection failed](#injection-failed). Otherwise, work through the checks in order.
328Google records the reason in your Cloud Audit Logs. The Security Token Service API entry covers the token exchange, and, if you named a service account, the IAM Service Account Credentials API entry covers the impersonation. Both are Data Access audit logs, which Google keeps off by default, as described under [Verify the connection](https://claude.com/docs/claude-tag/admins/federated-access/gcp.md#verify-the-connection). If the logs were on and show no entry at the time of the request, the token wasn't issued; see [injection failed](#injection-failed). Otherwise, work through the checks in order.
329329
330330| Check | What to confirm |
331331| :- | :- |
from line 368
368368
369369## Related resources
370370
371* [Federated agent access overview](/docs/claude-tag/admins/federated-access/overview): how the token works and which connection type to use
372* [Connect a gateway](/docs/claude-tag/admins/federated-access/connect-a-gateway.md): the setup steps and the connection check in full
373* [Identity token reference](/docs/claude-tag/admins/federated-access/token-reference.md): every claim, the lifetime, and key rotation
374* [Limits](/docs/claude-tag/admins/federated-access/limits.md): counts, lengths, and lifetimes
375* [Troubleshoot Claude Tag setup](/docs/claude-tag/admins/troubleshooting.md): errors outside federated agent access
371* [Federated agent access overview](https://claude.com/docs/claude-tag/admins/federated-access/overview): how the token works and which connection type to use
372* [Connect a gateway](https://claude.com/docs/claude-tag/admins/federated-access/connect-a-gateway.md): the setup steps and the connection check in full
373* [Identity token reference](https://claude.com/docs/claude-tag/admins/federated-access/token-reference.md): every claim, the lifetime, and key rotation
374* [Limits](https://claude.com/docs/claude-tag/admins/federated-access/limits.md): counts, lengths, and lifetimes
375* [Troubleshoot Claude Tag setup](https://claude.com/docs/claude-tag/admins/troubleshooting.md): errors outside federated agent access
376376
claude-tag/admins/for-slack-admins Changed · +9 / -9 lines
from line 16
1616
1717* Invite it with `/invite @Claude` in the channel
1818* Select **Add to channel** on a channel Claude suggests in a direct message. Claude's welcome message, the introduction it posts when a member first opens a direct message with it, suggests public channels this way.
19* Select **Approve and post** on a message Claude drafts in a direct message for a public channel it isn't a member of. When the member approves, Claude posts the message and joins that channel. [What Claude can do in other channels](/docs/claude-tag/concepts/how-it-works.md#what-claude-can-do-in-other-channels) covers the flow.
19* Select **Approve and post** on a message Claude drafts in a direct message for a public channel it isn't a member of. When the member approves, Claude posts the message and joins that channel. [What Claude can do in other channels](https://claude.com/docs/claude-tag/concepts/how-it-works.md#what-claude-can-do-in-other-channels) covers the flow.
2020* Select a channel in a weekly suggestion message. About once a week, Claude sends the person who connected the workspace a direct message that suggests public channels to add it to. That person can stop the suggestions from any of those messages.
2121
2222Claude picks the channels to suggest from public channel names, topics, and purposes, and from public-channel search. Claude doesn't join a channel to evaluate it.
2323
24A Claude organization Owner can also set [auto-join channel patterns](/docs/claude-tag/admins/restrict-access.md#block-or-auto-join-channels-by-name), so Claude joins a public channel whose name matches when the channel is created or renamed.
24A Claude organization Owner can also set [auto-join channel patterns](https://claude.com/docs/claude-tag/admins/restrict-access.md#block-or-auto-join-channels-by-name), so Claude joins a public channel whose name matches when the channel is created or renamed.
2525
2626When a member selects **Add to channel** or **Approve and post**, picks a channel in a suggestion message, or an auto-join pattern matches, Claude adds itself to that channel using its `channels:join` scope. Slack's audit log records the join as the Claude app, with no inviter shown; neither the member's selection nor the matched pattern is visible in Slack's log. If you see a join in the audit log that no one can explain, a member selected one of these buttons or an auto-join pattern matched. Outside these paths, Claude does not join channels on its own.
2727
2828Reading a channel's full history requires being added there. Workspace search can surface public-channel content, the same as any app with the search scope.
2929
30In a Slack Connect channel (shared with another company), Claude answers only where an Owner or a Claude Tag admin of your Claude organization has [turned it on](/docs/claude-tag/admins/restrict-access.md#slack-connect-channels), and then with [limited access](/docs/claude-tag/admins/restrict-access.md#what-access-claude-has-in-a-slack-connect-channel).
30In a Slack Connect channel (shared with another company), Claude answers only where an Owner or a Claude Tag admin of your Claude organization has [turned it on](https://claude.com/docs/claude-tag/admins/restrict-access.md#slack-connect-channels), and then with [limited access](https://claude.com/docs/claude-tag/admins/restrict-access.md#what-access-claude-has-in-a-slack-connect-channel).
3131
3232## Requested scopes
3333
from line 35
3535
3636Two scopes a Slack admin commonly asks about:
3737
38* `channels:join` lets Claude add itself to a public channel when a member selects one of its suggested-channel buttons, when a member approves a message it drafted in a direct message for that channel, or when the channel's name matches an [auto-join channel pattern](/docs/claude-tag/admins/restrict-access.md#block-or-auto-join-channels-by-name) an admin set. It cannot join private channels this way.
38* `channels:join` lets Claude add itself to a public channel when a member selects one of its suggested-channel buttons, when a member approves a message it drafted in a direct message for that channel, or when the channel's name matches an [auto-join channel pattern](https://claude.com/docs/claude-tag/admins/restrict-access.md#block-or-auto-join-channels-by-name) an admin set. It cannot join private channels this way.
3939* `users:read.email` lets Claude read a member's profile email. Claude uses it for checks such as the email domain when a member connects their Claude account. It does not connect accounts; a member still runs the Connect step in Slack.
4040
4141## What installing does not grant
4242
43Credentials for GitHub, Google Drive, a data warehouse, or anything else are provisioned separately by an Owner or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) of the Claude organization and live on Anthropic's side rather than in Slack.
43Credentials for GitHub, Google Drive, a data warehouse, or anything else are provisioned separately by an Owner or a [Claude Tag admin](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) of the Claude organization and live on Anthropic's side rather than in Slack.
4444
4545It responds when @-mentioned, and may respond to other messages it judges warrant a reply.
4646
from line 48
4848
4949Post `@Claude connect` in any channel with no other text, or send `connect` on its own in a direct message with Claude, and give the code it returns to whoever asked you to install. That code is what pairs your workspace to their Claude organization; it expires after 15 minutes.
5050
51Pick a channel that belongs to just your workspace. Claude can decline to reply in [guest and shared channels](/docs/claude-tag/admins/troubleshooting.md#guest-and-shared-channels).
51Pick a channel that belongs to just your workspace. Claude can decline to reply in [guest and shared channels](https://claude.com/docs/claude-tag/admins/troubleshooting.md#guest-and-shared-channels).
5252
5353## If you uninstall the app
5454
55Uninstalling the Claude app from your workspace removes it from Slack and deletes the workspace's Claude data on Anthropic's side, the same way [disconnecting the workspace](/docs/claude-tag/admins/workspaces.md#revoke-a-pairing) from the Claude console does. What Claude posted in Slack, such as messages, canvases, and files, stays in Slack under your workspace's own retention settings.
55Uninstalling the Claude app from your workspace removes it from Slack and deletes the workspace's Claude data on Anthropic's side, the same way [disconnecting the workspace](https://claude.com/docs/claude-tag/admins/workspaces.md#revoke-a-pairing) from the Claude console does. What Claude posted in Slack, such as messages, canvases, and files, stays in Slack under your workspace's own retention settings.
5656
5757On Enterprise Grid, this applies when the app was installed on an individual workspace and you uninstall it there. Removing an org-wide installation, from the whole grid or from one of its workspaces, doesn't delete data on its own; to delete it, ask an Owner of the Claude organization to disconnect the Grid in its Claude Tag settings.
5858
5959## Related resources
6060
61* [Security and data handling](/docs/claude-tag/concepts/security-and-data.md): where credentials are stored and what leaves your workspace
62* [Pair your Slack workspace](/docs/claude-tag/admins/setup-overview#pair-your-slack-workspace): what the Claude organization's Owner does with the code you send
61* [Security and data handling](https://claude.com/docs/claude-tag/concepts/security-and-data.md): where credentials are stored and what leaves your workspace
62* [Pair your Slack workspace](https://claude.com/docs/claude-tag/admins/setup-overview#pair-your-slack-workspace): what the Claude organization's Owner does with the code you send
6363
claude-tag/admins/healthcare Changed · +20 / -20 lines
from line 17
1717Claude reads Slack with the same visibility a member of your workspace has. In a Slack workspace connected to your Claude organization, Claude can:
1818
1919* Read and post in the channels it has been added to
20* Search every public channel by keyword, including public channels it hasn't been added to. [No admin setting turns this search off](/docs/claude-tag/admins/restrict-access.md#controls-that-aren%E2%80%99t-available). An Owner can [limit it to channels Claude is in](/docs/claude-tag/admins/restrict-access.md#limit-which-channels-claude-can-search).
20* Search every public channel by keyword, including public channels it hasn't been added to. [No admin setting turns this search off](https://claude.com/docs/claude-tag/admins/restrict-access.md#controls-that-aren%E2%80%99t-available). An Owner can [limit it to channels Claude is in](https://claude.com/docs/claude-tag/admins/restrict-access.md#limit-which-channels-claude-can-search).
2121* Read a private channel only after someone in that channel invites it
2222
23Claude never searches private channels. In a [Slack Connect channel](/docs/claude-tag/admins/restrict-access.md#slack-connect-channels), one your workspace shares with another company, Claude replies only where an Owner or a Claude Tag admin of your Claude organization has turned it on, and then with [limited access](/docs/claude-tag/admins/restrict-access.md#what-access-claude-has-in-a-slack-connect-channel).
23Claude never searches private channels. In a [Slack Connect channel](https://claude.com/docs/claude-tag/admins/restrict-access.md#slack-connect-channels), one your workspace shares with another company, Claude replies only where an Owner or a Claude Tag admin of your Claude organization has turned it on, and then with [limited access](https://claude.com/docs/claude-tag/admins/restrict-access.md#what-access-claude-has-in-a-slack-connect-channel).
2424
2525For a healthcare organization, the rule that follows is to keep PHI out of every public channel in the connected workspace, not only the channels where Claude responds, because Claude's keyword search reaches all of them by default. Keep PHI out of any private channel Claude has been invited to as well.
2626
27For how Claude's work in each thread is isolated, how connection credentials are held, and where network traffic can go, see [Security and data handling](/docs/claude-tag/concepts/security-and-data.md).
27For how Claude's work in each thread is isolated, how connection credentials are held, and where network traffic can go, see [Security and data handling](https://claude.com/docs/claude-tag/concepts/security-and-data.md).
2828
2929## Plan and organization requirements
3030
31Limiting Claude to approved channels needs an [Enterprise plan](https://claude.com/pricing), in addition to the [general prerequisites for Claude Tag](/docs/claude-tag/admins/setup-overview). The Enterprise plan has a [setting that turns Claude on or off for an individual channel](/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-and-set-the-version-for-a-scope).
31Limiting Claude to approved channels needs an [Enterprise plan](https://claude.com/pricing), in addition to the [general prerequisites for Claude Tag](https://claude.com/docs/claude-tag/admins/setup-overview). The Enterprise plan has a [setting that turns Claude on or off for an individual channel](https://claude.com/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-and-set-the-version-for-a-scope).
3232
33Claude Tag [isn't available in a Claude organization](/docs/claude-tag/concepts/security-and-data.md) that has any of these:
33Claude Tag [isn't available in a Claude organization](https://claude.com/docs/claude-tag/concepts/security-and-data.md) that has any of these:
3434
3535* Zero Data Retention (ZDR)
3636* Customer-managed encryption keys
from line 44
4444
4545**1. Turn Claude off by default**
4646
47Go to [**Claude's access > Channels > Slack**](https://claude.ai/admin-settings/claude-tag/channels/slack) and turn off the **Respond in all channels** switch at the top of the **General** tab. [Limit Claude Tag to specific channels](/docs/claude-tag/admins/restrict-access.md#limit-claude-tag-to-specific-channels) has the full procedure.
47Go to [**Claude's access > Channels > Slack**](https://claude.ai/admin-settings/claude-tag/channels/slack) and turn off the **Respond in all channels** switch at the top of the **General** tab. [Limit Claude Tag to specific channels](https://claude.com/docs/claude-tag/admins/restrict-access.md#limit-claude-tag-to-specific-channels) has the full procedure.
4848
4949**2. Reset workspaces and channels that have their own setting**
5050
from line 52
5252
5353**3. Turn Claude on in each approved channel**
5454
55On the **Channels** tab, open the approved channel's page and turn on its **Enable Claude Tag in this channel** switch. If the channel isn't listed on the **Channels** tab, [set it up](/docs/claude-tag/admins/attach-to-scope.md#attach-to-a-channel) first.
55On the **Channels** tab, open the approved channel's page and turn on its **Enable Claude Tag in this channel** switch. If the channel isn't listed on the **Channels** tab, [set it up](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#attach-to-a-channel) first.
5656
5757**4. Turn off direct messages**
5858
59On the same [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag) page, select **Edit** on the **Direct messages** row and turn off the [**Allow direct messages** toggle](/docs/claude-tag/admins/restrict-access.md#allow-or-disable-direct-messages). Claude is then reachable only in channels.
59On the same [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag) page, select **Edit** on the **Direct messages** row and turn off the [**Allow direct messages** toggle](https://claude.com/docs/claude-tag/admins/restrict-access.md#allow-or-disable-direct-messages). Claude is then reachable only in channels.
6060
6161**5. Block channel names that signal PHI**
6262
63Go to [**Claude's access > Channels > Slack**](https://claude.ai/admin-settings/claude-tag/channels/slack), open the **Advanced** tab, and under **Channels** add the naming patterns your workspace uses for clinical or patient channels to **Blocked channel patterns**, for example `*-patient-*`. Claude won't read or respond in a matching channel even if someone invites it. See [Block or auto-join channels by name](/docs/claude-tag/admins/restrict-access.md#block-or-auto-join-channels-by-name).
63Go to [**Claude's access > Channels > Slack**](https://claude.ai/admin-settings/claude-tag/channels/slack), open the **Advanced** tab, and under **Channels** add the naming patterns your workspace uses for clinical or patient channels to **Blocked channel patterns**, for example `*-patient-*`. Claude won't read or respond in a matching channel even if someone invites it. See [Block or auto-join channels by name](https://claude.com/docs/claude-tag/admins/restrict-access.md#block-or-auto-join-channels-by-name).
6464
6565Any member of the workspace can still invite `@Claude` to a channel that isn't approved. Claude stays silent there, and an @-mention gets a notice that Claude is disabled in that channel instead of a reply.
6666
67Only an Owner of your Claude organization or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) can change the **Respond in all channels** switch or an **Enable Claude Tag** switch, and only an Owner can change the **Allow direct messages** toggle. Give the **Claude Tag Admin** permission only to people you trust to approve a channel as PHI-free.
67Only an Owner of your Claude organization or a [Claude Tag admin](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) can change the **Respond in all channels** switch or an **Enable Claude Tag** switch, and only an Owner can change the **Allow direct messages** toggle. Give the **Claude Tag Admin** permission only to people you trust to approve a channel as PHI-free.
6868
6969## Connect only PHI-free tools
7070
71In a channel, Claude signs in to tools outside Slack only through Claude Tag connectors. The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](/docs/claude-tag/admins/add-connections.md#add-a-connection) before you add a connector.
71In a channel, Claude signs in to tools outside Slack only through Claude Tag connectors. The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](https://claude.com/docs/claude-tag/admins/add-connections.md#add-a-connection) before you add a connector.
7272
7373For a healthcare organization, apply these rules when deciding what to connect:
7474
from line 77
7777* Treat email and calendar as PHI-bearing unless your compliance team has confirmed otherwise, and leave them unconnected until then
7878* Add connectors inside bundles, and add each bundle to the approved channels that need it, not to the **Slack** page (whose settings apply to every channel in every connected workspace), so a connector never reaches a channel it wasn't reviewed for
7979
80Members' own claude.ai connectors, such as their email or calendar, are a separate path to tools outside Slack. In a one-to-one direct message from a member who has connected a Claude account, Claude works on that member's own Claude account and can use those connectors, so keep the **Allow direct messages** toggle off as described in [Limit Claude to PHI-free channels](#limit-claude-to-phi-free-channels). In channels, Claude can [use a member's own connectors for that member's requests](/docs/claude-tag/concepts/personal-connectors.md) after the member allows it, and no organization setting turns off personal connectors in channels entirely. These controls apply:
80Members' own claude.ai connectors, such as their email or calendar, are a separate path to tools outside Slack. In a one-to-one direct message from a member who has connected a Claude account, Claude works on that member's own Claude account and can use those connectors, so keep the **Allow direct messages** toggle off as described in [Limit Claude to PHI-free channels](#limit-claude-to-phi-free-channels). In channels, Claude can [use a member's own connectors for that member's requests](https://claude.com/docs/claude-tag/concepts/personal-connectors.md) after the member allows it, and no organization setting turns off personal connectors in channels entirely. These controls apply:
8181
8282* **Block a connector for everyone.** A connector you restrict for your organization on the [**Connectors** admin page](https://claude.ai/admin-settings/connectors) stays restricted when Claude uses a member's connectors in a channel.
8383* **Require human review.** On the Enterprise plan, go to [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), select **Edit** on the **Personal connectors** row, and turn on **Require human review of every message**, so a member reviews every result before it posts to the channel.
from line 93
9393
9494Claude keeps separate notes for each channel. From a public channel it can also save workspace notes, and those inform its replies in every channel in the workspace. Notes from a private channel stay in that channel's own store and aren't read anywhere else.
9595
96Anyone in a channel can ask Claude what it remembers there and tell it to correct or delete a note. An Owner can view, edit, and delete the memory notes of the workspace or of a channel. Go to [**Claude's access > Channels**](https://claude.ai/admin-settings/claude-tag?access=channels), open the workspace's page (or a channel's page, when that channel has memory of its own), open its **⋯** menu, and select **View memory files**. The **Memory** tab of the [**Activity** page](/docs/claude-tag/admins/audit.md) opens the same files.
96Anyone in a channel can ask Claude what it remembers there and tell it to correct or delete a note. An Owner can view, edit, and delete the memory notes of the workspace or of a channel. Go to [**Claude's access > Channels**](https://claude.ai/admin-settings/claude-tag?access=channels), open the workspace's page (or a channel's page, when that channel has memory of its own), open its **⋯** menu, and select **View memory files**. The **Memory** tab of the [**Activity** page](https://claude.com/docs/claude-tag/admins/audit.md) opens the same files.
9797
98By default, your Slack conversations with Claude aren't used to train Anthropic's models. Anthropic's [model training policy](https://privacy.anthropic.com/en/articles/7996885-how-do-you-use-personal-data-in-model-training) describes when data is used. Claude Tag data is kept until one of the admin actions in [Data lifecycle and deletion](/docs/claude-tag/concepts/data-lifecycle.md) deletes it, and during the beta you can't set a shorter retention period.
98By default, your Slack conversations with Claude aren't used to train Anthropic's models. Anthropic's [model training policy](https://privacy.anthropic.com/en/articles/7996885-how-do-you-use-personal-data-in-model-training) describes when data is used. Claude Tag data is kept until one of the admin actions in [Data lifecycle and deletion](https://claude.com/docs/claude-tag/concepts/data-lifecycle.md) deletes it, and during the beta you can't set a shorter retention period.
9999
100For the full list of what is stored and what each admin action deletes, see [Data lifecycle and deletion](/docs/claude-tag/concepts/data-lifecycle.md) and [What Claude Tag remembers](/docs/claude-tag/users/memory.md).
100For the full list of what is stored and what each admin action deletes, see [Data lifecycle and deletion](https://claude.com/docs/claude-tag/concepts/data-lifecycle.md) and [What Claude Tag remembers](https://claude.com/docs/claude-tag/users/memory.md).
101101
102102## If PHI is posted where Claude can read it
103103
from line 105
105105
1061061. Report it to your organization's HIPAA privacy officer and follow your incident process.
1071072. Delete the message in Slack.
1083. If the message was posted in a channel where Claude is turned on, have an Owner delete that channel's transcripts and memory immediately by [removing the channel's scope](/docs/claude-tag/concepts/data-lifecycle.md#delete-data-or-request-deletion). On the **Channels** tab under **Claude's access**, open the channel's page and choose **Remove this scope** from its **⋯** menu, if the menu lists it.
1083. If the message was posted in a channel where Claude is turned on, have an Owner delete that channel's transcripts and memory immediately by [removing the channel's scope](https://claude.com/docs/claude-tag/concepts/data-lifecycle.md#delete-data-or-request-deletion). On the **Channels** tab under **Claude's access**, open the channel's page and choose **Remove this scope** from its **⋯** menu, if the menu lists it.
1091094. If that channel is public, have an Owner also check the workspace's memory, because workspace notes Claude saved from that channel are stored with the workspace and aren't deleted with the channel's scope. On the **Channels** tab, open your workspace's page, choose **View memory files** from its **⋯** menu, and delete any note that contains the information. Deleting a note removes it from what Claude reads in every channel right away.
1101105. Email [[email protected]](mailto:[email protected]) to request deletion of the data Claude Tag retained that the admin controls in steps 3 and 4 don't delete, including the workspace's stored memory and any transcript in another channel whose session found the message through search. Include the workspace, the channel, and the time of the message.
111111
112Removing a channel's scope also turns Claude off in that channel, because the channel then inherits the off setting from the **Slack** page. To turn Claude back on later, [set the channel up again](/docs/claude-tag/admins/attach-to-scope.md#attach-to-a-channel) on the **Channels** tab and turn on its **Enable Claude Tag in this channel** switch.
112Removing a channel's scope also turns Claude off in that channel, because the channel then inherits the off setting from the **Slack** page. To turn Claude back on later, [set the channel up again](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#attach-to-a-channel) on the **Channels** tab and turn on its **Enable Claude Tag in this channel** switch.
113113
114114## Related resources
115115
116* [Restrict where Claude Tag operates](/docs/claude-tag/admins/restrict-access.md): every control that narrows where Claude responds and who can use it
117* [Security and data handling](/docs/claude-tag/concepts/security-and-data.md): sandbox isolation, credential handling, and network egress
118* [Data lifecycle and deletion](/docs/claude-tag/concepts/data-lifecycle.md): what Anthropic stores and how to delete it
116* [Restrict where Claude Tag operates](https://claude.com/docs/claude-tag/admins/restrict-access.md): every control that narrows where Claude responds and who can use it
117* [Security and data handling](https://claude.com/docs/claude-tag/concepts/security-and-data.md): sandbox isolation, credential handling, and network egress
118* [Data lifecycle and deletion](https://claude.com/docs/claude-tag/concepts/data-lifecycle.md): what Anthropic stores and how to delete it
119119
claude-tag/admins/managed-by Changed · +25 / -25 lines
from line 8
88
99**Managed by** is a channel setting that names other Slack channels whose members can write that channel's standing instructions for Claude. The channel that carries the setting is the managed channel, and each channel it names is a managing channel. People in a managing channel ask Claude to set or update the managed channel's instructions and confirm the change on a card, and Claude follows that text in every new conversation in the managed channel. This page is for admins who set up the pairing and for the people in a managing channel who write the instructions.
1010
11On the Enterprise plan, an Owner of your Claude organization or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) sets up **Managed by** on the **Admin** tab of a channel's Configure page. The Team plan doesn't have the **Admin** tab. [When to use Managed by](#when-to-use-managed-by) lists the other places to keep instructions for a channel.
11On the Enterprise plan, an Owner of your Claude organization or a [Claude Tag admin](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) sets up **Managed by** on the **Admin** tab of a channel's Configure page. The Team plan doesn't have the **Admin** tab. [When to use Managed by](#when-to-use-managed-by) lists the other places to keep instructions for a channel.
1212
13A managing channel isn't a [channel manager](/docs/claude-tag/admins/restrict-access.md#delegate-channel-setup-to-channel-managers). A channel manager is a person with a role that lets them configure one channel. A managing channel is a Slack channel, and the full workspace members in it can propose and confirm changes.
13A managing channel isn't a [channel manager](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-channel-setup-to-channel-managers). A channel manager is a person with a role that lets them configure one channel. A managing channel is a Slack channel, and the full workspace members in it can propose and confirm changes.
1414
1515## When to use Managed by
1616
from line 18
1818
1919| You want | Use | Who writes it |
2020| :- | :- | :- |
21| The same rules in every channel of a workspace or your whole organization | [Custom instructions](/docs/claude-tag/admins/attach-to-scope.md#add-custom-instructions) on the workspace or organization scope | An Owner, or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) for the workspace scope, in admin settings |
21| The same rules in every channel of a workspace or your whole organization | [Custom instructions](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#add-custom-instructions) on the workspace or organization scope | An Owner, or a [Claude Tag admin](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) for the workspace scope, in admin settings |
2222| A central team to write the rules for a few channels it runs, such as a help desk or an on-call channel, without being admins | **Managed by** | Members of a managing channel, by asking Claude in Slack |
2323| To correct how Claude behaves in a channel without having the conversation in that channel | **Managed by** with a private managing channel, as in [Correct Claude privately from a managing channel](#correct-claude-privately-from-a-managing-channel) | You, by asking Claude in the private channel |
24| The people who work in a channel to set its conventions themselves | The **Channel instructions** field on the channel's [Configure page](/docs/claude-tag/users/good-habits.md#configure-claude-for-a-channel) | Channel members, unless an admin has [restricted editing](/docs/claude-tag/admins/attach-to-scope.md#restrict-who-can-set-channel-instructions) |
24| The people who work in a channel to set its conventions themselves | The **Channel instructions** field on the channel's [Configure page](https://claude.com/docs/claude-tag/users/good-habits.md#configure-claude-for-a-channel) | Channel members, unless an admin has [restricted editing](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#restrict-who-can-set-channel-instructions) |
2525
2626You set up **Managed by** one channel at a time, and someone confirms each change to a channel's text in Slack. That suits a handful of channels. To give many channels the same text, use workspace or organization custom instructions.
2727
from line 34
3434* **Every channel in the pairing:** Claude is a member, and the channel is an ordinary channel in the same Slack workspace as the others. Direct messages and group direct messages can't be managed or managing channels.
3535* **Sharing:** no channel in the pairing is shared outside its workspace. That rules out Slack Connect channels, including ones with a pending invitation, and channels shared across the workspaces of an Enterprise Grid.
3636* **You:** you are a member of every managing channel you add.
37* **Managing channel:** its [**Channel member edits**](/docs/claude-tag/admins/attach-to-scope.md#restrict-who-can-set-channel-instructions) setting resolves to **Allow**. The list accepts a managing channel set to **Block**, but Claude refuses every read and change there.
38* **Managed channel:** the channel has its own page on the **Channels** tab under **Claude's access** in admin settings. If it isn't listed there, [set the channel up](/docs/claude-tag/admins/attach-to-scope.md#attach-to-a-channel).
37* **Managing channel:** its [**Channel member edits**](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#restrict-who-can-set-channel-instructions) setting resolves to **Allow**. The list accepts a managing channel set to **Block**, but Claude refuses every read and change there.
38* **Managed channel:** the channel has its own page on the **Channels** tab under **Claude's access** in admin settings. If it isn't listed there, [set the channel up](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#attach-to-a-channel).
3939
4040A managed channel can have up to five managing channels. A private managed channel has extra rules, listed under [Public and private channels](#public-and-private-channels).
4141
from line 43
4343
4444**1. Open the managed channel's Configure page**
4545
46In the channel whose instructions will be managed, select the **Configure** link in the footer of any Claude reply, or send [`@Claude !configure`](/docs/claude-tag/users/commands#get-the-link-to-configure-a-channel) and follow the link Claude posts. Go to the **Admin** tab.
46In the channel whose instructions will be managed, select the **Configure** link in the footer of any Claude reply, or send [`@Claude !configure`](https://claude.com/docs/claude-tag/users/commands#get-the-link-to-configure-a-channel) and follow the link Claude posts. Go to the **Admin** tab.
4747
4848**2. Select channels under Managed by**
4949
from line 57
5757
5858## Write or update managed instructions
5959
60A managing channel is a Slack channel that an Owner or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) selected under **Managed by** on another channel's Configure page. Any full member of the workspace who is in a managing channel can ask Claude there to change the managed channel's instructions. Guests and people from other organizations can't.
60A managing channel is a Slack channel that an Owner or a [Claude Tag admin](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) selected under **Managed by** on another channel's Configure page. Any full member of the workspace who is in a managing channel can ask Claude there to change the managed channel's instructions. Guests and people from other organizations can't.
6161
6262**1. Ask Claude in the managing channel**
6363
from line 93
9393
9494### Correct Claude privately from a managing channel
9595
96A managing channel is a Slack channel that an Owner or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) selected under **Managed by** on another channel's Configure page, and that other channel is the managed channel. When Claude gets something wrong in the managed channel, you can give the correction in a private managing channel, where only the private channel's members see the conversation.
96A managing channel is a Slack channel that an Owner or a [Claude Tag admin](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) selected under **Managed by** on another channel's Configure page, and that other channel is the managed channel. When Claude gets something wrong in the managed channel, you can give the correction in a private managing channel, where only the private channel's members see the conversation.
9797
98Claude proposes the correction as a change to the managed channel's instructions. After you confirm, Claude follows the new text in [conversations that start afterward](#how-managed-instructions-load) in the managed channel. While a guest is present in a managed channel that runs with [channel-only access](/docs/claude-tag/admins/restrict-access.md#how-channel-only-works), Claude doesn't load managed instructions.
98Claude proposes the correction as a change to the managed channel's instructions. After you confirm, Claude follows the new text in [conversations that start afterward](#how-managed-instructions-load) in the managed channel. While a guest is present in a managed channel that runs with [channel-only access](https://claude.com/docs/claude-tag/admins/restrict-access.md#how-channel-only-works), Claude doesn't load managed instructions.
9999
100100**1. Set up a private managing channel**
101101
from line 130
130130* **Your messages, Claude's replies, and the card:** these stay in the managing channel. Claude posts nothing in the managed channel when you confirm.
131131* **The instruction text:** members of the managed channel can ask Claude to repeat its instructions, so write the correction as a rule you're comfortable with them reading. They can also ask Claude to change or remove the text, as described in [Limits of Managed by as a control](#limits-of-managed-by-as-a-control).
132132
133In the original thread, Claude keeps the text the thread started with, and its replies there stay as they are. From a private channel, Claude [doesn't post in other channels](/docs/claude-tag/concepts/how-it-works.md#what-claude-can-do-in-other-channels), so reply in that thread yourself if the person who asked needs the right answer.
133In the original thread, Claude keeps the text the thread started with, and its replies there stay as they are. From a private channel, Claude [doesn't post in other channels](https://claude.com/docs/claude-tag/concepts/how-it-works.md#what-claude-can-do-in-other-channels), so reply in that thread yourself if the person who asked needs the right answer.
134134
135135## How managed instructions load
136136
from line 141
141141| Core instructions | One per managed channel | 16 KiB | At the start of every new conversation in the managed channel |
142142| Reference files | Up to 20 per managed channel, each with a short name | 100 KiB each | When the core instructions point Claude to one by name |
143143
144While a guest is present in a managed channel that runs with [channel-only access](/docs/claude-tag/admins/restrict-access.md#how-channel-only-works), Claude doesn't read the channel's memory, where managed instructions are stored, so conversations start without them.
144While a guest is present in a managed channel that runs with [channel-only access](https://claude.com/docs/claude-tag/admins/restrict-access.md#how-channel-only-works), Claude doesn't read the channel's memory, where managed instructions are stored, so conversations start without them.
145145
146146Put what Claude must always follow in the core instructions. Put long material, such as a runbook or an escalation list, in a reference file, and name that file in the core instructions so Claude knows when to open it.
147147
from line 166
166166
167167| Managed channel | Managing channels can be | Who can add managing channels |
168168| :- | :- | :- |
169| Public | Public or private | An Owner or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) |
169| Public | Public or private | An Owner or a [Claude Tag admin](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) |
170170| Private | Private only | An Owner or a Claude Tag admin who is also a member of the private channel |
171171
172172Anyone in the workspace can join a public managing channel and confirm changes there, so prefer a private managing channel for anything sensitive.
from line 175
175175
176176## Limits of Managed by as a control
177177
178**Managed by** sets which channels' members can write a channel's standing instructions through Claude. It isn't an access control. The managed text is stored with the managed channel's [memory](/docs/claude-tag/users/memory.md), so a member of the managed channel who asks Claude to change what it has saved there can still alter or remove the text.
178**Managed by** sets which channels' members can write a channel's standing instructions through Claude. It isn't an access control. The managed text is stored with the managed channel's [memory](https://claude.com/docs/claude-tag/users/memory.md), so a member of the managed channel who asks Claude to change what it has saved there can still alter or remove the text.
179179
180For instructions that channel members can't change, use [organization or workspace custom instructions](/docs/claude-tag/admins/attach-to-scope.md#add-custom-instructions). For anything Claude must not do, use [access controls](/docs/claude-tag/admins/restrict-access.md).
180For instructions that channel members can't change, use [organization or workspace custom instructions](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#add-custom-instructions). For anything Claude must not do, use [access controls](https://claude.com/docs/claude-tag/admins/restrict-access.md).
181181
182182If Claude can't read managed instructions when a conversation starts, the conversation starts without them.
183183
from line 190
190190| This channel isn't set as a manager of the other channel | No pairing exists, or it was removed | Add this channel under **Managed by** on the other channel's Configure page |
191191| A channel is shared with another organization | The managed or managing channel is a Slack Connect channel, has a pending invitation, or is shared across Enterprise Grid workspaces | Use channels that belong to one workspace only |
192192| You aren't in the managing channel, or in the private managed channel | You tried to add a managing channel you haven't joined, or to add managing channels to a private channel you aren't in | Join the channel in Slack, then try again |
193| This channel's settings are locked by an admin | The managing channel's [**Channel member edits**](/docs/claude-tag/admins/attach-to-scope.md#restrict-who-can-set-channel-instructions) setting is **Block**, on the channel or inherited from its workspace or the **Slack** page | Set **Channel member edits** to **Allow** on the managing channel's scope |
193| This channel's settings are locked by an admin | The managing channel's [**Channel member edits**](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#restrict-who-can-set-channel-instructions) setting is **Block**, on the channel or inherited from its workspace or the **Slack** page | Set **Channel member edits** to **Allow** on the managing channel's scope |
194194| You need your Claude account connected in this organization | You selected **Confirm** or **Cancel** without a Claude account in the organization connected to your Slack account | Connect your account from the Claude app's **Home** tab in Slack, then select the button again |
195195| Claude isn't in one of the channels | Claude was removed from the managed or managing channel, or never added | Run `/invite @Claude` in that channel |
196196| One of those channels is archived | One of the managing channels is archived in Slack | Remove the archived channel, then try again |
197197| A private channel can only be managed by private channels | The managed channel is private and the managing channel is public, or was made public later | Pick a private managing channel |
198| The managed channel may have been made private or deleted | The managed channel was made private or deleted, or Claude is no longer in it | Check the channel in Slack. If it was made private, an Owner or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) who is a member of it adds private managing channels again |
199| Claude isn't set up in the managed channel with its own channel configuration | The managed channel has no page of its own on the **Channels** tab | [Set the channel up](/docs/claude-tag/admins/attach-to-scope.md#attach-to-a-channel) in admin settings |
198| The managed channel may have been made private or deleted | The managed channel was made private or deleted, or Claude is no longer in it | Check the channel in Slack. If it was made private, an Owner or a [Claude Tag admin](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) who is a member of it adds private managing channels again |
199| Claude isn't set up in the managed channel with its own channel configuration | The managed channel has no page of its own on the **Channels** tab | [Set the channel up](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#attach-to-a-channel) in admin settings |
200200| The managed channel already has five managing channels | Five is the most a managed channel can have | Remove one before adding another |
201201| The file would be too large | The core instructions are over 16 KiB, or a reference file is over 100 KiB | Shorten the text, or move detail into a reference file |
202202| The managed channel already has the most reference files | Twenty reference files exist | Ask Claude to delete one first |
203203| The change is too large to show | The card can't display every changed line | Ask for a smaller part, confirm it, then ask for the next part |
204204| The text was refused by the content check | The text is blank or contains characters, links, or formatting the content check doesn't allow | Remove that part or write it as plain text, then ask again |
205| Managed instructions changes aren't available for organizations with restricted compliance settings | Your organization has restricted compliance settings | See [Restricted compliance settings block Claude Tag](/docs/claude-tag/admins/troubleshooting.md#restricted-compliance-settings-block-claude-tag) |
205| Managed instructions changes aren't available for organizations with restricted compliance settings | Your organization has restricted compliance settings | See [Restricted compliance settings block Claude Tag](https://claude.com/docs/claude-tag/admins/troubleshooting.md#restricted-compliance-settings-block-claude-tag) |
206206
207207## Related resources
208208
209* [How custom instructions stack](/docs/claude-tag/admins/attach-to-scope.md#custom-instructions): how organization, workspace, and channel instructions combine
210* [Customize Claude Tag](/docs/claude-tag/admins/customize.md): every layer that shapes Claude's behavior and who sets it
211* [What Claude Tag remembers](/docs/claude-tag/users/memory.md): channel memory, where managed text is stored
209* [How custom instructions stack](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#custom-instructions): how organization, workspace, and channel instructions combine
210* [Customize Claude Tag](https://claude.com/docs/claude-tag/admins/customize.md): every layer that shapes Claude's behavior and who sets it
211* [What Claude Tag remembers](https://claude.com/docs/claude-tag/users/memory.md): channel memory, where managed text is stored
212212
claude-tag/admins/migrate-from-earlier Changed · +12 / -12 lines
from line 10
1010
1111> [!NOTE]
1212>
13> If your Team plan organization has the single [**Respond in channels** switch](/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-on-the-team-plan), it has no **Claude Tag version** controls and there is nothing to migrate.
13> If your Team plan organization has the single [**Respond in channels** switch](https://claude.com/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-on-the-team-plan), it has no **Claude Tag version** controls and there is nothing to migrate.
1414
1515## Switch your workspace to Claude Tag
1616
1717**1. Connect the workspace in the Claude console**
1818
19Open [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag). If your workspace isn't paired, run [setup](/docs/claude-tag/admins/setup-overview); otherwise you're already on Claude Tag. Once paired, channels and linked-user DMs answer with the New version by default; no per-channel action is needed.
19Open [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag). If your workspace isn't paired, run [setup](https://claude.com/docs/claude-tag/admins/setup-overview); otherwise you're already on Claude Tag. Once paired, channels and linked-user DMs answer with the New version by default; no per-channel action is needed.
2020
2121**2. Check for channels still on Legacy**
2222
from line 28
2828
2929**3. Give Claude its connections**
3030
31The New version starts with no access of its own. GitHub repositories and other connections do not carry over from individual users' linked accounts, so code requests in a switched channel have nothing to clone until you configure them. Follow the [setup overview](/docs/claude-tag/admins/setup-overview) to add connections, and [GitHub access](/docs/claude-tag/admins/configure-github.md) for code work specifically.
31The New version starts with no access of its own. GitHub repositories and other connections do not carry over from individual users' linked accounts, so code requests in a switched channel have nothing to clone until you configure them. Follow the [setup overview](https://claude.com/docs/claude-tag/admins/setup-overview) to add connections, and [GitHub access](https://claude.com/docs/claude-tag/admins/configure-github.md) for code work specifically.
3232
33If your teams keep custom skills in a repository's `.claude/skills/` folder, those skills apply only in threads that have the repository. Add the repository to a [bundle](/docs/claude-tag/concepts/glossary.md#access-bundle) that applies to the channel, and have users name it in the first message. To give skills to every channel in a workspace or in all of Slack, add them through a [skills repository](/docs/claude-tag/admins/skills-repo.md).
33If your teams keep custom skills in a repository's `.claude/skills/` folder, those skills apply only in threads that have the repository. Add the repository to a [bundle](https://claude.com/docs/claude-tag/concepts/glossary.md#access-bundle) that applies to the channel, and have users name it in the first message. To give skills to every channel in a workspace or in all of Slack, add them through a [skills repository](https://claude.com/docs/claude-tag/admins/skills-repo.md).
3434
3535**4. Tell your users**
3636
37Send them [Get started](/docs/claude-tag/users/getting-started.md). The visible change is that work now belongs to the channel; see [What existing users notice after the switch](#what-existing-users-notice-after-the-switch) below.
37Send them [Get started](https://claude.com/docs/claude-tag/users/getting-started.md). The visible change is that work now belongs to the channel; see [What existing users notice after the switch](#what-existing-users-notice-after-the-switch) below.
3838
3939**You'll see:** the workspace under **Connected workspaces** on the **Slack** page, **New** as the **Slack** page's **Claude Tag version**, and no row on the **Channels** tab showing **legacy Claude in Slack**.
4040
4141### If `@Claude` doesn't respond at all
4242
43On Enterprise Grid, an earlier install can lose its connection and stop responding in every workspace. See [Claude is silent everywhere on Enterprise Grid](/docs/claude-tag/admins/troubleshooting.md#claude-is-silent-everywhere-on-enterprise-grid) for the reinstall that refreshes it without uninstalling, then send `@Claude connect` again in a channel of that workspace and [pair the workspace](/docs/claude-tag/admins/setup-overview#pair-your-slack-workspace) with the new code.
43On Enterprise Grid, an earlier install can lose its connection and stop responding in every workspace. See [Claude is silent everywhere on Enterprise Grid](https://claude.com/docs/claude-tag/admins/troubleshooting.md#claude-is-silent-everywhere-on-enterprise-grid) for the reinstall that refreshes it without uninstalling, then send `@Claude connect` again in a channel of that workspace and [pair the workspace](https://claude.com/docs/claude-tag/admins/setup-overview#pair-your-slack-workspace) with the new code.
4444
4545> [!WARNING]
4646>
47> Since October 5, 2026, the earlier Claude in Slack app, shown as **Legacy** in admin settings, no longer answers in channels of a workspace paired with your Claude organization. A channel there that's still set to Legacy gets a notice that the legacy bot is retired, until you set **Claude Tag version** to **New** on the channel, or on its workspace if the channel inherits the setting. You also can't switch a workspace or channel to Legacy anymore. Direct messages aren't affected. In a workspace that isn't paired, Pro and Max users still get answers from the earlier app in channels, and anyone else with a connected Claude account gets the [workspace setup notice](/docs/claude-tag/admins/troubleshooting.md#this-workspace-isn%E2%80%99t-set-up-for-claude-tag-yet) instead.
47> Since October 5, 2026, the earlier Claude in Slack app, shown as **Legacy** in admin settings, no longer answers in channels of a workspace paired with your Claude organization. A channel there that's still set to Legacy gets a notice that the legacy bot is retired, until you set **Claude Tag version** to **New** on the channel, or on its workspace if the channel inherits the setting. You also can't switch a workspace or channel to Legacy anymore. Direct messages aren't affected. In a workspace that isn't paired, Pro and Max users still get answers from the earlier app in channels, and anyone else with a connected Claude account gets the [workspace setup notice](https://claude.com/docs/claude-tag/admins/troubleshooting.md#this-workspace-isn%E2%80%99t-set-up-for-claude-tag-yet) instead.
4848
4949## What stays the same
5050
from line 64
6464| Standing work | None | Routines and channel watching |
6565| Who sets it up | Each user, individually | An Owner, once |
6666
67The **Claude Tag version** setting on each workspace's and channel's page chooses whether the New or Legacy version answers there, and the page's enable switch turns both off. In a paired workspace, Legacy no longer answers in channels. Bundles only apply where the New version answers. See [Turn Claude Tag on or off and set the version for a scope](/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-and-set-the-version-for-a-scope) for both controls and where to set them.
67The **Claude Tag version** setting on each workspace's and channel's page chooses whether the New or Legacy version answers there, and the page's enable switch turns both off. In a paired workspace, Legacy no longer answers in channels. Bundles only apply where the New version answers. See [Turn Claude Tag on or off and set the version for a scope](https://claude.com/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-and-set-the-version-for-a-scope) for both controls and where to set them.
6868
6969## Two versions of the same Slack app
7070
from line 76
7676
7777In channels, the visible difference is that work belongs to the channel, not to whoever asked. Anyone can reply in a thread to steer it, and the result stays where the team can see and pick it up. Code work is authored by the Claude GitHub App rather than as the requesting user.
7878
79A user who never linked a claude.ai account can now hand Claude work in channels, by default. Whether that stays open or narrows to organization members is the admin's [access restriction](/docs/claude-tag/admins/restrict-access.md#restrict-who-can-use-claude) setting.
79A user who never linked a claude.ai account can now hand Claude work in channels, by default. Whether that stays open or narrows to organization members is the admin's [access restriction](https://claude.com/docs/claude-tag/admins/restrict-access.md#restrict-who-can-use-claude) setting.
8080
8181## Related resources
8282
83* [Glossary: the earlier Claude in Slack](/docs/claude-tag/concepts/glossary.md#the-earlier-claude-in-slack): what each term meant in the old app versus now
84* [Set up Claude Tag](/docs/claude-tag/admins/setup-overview): the new admin-side setup, since per-user setup no longer applies
85* [Restrict where Claude Tag operates](/docs/claude-tag/admins/restrict-access.md): limit Claude to specific channels, for example during a pilot
83* [Glossary: the earlier Claude in Slack](https://claude.com/docs/claude-tag/concepts/glossary.md#the-earlier-claude-in-slack): what each term meant in the old app versus now
84* [Set up Claude Tag](https://claude.com/docs/claude-tag/admins/setup-overview): the new admin-side setup, since per-user setup no longer applies
85* [Restrict where Claude Tag operates](https://claude.com/docs/claude-tag/admins/restrict-access.md): limit Claude to specific channels, for example during a pilot
8686
claude-tag/admins/network-requirements Changed · +8 / -8 lines
from line 18
1818
1919The authoritative list is [Anthropic's published IP addresses](https://platform.claude.com/docs/en/api/ip-addresses); check it when you create the rule.
2020
21The range is shared across Anthropic services, and dedicated per-organization egress addresses aren't available, so the allowlist entry admits Anthropic's infrastructure as a whole. Your credential's [allowed websites](/docs/claude-tag/admins/add-connections.md#set-allowed-websites) are what scope which of *your* systems Claude can call.
21The range is shared across Anthropic services, and dedicated per-organization egress addresses aren't available, so the allowlist entry admits Anthropic's infrastructure as a whole. Your credential's [allowed websites](https://claude.com/docs/claude-tag/admins/add-connections.md#set-allowed-websites) are what scope which of *your* systems Claude can call.
2222
2323> [!NOTE]
2424>
25> If your Google Cloud project uses VPC Service Controls, an IP-based access level doesn't admit Claude's queries through the [BigQuery connection](/docs/claude-tag/admins/connections/bigquery.md). See [Allow the connection through a VPC Service Controls perimeter](/docs/claude-tag/admins/connections/bigquery.md#allow-the-connection-through-a-vpc-service-controls-perimeter) on the BigQuery page.
25> If your Google Cloud project uses VPC Service Controls, an IP-based access level doesn't admit Claude's queries through the [BigQuery connection](https://claude.com/docs/claude-tag/admins/connections/bigquery.md). See [Allow the connection through a VPC Service Controls perimeter](https://claude.com/docs/claude-tag/admins/connections/bigquery.md#allow-the-connection-through-a-vpc-service-controls-perimeter) on the BigQuery page.
2626
2727## Internet reachability
2828
from line 30
3030>
3131> A connected service must accept traffic from the internet (restricted by IP allowlist if you like). A service reachable only inside your private network can't be connected; private networking such as PrivateLink or VPC peering is not supported.
3232
33In an Anthropic-hosted environment, every request from a channel's sandbox to your service passes through [Agent Proxy](/docs/claude-tag/concepts/agent-identity.md#agent-proxy), which carries HTTP and HTTPS only. A service reachable only over another protocol, such as SSH or a database's native wire protocol, can't be connected; put an HTTP API in front of it instead.
33In an Anthropic-hosted environment, every request from a channel's sandbox to your service passes through [Agent Proxy](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy), which carries HTTP and HTTPS only. A service reachable only over another protocol, such as SSH or a database's native wire protocol, can't be connected; put an HTTP API in front of it instead.
3434
3535## IP allowlist vs. allowed websites
3636
37The IP allowlist on your service and the [allowed websites](/docs/claude-tag/admins/add-connections.md#set-allowed-websites) on a connection are opposite sides of the same boundary:
37The IP allowlist on your service and the [allowed websites](https://claude.com/docs/claude-tag/admins/add-connections.md#set-allowed-websites) on a connection are opposite sides of the same boundary:
3838
3939| | IP allowlist | Allowed websites |
4040| :- | :- | :- |
from line 47
4747
4848## Related resources
4949
50* [Add connections](/docs/claude-tag/admins/add-connections.md#set-allowed-websites): the allowed-websites setting (the other direction: what Claude is allowed to reach)
51* [Allow a host without a credential](/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential): how hosts become reachable from a channel, including [allow-all egress](/docs/claude-tag/admins/add-connections.md#allow-all-hosts)
52* [How agent identity works](/docs/claude-tag/concepts/agent-identity.md): how credentials are injected at the network boundary
53* [Setup overview](/docs/claude-tag/admins/setup-overview): back to the console flow once the allowlist is in place
50* [Add connections](https://claude.com/docs/claude-tag/admins/add-connections.md#set-allowed-websites): the allowed-websites setting (the other direction: what Claude is allowed to reach)
51* [Allow a host without a credential](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential): how hosts become reachable from a channel, including [allow-all egress](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-all-hosts)
52* [How agent identity works](https://claude.com/docs/claude-tag/concepts/agent-identity.md): how credentials are injected at the network boundary
53* [Setup overview](https://claude.com/docs/claude-tag/admins/setup-overview): back to the console flow once the allowlist is in place
5454
claude-tag/admins/restrict-access Changed · +68 / -68 lines
from line 6
66>
77> Claude Tag is in public beta. Features and behavior described here may change before general availability.
88
9In channels, Claude Tag responds only where it's been added and addressed, and the controls on this page narrow that further. One-to-one DMs are a separate surface. A DM from a member who has connected a Claude account runs on that member's own account; see [how DMs differ from channels](/docs/claude-tag/concepts/agent-identity.md#direct-message-channels). A [DM from a member who hasn't](#direct-messages-from-members-without-a-claude-account) can bill to your organization. In a [group DM](#group-dms), the work bills to your organization.
9In channels, Claude Tag responds only where it's been added and addressed, and the controls on this page narrow that further. One-to-one DMs are a separate surface. A DM from a member who has connected a Claude account runs on that member's own account; see [how DMs differ from channels](https://claude.com/docs/claude-tag/concepts/agent-identity.md#direct-message-channels). A [DM from a member who hasn't](#direct-messages-from-members-without-a-claude-account) can bill to your organization. In a [group DM](#group-dms), the work bills to your organization.
1010
1111> [!NOTE]
1212>
from line 69
6969
7070The restriction toggle decides who can use Claude. The controls in this section decide where it works at all, from one channel up to a workspace, and which generation answers in each scope (a scope is a channel, a workspace, or your whole organization). Each scope has its own page under [**Claude's access > Channels**](https://claude.ai/admin-settings/claude-tag?access=channels), and the **Slack** page there holds the settings for your whole organization.
7171
72If the **Slack** page's **General** tab shows a **Respond in channels** switch rather than **Respond in all channels**, your organization has a [single on-or-off switch](/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-on-the-team-plan) in place of the per-scope switches and version settings. The other controls in this section work the same way either way.
72If the **Slack** page's **General** tab shows a **Respond in channels** switch rather than **Respond in all channels**, your organization has a [single on-or-off switch](https://claude.com/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-on-the-team-plan) in place of the per-scope switches and version settings. The other controls in this section work the same way either way.
7373
7474### Quiet or remove Claude Tag
7575
from line 80
80803. **Turn off the scope's switch.**
8181 * **Stop Claude in one workspace or channel:** open the workspace's or channel's page on the **Channels** tab and turn off the **Enable Claude Tag in this workspace** or **Enable Claude Tag in this channel** switch at the top of its **General** tab. Claude stops responding in that scope even if someone invites it back; an @-mention gets a disabled notice instead of a reply, except in a Slack Connect channel, where Claude posts no notice. Only an Owner or a [Claude Tag admin](#delegate-claude-tag-administration) can change it.
8282 * **Stop Claude in every channel:** turn off the **Respond in all channels** switch at the top of the **Slack** page's **General** tab. Claude stops responding in every channel except in workspaces and channels whose own switch is on. If the **Slack** page shows **Respond in channels** instead, turning it off stops Claude in every channel of every connected workspace.
834. **Remove the channel's scope.** If the **⋯** menu on the channel's page lists **Remove this scope**, choose it. Claude deletes the channel's sessions, memory, routines, and published artifacts; see [what each action deletes](/docs/claude-tag/concepts/data-lifecycle.md#actions-in-claude). Where the channel's workspace has its own setting on, or has no setting of its own and the **Slack** page's setting is on, Claude keeps answering in the channel with the access it inherits from its workspace. To stop it answering in that case, run `/remove @Claude` first.
845. **Delete the bundle.** On the bundle's page, choose **Delete bundle** from its menu. This revokes its credentials everywhere it applied (the credentials are removed; memory, routines, and transcripts are not). Running sessions may keep a revoked credential for a short window before the change propagates. An Owner or a [Claude Tag admin](#delegate-claude-tag-administration) can delete a bundle, except that only an Owner can delete one a [channel rule](/docs/claude-tag/admins/attach-to-scope.md#attach-a-bundle-to-channels-by-name) names.
856. **Uninstall the app.** This removes Claude from the workspace and deletes the workspace's Claude data the same way [disconnecting the workspace](/docs/claude-tag/admins/workspaces.md#revoke-a-pairing) does.
834. **Remove the channel's scope.** If the **⋯** menu on the channel's page lists **Remove this scope**, choose it. Claude deletes the channel's sessions, memory, routines, and published artifacts; see [what each action deletes](https://claude.com/docs/claude-tag/concepts/data-lifecycle.md#actions-in-claude). Where the channel's workspace has its own setting on, or has no setting of its own and the **Slack** page's setting is on, Claude keeps answering in the channel with the access it inherits from its workspace. To stop it answering in that case, run `/remove @Claude` first.
845. **Delete the bundle.** On the bundle's page, choose **Delete bundle** from its menu. This revokes its credentials everywhere it applied (the credentials are removed; memory, routines, and transcripts are not). Running sessions may keep a revoked credential for a short window before the change propagates. An Owner or a [Claude Tag admin](#delegate-claude-tag-administration) can delete a bundle, except that only an Owner can delete one a [channel rule](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#attach-a-bundle-to-channels-by-name) names.
856. **Uninstall the app.** This removes Claude from the workspace and deletes the workspace's Claude data the same way [disconnecting the workspace](https://claude.com/docs/claude-tag/admins/workspaces.md#revoke-a-pairing) does.
8686
8787To keep Claude out of channels by name ahead of time, add a [blocked channel pattern](#block-or-auto-join-channels-by-name) instead.
8888
from line 90
9090
9191Steps 4 through 6, and disconnecting the workspace, each delete something different:
9292
93* **Remove the channel's scope (step 4):** deletes the channel's sessions, memory, routines, and published artifacts; see [what each action deletes](/docs/claude-tag/concepts/data-lifecycle.md#actions-in-claude).
93* **Remove the channel's scope (step 4):** deletes the channel's sessions, memory, routines, and published artifacts; see [what each action deletes](https://claude.com/docs/claude-tag/concepts/data-lifecycle.md#actions-in-claude).
9494* **Delete the bundle (step 5):** removes the credentials in that bundle. Memory, routines, and session transcripts stay.
95* **Uninstall the app (step 6):** Anthropic deletes the workspace's Claude data, the same set as disconnecting the workspace, plus the app's installation credential; see [what each action deletes](/docs/claude-tag/concepts/data-lifecycle.md#actions-in-slack).
96* **[Disconnect the workspace](/docs/claude-tag/admins/workspaces.md#revoke-a-pairing)** at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag): Anthropic deletes the workspace's sessions and transcripts, memory, routines and artifacts, scopes, and members' account links, and the app stays installed so a workspace admin can pair again; see [what each action deletes](/docs/claude-tag/concepts/data-lifecycle.md#actions-in-claude).
95* **Uninstall the app (step 6):** Anthropic deletes the workspace's Claude data, the same set as disconnecting the workspace, plus the app's installation credential; see [what each action deletes](https://claude.com/docs/claude-tag/concepts/data-lifecycle.md#actions-in-slack).
96* **[Disconnect the workspace](https://claude.com/docs/claude-tag/admins/workspaces.md#revoke-a-pairing)** at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag): Anthropic deletes the workspace's sessions and transcripts, memory, routines and artifacts, scopes, and members' account links, and the app stays installed so a workspace admin can pair again; see [what each action deletes](https://claude.com/docs/claude-tag/concepts/data-lifecycle.md#actions-in-claude).
9797
9898Bundles belong to your organization, not to a workspace, so uninstalling or disconnecting keeps them; only the places they apply in that workspace go. To delete one channel's data while Claude stays in the workspace, remove that channel's scope (step 4) rather than uninstalling.
9999
from line 101
101101
102102To let Claude respond only in channels you choose, for example during a pilot confined to one channel, turn off **Respond in all channels** on the **Slack** page, then turn on each chosen channel's **Enable Claude Tag in this channel** switch. Both pages are on the **Channels** tab under [**Claude's access**](https://claude.ai/admin-settings/claude-tag?access=channels). One-to-one DMs, guest channels, and shared channels need more than these switches; each gets its own treatment after the steps.
103103
104These steps need the per-scope switches. If the **Slack** page shows [**Respond in channels**](/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-on-the-team-plan) instead, you can't limit Claude this way. Use [blocked channel patterns](#block-or-auto-join-channels-by-name) to keep it out of specific channels.
104These steps need the per-scope switches. If the **Slack** page shows [**Respond in channels**](https://claude.com/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-on-the-team-plan) instead, you can't limit Claude this way. Use [blocked channel patterns](#block-or-auto-join-channels-by-name) to keep it out of specific channels.
105105
106106> [!NOTE]
107107>
from line 117
117117
118118**3. Switch each chosen channel back on**
119119
120On the **Channels** tab, find the channel with the search field; channels Claude was added to are already listed. If it isn't listed, set it up as described in [Attach to a channel](/docs/claude-tag/admins/attach-to-scope.md#attach-to-a-channel). Open the channel's page and turn on the **Enable Claude Tag in this channel** switch at the top of its **General** tab.
120On the **Channels** tab, find the channel with the search field; channels Claude was added to are already listed. If it isn't listed, set it up as described in [Attach to a channel](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#attach-to-a-channel). Open the channel's page and turn on the **Enable Claude Tag in this channel** switch at the top of its **General** tab.
121121
122122A channel's own setting wins over the off setting above it, so Claude responds in the chosen channels and nowhere else.
123123
from line 140
140140* **Blocked channel patterns**: Claude won't read or respond in a channel whose name matches, even if someone invites it there. When it's added to such a channel or @-mentioned in one, it posts a notice that an admin has blocked it there, and otherwise stays silent. In a Slack Connect channel, it posts no notice.
141141* **Auto-join channels**: Claude joins a public channel whose name matches one of its patterns when the channel is created or renamed. Private channels still need an invite. To add Claude to an existing channel, invite it as usual.
142142
143Each row of the **Auto-join channels** table is one pattern, added with **Add pattern**. A row can also carry [bundles](/docs/claude-tag/admins/attach-to-scope.md#attach-a-bundle-to-channels-by-name), which attach in every matching channel Claude is in; a row with no bundles is marked **Auto-join only**, and Claude joins matching channels whether or not a row carries bundles. A channel rule added with **Add a channel rule…** on the **Channels** tab shows up as a row here too. Editing the patterns or the bundles on a row needs an Owner of your Claude organization.
143Each row of the **Auto-join channels** table is one pattern, added with **Add pattern**. A row can also carry [bundles](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#attach-a-bundle-to-channels-by-name), which attach in every matching channel Claude is in; a row with no bundles is marked **Auto-join only**, and Claude joins matching channels whether or not a row carries bundles. A channel rule added with **Add a channel rule…** on the **Channels** tab shows up as a row here too. Editing the patterns or the bundles on a row needs an Owner of your Claude organization.
144144
145145Removing a pattern row also detaches the row's bundles. A row marked **Not auto-joined** shows a pattern that still has bundles attached but that the auto-join list no longer carries. Claude joins no new channels for it, but its bundles still attach in matching channels Claude is already in; remove the bundles from the row to end that.
146146
from line 172
172172
173173Use **Channel only** to keep Claude available in a channel shared with contractors, clients, or agency partners without exposing the rest of the organization's setup to that conversation. While a guest is in the channel, Claude has:
174174
175* No [bundles](/docs/claude-tag/admins/attach-to-scope.md) inherited from the workspace or the organization. A bundle attached directly to the channel still applies.
175* No [bundles](https://claude.com/docs/claude-tag/admins/attach-to-scope.md) inherited from the workspace or the organization. A bundle attached directly to the channel still applies.
176176* No connections inherited from the workspace or the organization. A connection set directly on the channel still applies.
177177* No repositories from the workspace or the organization.
178178* No instructions set on the workspace or the organization. Instructions set on the channel itself still apply.
179179* No memory, including this channel's own, and no skills.
180* No [environment set on the scope](/docs/claude-tag/admins/customize.md#configure-the-environment-for-a-scope). The session runs on the standard environment, so the setup script, environment variables, and network access level of the environment you chose don't apply while a guest is present.
180* No [environment set on the scope](https://claude.com/docs/claude-tag/admins/customize.md#configure-the-environment-for-a-scope). The session runs on the standard environment, so the setup script, environment variables, and network access level of the environment you chose don't apply while a guest is present.
181181
182182Claude decides which access applies when a conversation starts. When no guest is in the channel, new conversations get the same access as under **Full access**.
183183
184184A conversation that was underway before the first guest joined doesn't keep its full access. The next message from a workspace member in that thread starts the conversation over with channel-only access. A guest who writes there before a member does gets the same notice as under **Restrict**.
185185
186The channel's [**Respond automatically**](/docs/claude-tag/users/when-claude-responds.md#turn-automatic-replies-on-or-off) setting works the same while a guest is present, and it's on by default. While it's on, messages from workspace members that don't mention Claude still reach it, and Claude may reply to some of them on its own. Outside the threads Claude is part of, a guest's messages that don't mention Claude reach it only as context, not as requests. To have Claude reply only to @-mentions and in threads it's already part of, turn **Respond automatically** off for that channel.
186The channel's [**Respond automatically**](https://claude.com/docs/claude-tag/users/when-claude-responds.md#turn-automatic-replies-on-or-off) setting works the same while a guest is present, and it's on by default. While it's on, messages from workspace members that don't mention Claude still reach it, and Claude may reply to some of them on its own. Outside the threads Claude is part of, a guest's messages that don't mention Claude reach it only as context, not as requests. To have Claude reply only to @-mentions and in threads it's already part of, turn **Respond automatically** off for that channel.
187187
188While a guest is present, Claude doesn't publish [artifacts](/docs/claude-tag/concepts/security-and-data.md#artifact-visibility), the web pages hosted on claude.ai. To have Claude publish a page, ask from a channel without guests.
188While a guest is present, Claude doesn't publish [artifacts](https://claude.com/docs/claude-tag/concepts/security-and-data.md#artifact-visibility), the web pages hosted on claude.ai. To have Claude publish a page, ask from a channel without guests.
189189
190190A guest can talk to Claude by mentioning `@Claude` or by replying in a thread Claude is part of, and Claude answers them. A guest can't approve a tool or permission request, and can't restart, mute, fork, or stop the session. If a guest clicks approve, nothing is granted.
191191
192192Treat a channel's instructions, and the instructions in any bundle attached directly to the channel, as visible to everyone in that channel, including guests. Under **Channel only**, Claude follows them in replies that guests can read and respond to.
193193
194**Channel only** takes effect where the **New** [Claude Tag version](/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-and-set-the-version-for-a-scope) answers. On a scope where **Legacy** answers, a channel that includes a guest is treated as **Restrict**.
194**Channel only** takes effect where the **New** [Claude Tag version](https://claude.com/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-and-set-the-version-for-a-scope) answers. On a scope where **Legacy** answers, a channel that includes a guest is treated as **Restrict**.
195195
196196### Limit which channels Claude can search
197197
from line 233
233233
234234#### What access Claude has in a Slack Connect channel
235235
236Claude answers in a Slack Connect channel where [**How should Claude work in channels with guests**](#restrict-guest-channels) is **Channel only** or **Full access**. Its access there is capped at channel-only access under either value. Claude follows the channel's own instructions, and [bundles](/docs/claude-tag/admins/attach-to-scope.md) apply there according to how each one is attached:
236Claude answers in a Slack Connect channel where [**How should Claude work in channels with guests**](#restrict-guest-channels) is **Channel only** or **Full access**. Its access there is capped at channel-only access under either value. Claude follows the channel's own instructions, and [bundles](https://claude.com/docs/claude-tag/admins/attach-to-scope.md) apply there according to how each one is attached:
237237
238* **Attached directly to the channel.** The bundle applies whether it was [attached to the channel](/docs/claude-tag/admins/attach-to-scope.md#attach-to-a-channel) before or after the channel was shared and whoever attached it, unless it's set to apply only in channels with guests.
239* **Inherited, or attached by a channel rule.** A bundle inherited from the workspace or the **Slack** page, or attached by a [channel rule](/docs/claude-tag/admins/attach-to-scope.md#attach-a-bundle-to-channels-by-name), doesn't apply, except a bundle attached specifically for Slack Connect channels.
238* **Attached directly to the channel.** The bundle applies whether it was [attached to the channel](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#attach-to-a-channel) before or after the channel was shared and whoever attached it, unless it's set to apply only in channels with guests.
239* **Inherited, or attached by a channel rule.** A bundle inherited from the workspace or the **Slack** page, or attached by a [channel rule](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#attach-a-bundle-to-channels-by-name), doesn't apply, except a bundle attached specifically for Slack Connect channels.
240240
241241When a bundle applies there, Claude can use the bundle's connectors for anyone it answers in the channel, including the other company's people.
242242
243243> [!WARNING]
244244>
245> Treat the channel's instructions, and the connectors in its bundles, as available to the other company. Before you turn Claude on in a Slack Connect channel, or share a channel where it's already on, open the channel's page under [**Claude's access > Channels**](https://claude.ai/admin-settings/claude-tag?access=channels), check its bundles, and [remove the channel from any bundle](/docs/claude-tag/admins/attach-to-scope.md#choose-where-a-bundle-applies) you don't want used there.
245> Treat the channel's instructions, and the connectors in its bundles, as available to the other company. Before you turn Claude on in a Slack Connect channel, or share a channel where it's already on, open the channel's page under [**Claude's access > Channels**](https://claude.ai/admin-settings/claude-tag?access=channels), check its bundles, and [remove the channel from any bundle](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#choose-where-a-bundle-applies) you don't want used there.
246246
247247When it answers there, Claude also has:
248248
from line 249
249249* No connections inherited from the workspace or the **Slack** page.
250250* No instructions set on the workspace or on the **Slack** page.
251251* No memory, skills, or repositories.
252* No [environment set on the scope](/docs/claude-tag/admins/customize.md#configure-the-environment-for-a-scope). The session runs on the standard environment.
252* No [environment set on the scope](https://claude.com/docs/claude-tag/admins/customize.md#configure-the-environment-for-a-scope). The session runs on the standard environment.
253253
254In a Slack Connect channel, Claude also doesn't search your workspace, look up people or channels, read other channels, publish [artifacts](/docs/claude-tag/concepts/security-and-data.md#artifact-visibility), or set up [routines](/docs/claude-tag/users/proactivity.md). Routines set up in the channel before it was shared don't run there.
254In a Slack Connect channel, Claude also doesn't search your workspace, look up people or channels, read other channels, publish [artifacts](https://claude.com/docs/claude-tag/concepts/security-and-data.md#artifact-visibility), or set up [routines](https://claude.com/docs/claude-tag/users/proactivity.md). Routines set up in the channel before it was shared don't run there.
255255
256256#### Who can use Claude in a Slack Connect channel
257257
from line 258
258258People from the other company can talk to Claude by mentioning `@Claude` or by replying in a thread Claude is part of, and Claude answers them. Everyone in the channel, including the other company's people, can read what Claude posts.
259259
260260* **Limit Claude to your organization.** Go to [**Claude's access > Channels > Slack**](https://claude.ai/admin-settings/claude-tag/channels/slack), open the **Advanced** tab, and turn on the **Restrict to your organization** toggle (**Restrict to roles with Claude Tag access** on Enterprise). Someone from the other company who then mentions `@Claude` to start a conversation gets a message only they can see, and in an existing thread Claude declines their request. The toggle applies to channels and DMs alike, so members of your workspace without a Claude account (on Enterprise, without a role that grants **Claude Tag in Slack**) lose access too.
261* **Automatic replies.** While the channel's [**Respond automatically**](/docs/claude-tag/users/when-claude-responds.md#turn-automatic-replies-on-or-off) setting is on, messages from your members that don't mention Claude reach it, and Claude may reply to some of them on its own. Outside the threads Claude is part of, messages from the other company's people that don't mention Claude reach it only as context, not as requests.
262* **Commands.** Your organization's members can send `@Claude` followed by `!help`, `!mute`, `!unmute`, `!restart`, or `!fast`. People from the other company can use only `!help`, and other [commands](/docs/claude-tag/users/commands.md) do nothing there.
261* **Automatic replies.** While the channel's [**Respond automatically**](https://claude.com/docs/claude-tag/users/when-claude-responds.md#turn-automatic-replies-on-or-off) setting is on, messages from your members that don't mention Claude reach it, and Claude may reply to some of them on its own. Outside the threads Claude is part of, messages from the other company's people that don't mention Claude reach it only as context, not as requests.
262* **Commands.** Your organization's members can send `@Claude` followed by `!help`, `!mute`, `!unmute`, `!restart`, or `!fast`. People from the other company can use only `!help`, and other [commands](https://claude.com/docs/claude-tag/users/commands.md) do nothing there.
263263
264264#### When Claude does not answer in a Slack Connect channel
265265
266266After you [turn Claude on in Slack Connect channels](#turn-claude-on-in-slack-connect-channels), Claude still doesn't answer there in these cases, and posts a notice only in a thread from before the channel was shared:
267267
268* **Claude Tag turned off.** The [**Enable Claude Tag** switch](/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-and-set-the-version-for-a-scope) that covers the channel is off.
268* **Claude Tag turned off.** The [**Enable Claude Tag** switch](https://claude.com/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-and-set-the-version-for-a-scope) that covers the channel is off.
269269* **Blocked name.** The channel's name matches one of the [**Blocked channel patterns**](#block-or-auto-join-channels-by-name).
270* **Legacy version.** The scope's [Claude Tag version](/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-and-set-the-version-for-a-scope) is **Legacy**.
270* **Legacy version.** The scope's [Claude Tag version](https://claude.com/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-and-set-the-version-for-a-scope) is **Legacy**.
271271* **Enterprise Grid organization-level installs.** Claude is installed for your whole Enterprise Grid organization rather than per workspace, and none of your own workspaces hosts the channel.
272272* **Threads from before the channel was shared.** Claude doesn't continue a thread it was already working in before the channel was shared. A mention there gets the notice "This channel is now shared with another organization through Slack Connect, so this thread's earlier session can't continue here," and a new thread works.
273273* **Messages from the other company's Claude.** Claude doesn't reply to the other company's Claude. If the other company also uses Claude, each company's settings decide only whether its own Claude answers.
from line 277
277277
278278What happens in a channel shared across more than one workspace inside your Enterprise Grid depends on whether every workspace in it is connected to the same Claude organization.
279279
280When the workspaces all belong to your one Claude organization, Claude replies in the channel, but only with the access and settings on your organization's [**Slack**](/docs/claude-tag/admins/attach-to-scope.md) page. Bundles, instructions, and memory set on a workspace or on that channel don't reach it. Claude posts a notice in the thread explaining these limits, but not on every reply. Where guest access is at its default **Restrict**, the [guest check](#restrict-guest-channels) still runs first and can refuse the reply.
280When the workspaces all belong to your one Claude organization, Claude replies in the channel, but only with the access and settings on your organization's [**Slack**](https://claude.com/docs/claude-tag/admins/attach-to-scope.md) page. Bundles, instructions, and memory set on a workspace or on that channel don't reach it. Claude posts a notice in the thread explaining these limits, but not on every reply. Where guest access is at its default **Restrict**, the [guest check](#restrict-guest-channels) still runs first and can refuse the reply.
281281
282282When the workspaces belong to different Claude organizations, each with its own settings and plan, Claude won't reply and posts a refusal message instead.
283283
from line 285
285285
286286### Migrate from the earlier Claude in Slack
287287
288If your organization used the earlier Claude in Slack app, the **Claude Tag version** setting on the **Advanced** tab of each scope's page chooses which generation answers `@Claude` there. Bundles only apply where the New version answers. See [Turn Claude Tag on or off and set the version for a scope](/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-and-set-the-version-for-a-scope) for the values and [Migrate from the earlier Claude in Slack](/docs/claude-tag/admins/migrate-from-earlier.md) for the switch.
288If your organization used the earlier Claude in Slack app, the **Claude Tag version** setting on the **Advanced** tab of each scope's page chooses which generation answers `@Claude` there. Bundles only apply where the New version answers. See [Turn Claude Tag on or off and set the version for a scope](https://claude.com/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-and-set-the-version-for-a-scope) for the values and [Migrate from the earlier Claude in Slack](https://claude.com/docs/claude-tag/admins/migrate-from-earlier.md) for the switch.
289289
290290### Allow or disable direct messages
291291
from line 295
295295
296296### Group DMs
297297
298A group DM is a Slack direct message among several people. When members add Claude to one, Claude acts with its own [service accounts](/docs/claude-tag/concepts/agent-identity.md), and the work bills to your organization's [usage balance](/docs/claude-tag/admins/set-spend-limit.md). [Use Claude Tag in a group DM](/docs/claude-tag/users/group-dms.md) covers what members can do there.
298A group DM is a Slack direct message among several people. When members add Claude to one, Claude acts with its own [service accounts](https://claude.com/docs/claude-tag/concepts/agent-identity.md), and the work bills to your organization's [usage balance](https://claude.com/docs/claude-tag/admins/set-spend-limit.md). [Use Claude Tag in a group DM](https://claude.com/docs/claude-tag/users/group-dms.md) covers what members can do there.
299299
300A group DM has no [scope](/docs/claude-tag/concepts/glossary.md#scope) of its own, so you can't attach a [bundle](/docs/claude-tag/admins/attach-to-scope.md) to one group DM or turn Claude off in one. You control every group DM in a workspace together:
300A group DM has no [scope](https://claude.com/docs/claude-tag/concepts/glossary.md#scope) of its own, so you can't attach a [bundle](https://claude.com/docs/claude-tag/admins/attach-to-scope.md) to one group DM or turn Claude off in one. You control every group DM in a workspace together:
301301
302302* **Access.** Claude works with the bundles, instructions, and repositories on the workspace's page and on the **Slack** page.
303303* **Stop Claude from answering in group DMs.** Use either control. No setting covers group DMs alone.
304 * Turn off the [**Enable Claude Tag** switch](/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-and-set-the-version-for-a-scope) that covers the workspace. Claude also stops answering in the channels that follow that switch.
304 * Turn off the [**Enable Claude Tag** switch](https://claude.com/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-and-set-the-version-for-a-scope) that covers the workspace. Claude also stops answering in the channels that follow that switch.
305305 * Turn off the [**Allow direct messages**](#allow-or-disable-direct-messages) toggle. Claude also stops answering one-to-one DMs.
306306* **Who can ask.** If you [restrict who can use Claude](#restrict-who-can-use-claude), the restriction applies in group DMs too. With no restriction, a member who hasn't connected a Claude account can ask in a group DM, and the [limits on one-to-one DMs from those members](#limits-on-direct-messages-from-members-without-a-claude-account) don't apply.
307307* **Spend.** The organization-wide [spend limit](#set-spend-limits) caps group DM work along with channel work, and the **Default spend limit** applies to each group DM.
308* **Version.** Where the **Legacy** [Claude Tag version](/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-and-set-the-version-for-a-scope) answers for the workspace, Claude doesn't respond in group DMs.
308* **Version.** Where the **Legacy** [Claude Tag version](https://claude.com/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-and-set-the-version-for-a-scope) answers for the workspace, Claude doesn't respond in group DMs.
309309
310310Who is in a group DM, and how Slack shares it, can change whether Claude answers:
311311
from line 322
322322* **The workspace is connected to your organization.** The DMs bill the Claude organization the Slack workspace is paired to.
323323* **Anyone in the workspace can use Claude.** The [restriction toggle](#restrict-who-can-use-claude) is off, which is its default.
324324* **Direct messages are allowed.** The [**Allow direct messages**](#allow-or-disable-direct-messages) toggle is on, which is its default.
325* **Claude is on for the workspace.** The workspace's [**Enable Claude Tag in this workspace** switch](/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-and-set-the-version-for-a-scope) is on, or **Respond in all channels** on the **Slack** page is on when the workspace follows it. If the **Slack** page has the single [**Respond in channels** switch](/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-on-the-team-plan) instead, that switch is on.
325* **Claude is on for the workspace.** The workspace's [**Enable Claude Tag in this workspace** switch](https://claude.com/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-and-set-the-version-for-a-scope) is on, or **Respond in all channels** on the **Slack** page is on when the workspace follows it. If the **Slack** page has the single [**Respond in channels** switch](https://claude.com/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-on-the-team-plan) instead, that switch is on.
326326* **The member is a full member of the Slack workspace.** A Slack guest's DMs don't bill to your organization.
327327
328328#### Limits on direct messages from members without a Claude account
from line 335
335335| Spend | \$50 of usage, or your **Default spend limit** when that amount is lower |
336336| Sessions | 50 sessions |
337337
338The **Default spend limit** is the one at [`claude.ai/admin-settings/usage/claude-tag`](https://claude.ai/admin-settings/usage/claude-tag) that applies to each channel without a limit of its own. When it's below \$50, each member's DMs stop at that amount. When it's 0, none of these DMs bill to your organization. This usage also counts toward your organization's [spend limit](/docs/claude-tag/admins/set-spend-limit.md#set-the-spend-limit). The usage page's per-channel breakdown lists channels only, so this usage doesn't appear in it.
338The **Default spend limit** is the one at [`claude.ai/admin-settings/usage/claude-tag`](https://claude.ai/admin-settings/usage/claude-tag) that applies to each channel without a limit of its own. When it's below \$50, each member's DMs stop at that amount. When it's 0, none of these DMs bill to your organization. This usage also counts toward your organization's [spend limit](https://claude.com/docs/claude-tag/admins/set-spend-limit.md#set-the-spend-limit). The usage page's per-channel breakdown lists channels only, so this usage doesn't appear in it.
339339
340340Claude checks the limits when each message arrives, so work already running when a limit is reached can finish past it. After a member reaches a limit, their next DM gets a prompt to connect a Claude account, and after connecting, their DMs run on their own Claude account and bill to their own seat.
341341
342342#### Access in a direct message from a member without a Claude account
343343
344A DM session for a member without a Claude account runs as Claude's own identity, the way a [channel session](/docs/claude-tag/concepts/agent-identity.md#channel-sessions) does. Two facts decide what it can reach:
344A DM session for a member without a Claude account runs as Claude's own identity, the way a [channel session](https://claude.com/docs/claude-tag/concepts/agent-identity.md#channel-sessions) does. Two facts decide what it can reach:
345345
346* **Bundles.** The session reaches the same [bundles](/docs/claude-tag/admins/attach-to-scope.md) as a channel the member creates in that workspace.
347* **Personal connectors.** The member has no Claude account, so the session has no [personal connectors](/docs/claude-tag/concepts/personal-connectors.md).
346* **Bundles.** The session reaches the same [bundles](https://claude.com/docs/claude-tag/admins/attach-to-scope.md) as a channel the member creates in that workspace.
347* **Personal connectors.** The member has no Claude account, so the session has no [personal connectors](https://claude.com/docs/claude-tag/concepts/personal-connectors.md).
348348
349349#### Daily brief offer for members without a Claude account
350350
from line 370
370370
371371### Set spend limits
372372
373Spend limits live at [`claude.ai/admin-settings/usage/claude-tag`](https://claude.ai/admin-settings/usage/claude-tag), a different page than the main Claude Tag settings; see [when the usage page is available](/docs/claude-tag/admins/set-spend-limit.md#set-the-spend-limit). Spend trends and per-channel reports live on a separate analytics page; see [Usage analytics](#usage-analytics) below.
373Spend limits live at [`claude.ai/admin-settings/usage/claude-tag`](https://claude.ai/admin-settings/usage/claude-tag), a different page than the main Claude Tag settings; see [when the usage page is available](https://claude.com/docs/claude-tag/admins/set-spend-limit.md#set-the-spend-limit). Spend trends and per-channel reports live on a separate analytics page; see [Usage analytics](#usage-analytics) below.
374374
375A spend limit is a cap on how much of your organization's usage balance Claude Tag can draw each billing period. Setting a limit doesn't fund the balance; on a Team plan, [fund the usage balance first](/docs/claude-tag/admins/set-spend-limit.md) or Claude won't respond in channels regardless of the limit.
375A spend limit is a cap on how much of your organization's usage balance Claude Tag can draw each billing period. Setting a limit doesn't fund the balance; on a Team plan, [fund the usage balance first](https://claude.com/docs/claude-tag/admins/set-spend-limit.md) or Claude won't respond in channels regardless of the limit.
376376
377377* **Organization-wide limit.** Caps total Claude Tag spend across every channel.
378378* **Default spend limit.** A default limit applied to each channel that doesn't have its own.
from line 383
383383
384384### Usage analytics
385385
386Spend trends live at [`claude.ai/analytics/claude-tag`](https://claude.ai/analytics/claude-tag), the Claude Tag section of the Analytics dashboard, refreshed once a day. It shows total and projected month-end spend for the period you pick, spend by channel with a CSV export, DM versus channel spend, [spend by kind of work](/docs/claude-tag/admins/set-spend-limit.md#see-spend-by-kind-of-work), and any promotional credit. Billed figures are shown after your discount. Anyone with permission to view your organization's Analytics dashboard can open it; it has no controls, so use the usage page to change a limit. The two pages link to each other.
386Spend trends live at [`claude.ai/analytics/claude-tag`](https://claude.ai/analytics/claude-tag), the Claude Tag section of the Analytics dashboard, refreshed once a day. It shows total and projected month-end spend for the period you pick, spend by channel with a CSV export, DM versus channel spend, [spend by kind of work](https://claude.com/docs/claude-tag/admins/set-spend-limit.md#see-spend-by-kind-of-work), and any promotional credit. Billed figures are shown after your discount. Anyone with permission to view your organization's Analytics dashboard can open it; it has no controls, so use the usage page to change a limit. The two pages link to each other.
387387
388388When the period you pick falls within the current month, the **Spend by channel** table shows a **Billed** column and a **List price** column. Usage covered by a promotional credit shows as \$0.00 under **Billed** and at its list price under **List price**.
389389
from line 393
393393
394394A member whose custom role includes the permission is a Claude Tag admin. A Claude Tag admin can:
395395
396* Create and edit [bundles](/docs/claude-tag/admins/add-connections.md), including their credentials, domain entries, and repository grants, and attach bundles to the organization, a workspace, or a channel
396* Create and edit [bundles](https://claude.com/docs/claude-tag/admins/add-connections.md), including their credentials, domain entries, and repository grants, and attach bundles to the organization, a workspace, or a channel
397397* Edit workspace and channel settings at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), such as custom instructions and the default model
398398* Turn Claude on or off for a workspace or a channel with its **Enable Claude Tag** switch, or for every channel with the **Respond in all channels** switch on the **Slack** page
399399* Add and remove [channel managers](#delegate-channel-setup-to-channel-managers), if the role also sets **Identity & Access** to **Can manage**
400* Set up [**Managed by**](/docs/claude-tag/admins/managed-by.md) for a channel, on the **Admin** tab of the channel's Configure page
401* Open [on-call setup](/docs/claude-tag/admins/setup-oncall.md) at [`claude.ai/oncall`](https://claude.ai/oncall)
400* Set up [**Managed by**](https://claude.com/docs/claude-tag/admins/managed-by.md) for a channel, on the **Admin** tab of the channel's Configure page
401* Open [on-call setup](https://claude.com/docs/claude-tag/admins/setup-oncall.md) at [`claude.ai/oncall`](https://claude.ai/oncall)
402402* Set a scope's [**How should Claude work in channels with guests**](#restrict-guest-channels) setting to **Restrict** or **Channel only**; choosing **Full access** or setting a scope back to **Inherit** stays with Owners
403403
404404Some actions stay outside the permission:
405405
406406* **Owner-only**: the **Enable Claude Tag in Slack** switch, the [**Allow direct messages**](#allow-or-disable-direct-messages) toggle, the [restriction toggle](#restrict-who-can-use-claude), pairing or disconnecting workspaces, [channel name patterns](#block-or-auto-join-channels-by-name) and the bundles on them, and the [**Channels Claude can search**](#limit-which-channels-claude-can-search) setting
407* **The Claude GitHub App**: [installing the app](/docs/claude-tag/admins/configure-github.md) needs an owner of your GitHub organization
408* **Spend limits and usage analytics**: [usage analytics](#usage-analytics) is open to anyone with permission to view your organization's Analytics dashboard; [spend limits](/docs/claude-tag/admins/set-spend-limit.md) live on the usage page
407* **The Claude GitHub App**: [installing the app](https://claude.com/docs/claude-tag/admins/configure-github.md) needs an owner of your GitHub organization
408* **Spend limits and usage analytics**: [usage analytics](#usage-analytics) is open to anyone with permission to view your organization's Analytics dashboard; [spend limits](https://claude.com/docs/claude-tag/admins/set-spend-limit.md) live on the usage page
409409
410410### Give a member the Claude Tag Admin permission
411411
from line 435
435435
436436You name channel managers one channel at a time. For that channel, a channel manager sets the default model, adds repositories, manages credentials and plugins in the channel's bundle, and edits channel instructions. Every other setting at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag) stays with Owners; on the Enterprise plan, an Owner can delegate most of them through the [**Claude Tag Admin** permission](#delegate-claude-tag-administration).
437437
438A channel manager is a person. To let the members of another Slack channel write a channel's instructions, see [Manage a channel's instructions from another channel](/docs/claude-tag/admins/managed-by.md).
438A channel manager is a person. To let the members of another Slack channel write a channel's instructions, see [Manage a channel's instructions from another channel](https://claude.com/docs/claude-tag/admins/managed-by.md).
439439
440440### What a channel manager can do on the Configure page
441441
442A channel manager has to be a member of the channel in Slack. The channel's [Configure page](/docs/claude-tag/users/good-habits.md#configure-claude-for-a-channel), which opens on claude.ai from the **Configure** link in any Claude reply, is split into tabs. In a channel you assigned to them, a channel manager sees the **Default model** card on the **General** tab and the repository and access bundle cards on the **Tools and access** tab. Members without the role don't see those cards. Owners and [Claude Tag admins](#delegate-claude-tag-administration) also see an **Admin** tab, whose **Channel settings** card holds some of the channel scope's settings from admin settings.
442A channel manager has to be a member of the channel in Slack. The channel's [Configure page](https://claude.com/docs/claude-tag/users/good-habits.md#configure-claude-for-a-channel), which opens on claude.ai from the **Configure** link in any Claude reply, is split into tabs. In a channel you assigned to them, a channel manager sees the **Default model** card on the **General** tab and the repository and access bundle cards on the **Tools and access** tab. Members without the role don't see those cards. Owners and [Claude Tag admins](#delegate-claude-tag-administration) also see an **Admin** tab, whose **Channel settings** card holds some of the channel scope's settings from admin settings.
443443
444444| Setting | What a channel manager can do |
445445| :- | :- |
446446| **Default model** | Choose the model new threads in the channel start on, from the models your organization allows. **Inherit** keeps the workspace or organization default |
447447| **Repositories** | Add repositories beyond the ones your bundles already grant the channel. They can add only repositories their own GitHub account is an admin of |
448| **Access bundles** | Add, rotate, test, and remove credentials, and turn [plugins](/docs/claude-tag/admins/add-connections.md#attach-plugins) on or off, in the bundle Claude created for the channel and in any bundle they created for it. If the channel has no bundle yet, they can create one. They can't edit a bundle that an Owner or a [Claude Tag admin](#delegate-claude-tag-administration) created, or a bundle that other channels share |
448| **Access bundles** | Add, rotate, test, and remove credentials, and turn [plugins](https://claude.com/docs/claude-tag/admins/add-connections.md#attach-plugins) on or off, in the bundle Claude created for the channel and in any bundle they created for it. If the channel has no bundle yet, they can create one. They can't edit a bundle that an Owner or a [Claude Tag admin](#delegate-claude-tag-administration) created, or a bundle that other channels share |
449449
450450When a channel manager adds a credential, Claude also allows the host that credential uses. Channel managers can't change the bundle's domains or rules in any other way. A channel manager can't add, change, or rotate credentials that use Claude's own identity (mutual TLS, AWS or GCP service identity, and IAP), but can delete one from the channel's bundle, including one an Owner added. If that happens, Claude loses access to that service until an Owner or a [Claude Tag admin](#delegate-claude-tag-administration) adds the credential back.
451451
452452If you detach the channel's own bundle from the channel, its channel managers can't save settings for the channel; they see an error saying the channel's configuration was suspended by an administrator. They don't get a new bundle. Attach the bundle again to restore their access.
453453
454A channel manager can edit channel instructions even when the scope's [Channel member edits](/docs/claude-tag/admins/attach-to-scope.md#restrict-who-can-set-channel-instructions) setting is **Block**.
454A channel manager can edit channel instructions even when the scope's [Channel member edits](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#restrict-who-can-set-channel-instructions) setting is **Block**.
455455
456456Channel managers see their assigned channels at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag); organization and workspace settings are read-only for them. Tell them when you add them.
457457
from line 461
461461
462462**1. Open the channel's page**
463463
464Go to [**Claude's access > Channels**](https://claude.ai/admin-settings/claude-tag?access=channels) and open the channel's page. The channel must be a public or private channel. If it isn't listed, [add Claude to the channel](/docs/claude-tag/users/getting-started.md#add-claude-to-a-channel) in Slack first.
464Go to [**Claude's access > Channels**](https://claude.ai/admin-settings/claude-tag?access=channels) and open the channel's page. The channel must be a public or private channel. If it isn't listed, [add Claude to the channel](https://claude.com/docs/claude-tag/users/getting-started.md#add-claude-to-a-channel) in Slack first.
465465
466466**2. Add people or a group**
467467
from line 485
485485
486486### Verify a channel manager's access
487487
488In the list behind **Add managers** on the channel's page, people added directly show **Not in effect** when their access level doesn't support the role; the role works only on the **Custom roles** access level, so change the member's level on the Members page to put it into effect. An active manager sees the **Default model**, repository, and access bundle cards on the channel's [Configure page](/docs/claude-tag/users/good-habits.md#configure-claude-for-a-channel), so asking them to open that page confirms the setup.
488In the list behind **Add managers** on the channel's page, people added directly show **Not in effect** when their access level doesn't support the role; the role works only on the **Custom roles** access level, so change the member's level on the Members page to put it into effect. An active manager sees the **Default model**, repository, and access bundle cards on the channel's [Configure page](https://claude.com/docs/claude-tag/users/good-habits.md#configure-claude-for-a-channel), so asking them to open that page confirms the setup.
489489
490490### Audit channel manager activity
491491
from line 495
495495* **Credential changes.** Each credential a channel manager creates, updates, rotates, or deletes, with the Slack workspace and channel it was for and the roles that granted the permission, so you can tell a channel manager's change from an Owner's. Secrets are never included.
496496* **Configure page changes.** Which settings a channel manager saved from the Configure page, such as the default model, repositories, or channel instructions. The log records which fields changed, not the values entered.
497497
498The [**Activity** page](/docs/claude-tag/admins/audit.md) at [`claude.ai/admin-settings/claude-tag/audit`](https://claude.ai/admin-settings/claude-tag/audit) doesn't list these events; it covers scheduled work, memory, and network events.
498The [**Activity** page](https://claude.com/docs/claude-tag/admins/audit.md) at [`claude.ai/admin-settings/claude-tag/audit`](https://claude.ai/admin-settings/claude-tag/audit) doesn't list these events; it covers scheduled work, memory, and network events.
499499
500500## Permissions by role
501501
from line 511
511511| Create, edit, or delete a bundle, or choose where it applies | Yes | Only to create a bundle for an assigned channel | No |
512512| Edit a bundle's repositories, domains, or instructions | Yes | No | No |
513513| Edit a bundle's credentials or plugins | Yes | Yes, in a bundle created for an assigned channel | No |
514| Add or delete a [channel rule](/docs/claude-tag/admins/attach-to-scope.md#attach-a-bundle-to-channels-by-name), or change the bundles on one | Yes | No | No |
514| Add or delete a [channel rule](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#attach-a-bundle-to-channels-by-name), or change the bundles on one | Yes | No | No |
515515| Set guest channels to **Full access** or back to **Inherit** | Yes | No | No |
516516| Change other settings on a scope's page, such as instructions, model, and the **Enable Claude Tag** switch | Yes | No | No |
517517| Add a channel manager | Yes | No | No |
518518| Set a channel's default model or repositories from the Configure page | Yes | Yes, in assigned channels | No |
519| Set a channel's default model by asking Claude in a thread, unless the scope's [Channel member edits](/docs/claude-tag/admins/attach-to-scope.md#restrict-who-can-set-channel-instructions) setting is **Block** | Yes | Yes | Yes |
520| Turn a channel's [**Respond automatically**](/docs/claude-tag/users/when-claude-responds.md#turn-automatic-replies-on-or-off) setting on or off | Yes | Yes, in assigned channels | Yes, unless the scope's [**Channel member edits**](/docs/claude-tag/admins/attach-to-scope.md#restrict-who-can-set-channel-instructions) setting is **Block** |
519| Set a channel's default model by asking Claude in a thread, unless the scope's [Channel member edits](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#restrict-who-can-set-channel-instructions) setting is **Block** | Yes | Yes | Yes |
520| Turn a channel's [**Respond automatically**](https://claude.com/docs/claude-tag/users/when-claude-responds.md#turn-automatic-replies-on-or-off) setting on or off | Yes | Yes, in assigned channels | Yes, unless the scope's [**Channel member edits**](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#restrict-who-can-set-channel-instructions) setting is **Block** |
521521| Write channel memory | Yes, in the channel | Yes, in the channel | Yes |
522| Set channel instructions from the Configure link | Yes | Yes, in assigned channels | Yes, unless the scope's [Channel member edits](/docs/claude-tag/admins/attach-to-scope.md#restrict-who-can-set-channel-instructions) setting blocks it |
522| Set channel instructions from the Configure link | Yes | Yes, in assigned channels | Yes, unless the scope's [Channel member edits](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#restrict-who-can-set-channel-instructions) setting blocks it |
523523| Create, list, or disable a scheduled job in the channel | Yes, in the channel | Yes, in the channel | Yes |
524524| Remove Claude from a channel | Yes | Yes, with `/remove`, unless your Slack admin restricts it | Yes, with `/remove`, unless your Slack admin restricts it |
525525
from line 534
534534* **Per-user spend caps on channel work.** Spend limits apply at the organization and channel level. There's no way to cap what one member can spend in channels; one-to-one DM usage from a member who has connected a Claude account bills to that member's own seat and follows the seat's usual limits.
535535* **A switch for group DMs alone, or settings for one group DM.** You can't attach a bundle to one group DM, turn Claude off in one, or stop Claude from answering in group DMs without also stopping it in one-to-one DMs or the workspace's channels. See [Group DMs](#group-dms).
536536* **Per-channel responder allowlist.** The restriction toggle governs who can invoke Claude across the workspace; you can't narrow it to a list of people for one channel only.
537* **An open-internet switch in Claude Tag settings.** A channel sandbox reaches only allowed hosts. To let Claude reach a public site or API, an Owner or a [Claude Tag admin](#delegate-claude-tag-administration) [adds that hostname to a bundle as a domain](/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential); for broad web access, an Owner pins an [environment](/docs/claude-tag/concepts/glossary.md#environment) whose network access level is Full access on the scope. [Allow-all egress](/docs/claude-tag/admins/add-connections.md#allow-all-hosts), a `*` domain entry, admits any host on the ports it lists.
538* **A web search toggle for channels.** No setting turns web search off for channel sessions; the web search capability setting in claude.ai admin settings governs claude.ai chat, not channels. Web search runs on Anthropic's servers rather than from the channel sandbox, so Domains entries and egress settings don't govern it, and a search opens no new path out of the sandbox; search requests travel to Anthropic the same way the session's model traffic already does. See [Web search vs. network requests](/docs/claude-tag/concepts/agent-identity.md#web-search-vs-network-requests).
537* **An open-internet switch in Claude Tag settings.** A channel sandbox reaches only allowed hosts. To let Claude reach a public site or API, an Owner or a [Claude Tag admin](#delegate-claude-tag-administration) [adds that hostname to a bundle as a domain](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential); for broad web access, an Owner pins an [environment](https://claude.com/docs/claude-tag/concepts/glossary.md#environment) whose network access level is Full access on the scope. [Allow-all egress](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-all-hosts), a `*` domain entry, admits any host on the ports it lists.
538* **A web search toggle for channels.** No setting turns web search off for channel sessions; the web search capability setting in claude.ai admin settings governs claude.ai chat, not channels. Web search runs on Anthropic's servers rather than from the channel sandbox, so Domains entries and egress settings don't govern it, and a search opens no new path out of the sandbox; search requests travel to Anthropic the same way the session's model traffic already does. See [Web search vs. network requests](https://claude.com/docs/claude-tag/concepts/agent-identity.md#web-search-vs-network-requests).
539539* **A switch to turn workspace search off.** Claude can search public channels by keyword the same way any Slack user can; it can't read a channel's full history unless it's been added there. No setting turns workspace search off. The [**Channels Claude can search**](#limit-which-channels-claude-can-search) setting narrows it to channels Claude is in. No setting enables search in [channels that include guests](#restrict-guest-channels), where it's unavailable.
540540* **Session length enforcement.** Your organization's Slack session-length policy is not enforced on this surface.
541541
542542## Related resources
543543
544* [Configure per-channel access](/docs/claude-tag/admins/attach-to-scope.md): change the scopes these controls apply to
545* [How agent identity works](/docs/claude-tag/concepts/agent-identity.md): the model these controls operate on
546* [Security and data handling](/docs/claude-tag/concepts/security-and-data.md): what these controls don't cover (data flow, retention, where credentials are stored)
547* [Data lifecycle and deletion](/docs/claude-tag/concepts/data-lifecycle.md): which of these controls delete data and which only stop Claude responding
544* [Configure per-channel access](https://claude.com/docs/claude-tag/admins/attach-to-scope.md): change the scopes these controls apply to
545* [How agent identity works](https://claude.com/docs/claude-tag/concepts/agent-identity.md): the model these controls operate on
546* [Security and data handling](https://claude.com/docs/claude-tag/concepts/security-and-data.md): what these controls don't cover (data flow, retention, where credentials are stored)
547* [Data lifecycle and deletion](https://claude.com/docs/claude-tag/concepts/data-lifecycle.md): which of these controls delete data and which only stop Claude responding
548548
claude-tag/admins/set-spend-limit Changed · +12 / -12 lines
from line 10
1010
1111## How Claude Tag usage is billed
1212
13Slack users can work with Claude in channels [without holding a Claude seat](/docs/claude-tag/admins/restrict-access.md#restrict-who-can-use-claude).
13Slack users can work with Claude in channels [without holding a Claude seat](https://claude.com/docs/claude-tag/admins/restrict-access.md#restrict-who-can-use-claude).
1414
1515| Work | Bills to | Capped by |
1616| :- | :- | :- |
17| Channel work | Your organization's usage balance | The spend limit, plus any [per-channel limits](/docs/claude-tag/admins/restrict-access.md#set-spend-limits) |
18| [Group DM](/docs/claude-tag/admins/restrict-access.md#group-dms) work | Your organization's usage balance | The spend limit, plus the [**Default spend limit**](/docs/claude-tag/admins/restrict-access.md#set-spend-limits), which applies to each group DM |
19| Reading a channel or group DM, [deciding whether to reply](/docs/claude-tag/users/when-claude-responds.md#what-claude-does-with-a-channel-message), and short replies from what Claude already knows | Nothing | Not counted toward any limit. A working session Claude starts from the channel is channel work, above |
17| Channel work | Your organization's usage balance | The spend limit, plus any [per-channel limits](https://claude.com/docs/claude-tag/admins/restrict-access.md#set-spend-limits) |
18| [Group DM](https://claude.com/docs/claude-tag/admins/restrict-access.md#group-dms) work | Your organization's usage balance | The spend limit, plus the [**Default spend limit**](https://claude.com/docs/claude-tag/admins/restrict-access.md#set-spend-limits), which applies to each group DM |
19| Reading a channel or group DM, [deciding whether to reply](https://claude.com/docs/claude-tag/users/when-claude-responds.md#what-claude-does-with-a-channel-message), and short replies from what Claude already knows | Nothing | Not counted toward any limit. A working session Claude starts from the channel is channel work, above |
2020| A one-to-one DM from a member who has connected a Claude account | The sender's own seat | The seat's usual limits, not the spend limit |
21| A [one-to-one DM from a member who hasn't connected a Claude account](/docs/claude-tag/admins/restrict-access.md#direct-messages-from-members-without-a-claude-account) | Your organization's usage balance | The [limits for each member](/docs/claude-tag/admins/restrict-access.md#limits-on-direct-messages-from-members-without-a-claude-account) |
21| A [one-to-one DM from a member who hasn't connected a Claude account](https://claude.com/docs/claude-tag/admins/restrict-access.md#direct-messages-from-members-without-a-claude-account) | Your organization's usage balance | The [limits for each member](https://claude.com/docs/claude-tag/admins/restrict-access.md#limits-on-direct-messages-from-members-without-a-claude-account) |
2222
2323## Whether this step is required depends on your plan
2424
from line 68
6868
6969## Per-channel limits
7070
71Per-channel limits and the per-channel spend breakdown are on the same usage page. See [Set spend limits](/docs/claude-tag/admins/restrict-access.md#set-spend-limits) for the full set of controls.
71Per-channel limits and the per-channel spend breakdown are on the same usage page. See [Set spend limits](https://claude.com/docs/claude-tag/admins/restrict-access.md#set-spend-limits) for the full set of controls.
7272
7373## Attribute costs by channel
7474
from line 76
7676
7777The usage page at [`claude.ai/admin-settings/usage/claude-tag`](https://claude.ai/admin-settings/usage/claude-tag) shows spend broken down by channel, at list price. Usage covered by a promotional credit isn't counted there and shows as \$0.00. To see each channel's list-price spend for the current month including covered usage, use the **List price** column of the **Spend by channel** table at [`claude.ai/analytics/claude-tag`](https://claude.ai/analytics/claude-tag).
7878
79To attribute spend to teams or departments for showback or chargeback reporting, structure channels so each maps to one team or department, and give those channels [their own scopes](/docs/claude-tag/admins/attach-to-scope.md). The per-channel breakdown then reads as your per-team report, and per-channel spend limits act as team-level budgets.
79To attribute spend to teams or departments for showback or chargeback reporting, structure channels so each maps to one team or department, and give those channels [their own scopes](https://claude.com/docs/claude-tag/admins/attach-to-scope.md). The per-channel breakdown then reads as your per-team report, and per-channel spend limits act as team-level budgets.
8080
81Organizations on a Claude Enterprise plan can also pull channel spend per Slack user from the Analytics API, which attributes Claude's channel work to individual Slack users. See [Attribute costs to users](/docs/claude-tag/admins/attribute-costs.md).
81Organizations on a Claude Enterprise plan can also pull channel spend per Slack user from the Analytics API, which attributes Claude's channel work to individual Slack users. See [Attribute costs to users](https://claude.com/docs/claude-tag/admins/attribute-costs.md).
8282
83One-to-one DMs are separate. A DM from a member who has connected a Claude account bills to the sender's own seat, not to the organization's usage balance. A [DM from a member who hasn't connected a Claude account](/docs/claude-tag/admins/restrict-access.md#direct-messages-from-members-without-a-claude-account) can bill to the organization's usage balance.
83One-to-one DMs are separate. A DM from a member who has connected a Claude account bills to the sender's own seat, not to the organization's usage balance. A [DM from a member who hasn't connected a Claude account](https://claude.com/docs/claude-tag/admins/restrict-access.md#direct-messages-from-members-without-a-claude-account) can bill to the organization's usage balance.
8484
8585## See spend by kind of work
8686
from line 91
9191* **Scheduled**: recurring scheduled work
9292* **Monitoring**: Claude reading the channels it belongs to, which isn't billed
9393
94Reading a channel Claude belongs to, whether or not anyone tags it, doesn't draw from the usage balance. When Claude starts a working session on its own, that session bills to the balance under Proactive. To stop Claude from starting work on its own in a channel, turn off the channel's [Respond automatically](/docs/claude-tag/users/when-claude-responds.md#turn-automatic-replies-on-or-off) setting. One-to-one DMs from members who have connected a Claude account aren't included, because they bill to the sender's seat.
94Reading a channel Claude belongs to, whether or not anyone tags it, doesn't draw from the usage balance. When Claude starts a working session on its own, that session bills to the balance under Proactive. To stop Claude from starting work on its own in a channel, turn off the channel's [Respond automatically](https://claude.com/docs/claude-tag/users/when-claude-responds.md#turn-automatic-replies-on-or-off) setting. One-to-one DMs from members who have connected a Claude account aren't included, because they bill to the sender's seat.
9595
9696## Related resources
9797
98* [Verify your setup](/docs/claude-tag/admins/setup-overview#verify-your-setup): run a first task in a channel
99* [Restrict where Claude Tag operates](/docs/claude-tag/admins/restrict-access.md#set-spend-limits): per-channel limits and the usage page in full
98* [Verify your setup](https://claude.com/docs/claude-tag/admins/setup-overview#verify-your-setup): run a first task in a channel
99* [Restrict where Claude Tag operates](https://claude.com/docs/claude-tag/admins/restrict-access.md#set-spend-limits): per-channel limits and the usage page in full
100100
claude-tag/admins/setup-oncall Changed · +9 / -9 lines
from line 11
1111On-call is available on the Team and Enterprise plans. Who can open [`claude.ai/oncall`](https://claude.ai/oncall) and run setup depends on your plan.
1212
1313* **Team plan:** any member of your organization. A change that affects the whole organization saves only if your account has permission to make it.
14* **Enterprise plan:** an Owner or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration), meaning a member whose custom role sets **Claude Tag Admin** to **Can manage**. Other members, including those with the built-in **Admin** role and [channel managers](/docs/claude-tag/admins/restrict-access.md#delegate-channel-setup-to-channel-managers), don't see **On-call** in the **Code** sidebar and can't open setup.
14* **Enterprise plan:** an Owner or a [Claude Tag admin](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration), meaning a member whose custom role sets **Claude Tag Admin** to **Can manage**. Other members, including those with the built-in **Admin** role and [channel managers](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-channel-setup-to-channel-managers), don't see **On-call** in the **Code** sidebar and can't open setup.
1515
1616## What an on-call is
1717
18Your organization's on-call is an [Access bundle](/docs/claude-tag/concepts/glossary.md#access-bundle) carrying the connections, repositories, and skills Claude uses for incident work. The bundle attaches to the channels you pick during setup, and any [routines](/docs/claude-tag/concepts/glossary.md#routine) you schedule in those channels, like a morning incident digest, run alongside it. Setup builds the bundle, and after you deploy you edit it like any other bundle in [Give Claude access](/docs/claude-tag/admins/add-connections.md).
18Your organization's on-call is an [Access bundle](https://claude.com/docs/claude-tag/concepts/glossary.md#access-bundle) carrying the connections, repositories, and skills Claude uses for incident work. The bundle attaches to the channels you pick during setup, and any [routines](https://claude.com/docs/claude-tag/concepts/glossary.md#routine) you schedule in those channels, like a morning incident digest, run alongside it. Setup builds the bundle, and after you deploy you edit it like any other bundle in [Give Claude access](https://claude.com/docs/claude-tag/admins/add-connections.md).
1919
2020Setup offers two ways for Claude to work, and you can use either or both.
2121
from line 22
2222* **Watch your alerts.** Claude watches your monitoring tools and posts what it finds in a channel you choose.
2323* **Join incident channels.** Claude joins the incident channels you pick and investigates alongside your team, without waiting to be tagged. A channel-name prefix, like `incident-`, has Claude join new public channels that match.
2424
25On-call work is billed to your organization as usage. You can cap it with a monthly spend limit. [Set a spend limit](/docs/claude-tag/admins/set-spend-limit.md) covers what counts toward the limit and what happens when it's reached.
25On-call work is billed to your organization as usage. You can cap it with a monthly spend limit. [Set a spend limit](https://claude.com/docs/claude-tag/admins/set-spend-limit.md) covers what counts toward the limit and what happens when it's reached.
2626
2727## Run setup
2828
from line 49
4949
5050## After you deploy
5151
52Claude is on call in the channels you chose, and, if you set a channel-name prefix, it joins new public channels that match as they're created. The on-call's connections, repositories, and skills make up its [Access bundle](/docs/claude-tag/concepts/glossary.md#access-bundle). To change the on-call later, go to [`claude.ai/oncall`](https://claude.ai/oncall). Outside setup, these roles manage the on-call's Access bundle:
52Claude is on call in the channels you chose, and, if you set a channel-name prefix, it joins new public channels that match as they're created. The on-call's connections, repositories, and skills make up its [Access bundle](https://claude.com/docs/claude-tag/concepts/glossary.md#access-bundle). To change the on-call later, go to [`claude.ai/oncall`](https://claude.ai/oncall). Outside setup, these roles manage the on-call's Access bundle:
5353
54* **Owner:** edit the bundle in [Give Claude access](/docs/claude-tag/admins/add-connections.md), [set per-channel access](/docs/claude-tag/admins/attach-to-scope.md), and [change the monthly spend limit](/docs/claude-tag/admins/set-spend-limit.md)
55* **[Claude Tag admin](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration), on the Enterprise plan:** edit the bundle and set per-channel access
54* **Owner:** edit the bundle in [Give Claude access](https://claude.com/docs/claude-tag/admins/add-connections.md), [set per-channel access](https://claude.com/docs/claude-tag/admins/attach-to-scope.md), and [change the monthly spend limit](https://claude.com/docs/claude-tag/admins/set-spend-limit.md)
55* **[Claude Tag admin](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration), on the Enterprise plan:** edit the bundle and set per-channel access
5656
5757## Related resources
5858
59* [Set up Claude Tag](/docs/claude-tag/admins/setup-overview): the standard setup steps, and how to verify your setup afterward
60* [How agent identity works](/docs/claude-tag/concepts/agent-identity.md): why Claude gets its own accounts in your tools
61* [Watch monitors and alerts](/docs/claude-tag/users/use-cases/watch-monitors.md): what Claude's monitoring work looks like in a channel
59* [Set up Claude Tag](https://claude.com/docs/claude-tag/admins/setup-overview): the standard setup steps, and how to verify your setup afterward
60* [How agent identity works](https://claude.com/docs/claude-tag/concepts/agent-identity.md): why Claude gets its own accounts in your tools
61* [Watch monitors and alerts](https://claude.com/docs/claude-tag/users/use-cases/watch-monitors.md): what Claude's monitoring work looks like in a channel
6262
claude-tag/admins/setup-overview Changed · +42 / -42 lines
from line 24
2424> | Prerequisite | Why you need it | If you don't have it |
2525> | :- | :- | :- |
2626> | A **Team or Enterprise plan** on claude.ai | Claude Tag is available on Team and Enterprise plans, on Anthropic's first-party service. It isn't available on individual plans (Free, Pro, or Max), or for third-party deployments. | Start a Team or Enterprise plan at [claude.com/pricing](https://claude.com/pricing) |
27> | A Claude organization **without Zero Data Retention (ZDR), customer-managed encryption (CMEK), or the HIPAA configuration for Claude Code (local mode) and Cowork (local mode)** | Claude Tag stores channel memory and session transcripts, which ZDR doesn't permit. A CMEK policy and the HIPAA configuration don't allow Claude Tag either. | Claude Tag isn't available to organizations with any of these. See [Healthcare organizations](/docs/claude-tag/admins/healthcare.md#plan-and-organization-requirements) |
27> | A Claude organization **without Zero Data Retention (ZDR), customer-managed encryption (CMEK), or the HIPAA configuration for Claude Code (local mode) and Cowork (local mode)** | Claude Tag stores channel memory and session transcripts, which ZDR doesn't permit. A CMEK policy and the HIPAA configuration don't allow Claude Tag either. | Claude Tag isn't available to organizations with any of these. See [Healthcare organizations](https://claude.com/docs/claude-tag/admins/healthcare.md#plan-and-organization-requirements) |
2828> | **Routines** enabled for your Claude organization | Until it is, Claude answers every mention and DM with a reply that it's unavailable and does no work. | An admin turns on [**Admin settings > Capabilities > Remote sessions > Routines**](https://claude.ai/admin-settings/capabilities) |
2929> | **Owner** role in the Claude organization you're setting up | Setup pairs a workspace and turns Claude Tag on, and only an Owner can do either. Roles are per organization, so being an Owner elsewhere doesn't carry over. | Ask an Owner to run setup, or have one promote you at [`claude.ai/admin-settings/members`](https://claude.ai/admin-settings/members) |
3030> | A **Slack workspace admin** | Running `@Claude connect` requires a Slack workspace admin; installing the app usually does too. | If that's someone else, [send them the install request](#if-you-re-not-the-slack-workspace-admin) early (app approval can take time), and plan to be online together when you pair; pairing codes expire 15 minutes after they're issued |
from line 31
3131> | **Usage credits** (Team plans) | Channel work draws from your organization's usage balance; on a Team plan nothing runs until credits are loaded. | Buy credits at [`claude.ai/admin-settings/usage`](https://claude.ai/admin-settings/usage) |
3232> | A **public channel** for Claude to join | The launch step asks you to select at least one public channel, and you can [verify your setup](#verify-your-setup) there. | Create a public Slack channel for the pilot, or pick any existing one |
3333>
34> If any of your services restrict traffic by IP, file the [network requirements](/docs/claude-tag/admins/network-requirements.md) request with your network team early; in many organizations, IP allowlist changes take days to approve.
34> If any of your services restrict traffic by IP, file the [network requirements](https://claude.com/docs/claude-tag/admins/network-requirements.md) request with your network team early; in many organizations, IP allowlist changes take days to approve.
3535>
3636> If you see **View setup guide** and **Go to chat** buttons instead of **Start setup**, your signed-in account can't run setup. See [Common setup issues](#common-setup-issues).
3737
3838> [!NOTE]
3939>
40> If your team already uses the earlier Claude in Slack, the same steps apply and your existing app stays; see [Migrate from the earlier app](/docs/claude-tag/admins/migrate-from-earlier.md) for what changes.
40> If your team already uses the earlier Claude in Slack, the same steps apply and your existing app stays; see [Migrate from the earlier app](https://claude.com/docs/claude-tag/admins/migrate-from-earlier.md) for what changes.
4141
4242## Pair your Slack workspace
4343
from line 49
4949
5050Click **Add the Claude app** on the setup page to open the listing, then click **Add to Slack** and approve the permissions. If the app is already installed, click **Add to Slack** anyway: you reinstall over the existing app with its current permissions and keep your settings.
5151
52On Slack Enterprise Grid, installing takes two Slack actions. See [Set up Claude Tag on Enterprise Grid](/docs/claude-tag/admins/workspaces.md#set-up-claude-tag-on-enterprise-grid) for the steps.
52On Slack Enterprise Grid, installing takes two Slack actions. See [Set up Claude Tag on Enterprise Grid](https://claude.com/docs/claude-tag/admins/workspaces.md#set-up-claude-tag-on-enterprise-grid) for the steps.
5353
5454**2. Send @Claude connect in any channel**
5555
from line 79
7979
8080Pairing covers the whole workspace. Claude doesn't answer mentions in Slack until you finish [Launch Claude Tag](#launch-claude-tag). A mention before then gets a notice that starts "Claude isn't on in this channel yet."
8181
82After launch, people can tag Claude in any channel it has joined. To keep Claude to certain channels, see [Limit Claude Tag to specific channels](/docs/claude-tag/admins/restrict-access.md#limit-claude-tag-to-specific-channels).
82After launch, people can tag Claude in any channel it has joined. To keep Claude to certain channels, see [Limit Claude Tag to specific channels](https://claude.com/docs/claude-tag/admins/restrict-access.md#limit-claude-tag-to-specific-channels).
8383
8484> **If you're not the Slack workspace admin**
8585>
from line 91
9191
9292> **If your Slack is on Enterprise Grid**
9393>
94> When a Slack Org Owner or Org Admin sends `@Claude connect`, the reply includes two codes. One begins `workspace_` and pairs only the workspace the admin sent the command in, and one begins `enterprise_` and pairs the whole Grid. Paste the `enterprise_` code. See [Pair an Enterprise Grid](/docs/claude-tag/admins/workspaces.md#pair-an-enterprise-grid).
94> When a Slack Org Owner or Org Admin sends `@Claude connect`, the reply includes two codes. One begins `workspace_` and pairs only the workspace the admin sent the command in, and one begins `enterprise_` and pairs the whole Grid. Paste the `enterprise_` code. See [Pair an Enterprise Grid](https://claude.com/docs/claude-tag/admins/workspaces.md#pair-an-enterprise-grid).
9595
9696## Buy usage credits
9797
from line 110
110110The spend limit caps how much of your organization's usage balance Claude Tag can use each month.
111111
112112* **Channel work**: draws from that balance, not from individual seats
113* **Direct messages (DMs)**: One-to-one DMs from members who have connected a Claude account run on the member's own claude.ai account and aren't capped by this limit. For members who haven't connected one, see [Direct messages from members without a Claude account](/docs/claude-tag/admins/restrict-access.md#direct-messages-from-members-without-a-claude-account).
113* **Direct messages (DMs)**: One-to-one DMs from members who have connected a Claude account run on the member's own claude.ai account and aren't capped by this limit. For members who haven't connected one, see [Direct messages from members without a Claude account](https://claude.com/docs/claude-tag/admins/restrict-access.md#direct-messages-from-members-without-a-claude-account).
114114
115115**1. Set monthly spend limits**
116116
117117If setup included the [**Buy usage credits**](#buy-usage-credits) step, the launch step has no spend limit picker. Set a limit after launch at [`claude.ai/admin-settings/usage/claude-tag`](https://claude.ai/admin-settings/usage/claude-tag).
118118
119Otherwise, choose from `$500`, `$1,000`, `$2,500`, `$5,000`, **Unlimited**, or **Custom** (a US-dollar amount up to `$1,000,000`). `$2,500` is preselected unless your organization already has a Claude Tag spend limit. Usage bills against your organization's balance up to that amount each month. See [Set a spend limit](/docs/claude-tag/admins/set-spend-limit.md) for what counts toward the cap, per-channel limits, and what users see when it's reached.
119Otherwise, choose from `$500`, `$1,000`, `$2,500`, `$5,000`, **Unlimited**, or **Custom** (a US-dollar amount up to `$1,000,000`). `$2,500` is preselected unless your organization already has a Claude Tag spend limit. Usage bills against your organization's balance up to that amount each month. See [Set a spend limit](https://claude.com/docs/claude-tag/admins/set-spend-limit.md) for what counts toward the cap, per-channel limits, and what users see when it's reached.
120120
121121**2. Add Claude to your channels**
122122
from line 145
145145
146146After launch, Claude reaches your other tools through personal connectors and through access you give Claude itself.
147147
148* **Personal connectors**: Claude can use a member's own claude.ai connectors for that member's requests in a channel. You don't connect anything for these. See [Personal connectors in channels](/docs/claude-tag/concepts/personal-connectors.md) for how members approve that use.
149* **Access you give Claude**: you connect a tool on the Claude Tag admin page with credentials that belong to Claude rather than to a person. Claude then works in that tool and can use it for [work it starts on its own](/docs/claude-tag/users/proactivity.md).
148* **Personal connectors**: Claude can use a member's own claude.ai connectors for that member's requests in a channel. You don't connect anything for these. See [Personal connectors in channels](https://claude.com/docs/claude-tag/concepts/personal-connectors.md) for how members approve that use.
149* **Access you give Claude**: you connect a tool on the Claude Tag admin page with credentials that belong to Claude rather than to a person. Claude then works in that tool and can use it for [work it starts on its own](https://claude.com/docs/claude-tag/users/proactivity.md).
150150
151151### Connect GitHub
152152
153153When your organization hasn't installed the Claude GitHub App, the setup page offers a **Connect GitHub** step after you pair your workspace. To connect GitHub later, click **Skip** on that step.
154154
155Connect GitHub if your team will give Claude code work. Claude reaches GitHub through the [Claude GitHub App](/docs/claude-tag/admins/configure-github.md). Only an owner of your GitHub organization can install it.
155Connect GitHub if your team will give Claude code work. Claude reaches GitHub through the [Claude GitHub App](https://claude.com/docs/claude-tag/admins/configure-github.md). Only an owner of your GitHub organization can install it.
156156
157[Link your GitHub organization](/docs/claude-tag/admins/configure-github.md#link-your-github-organization) to install the app, then [grant repositories](/docs/claude-tag/admins/configure-github.md#grant-repository-access).
157[Link your GitHub organization](https://claude.com/docs/claude-tag/admins/configure-github.md#link-your-github-organization) to install the app, then [grant repositories](https://claude.com/docs/claude-tag/admins/configure-github.md#grant-repository-access).
158158
159159### Create accounts for Claude's other tools
160160
161161**Where:** your company's email admin console and each tool you're connecting, then the Claude Tag admin page at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag).
162162
163In each tool other than GitHub, Claude works through an account of its own, so you can see what it did in that tool's logs and cut off its access without touching anyone else's. You give Claude an email address, add it to each tool as a member, then sign in as Claude and create an API key. [How agent identity works](/docs/claude-tag/concepts/agent-identity.md) has the full model.
163In each tool other than GitHub, Claude works through an account of its own, so you can see what it did in that tool's logs and cut off its access without touching anyone else's. You give Claude an email address, add it to each tool as a member, then sign in as Claude and create an API key. [How agent identity works](https://claude.com/docs/claude-tag/concepts/agent-identity.md) has the full model.
164164
165165Work through one tool end to end before starting the next.
166166
from line 176
176176
177177**3. Create an API key in Claude's account**
178178
179Sign in to the tool as Claude and create the credential that tool's [connection guide](/docs/claude-tag/admins/connections/overview) names, usually an API key or personal access token from the tool's settings. Copy it. The credential belongs to Claude's account, so Claude's actions show up in the tool's audit log under Claude's name.
179Sign in to the tool as Claude and create the credential that tool's [connection guide](https://claude.com/docs/claude-tag/admins/connections/overview) names, usually an API key or personal access token from the tool's settings. Copy it. The credential belongs to Claude's account, so Claude's actions show up in the tool's audit log under Claude's name.
180180
181181**4. Add the key as a connector**
182182
183Go to [**Organization settings > Claude Tag**](https://claude.ai/admin-settings/claude-tag). Under **Claude's access**, select the **Connectors** tab and click **Add**. Then [add a connector](/docs/claude-tag/admins/add-connections.md#add-a-connection) for the tool and paste the key you created. The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](/docs/claude-tag/admins/add-connections.md#add-a-connection) before you save the connector.
183Go to [**Organization settings > Claude Tag**](https://claude.ai/admin-settings/claude-tag). Under **Claude's access**, select the **Connectors** tab and click **Add**. Then [add a connector](https://claude.com/docs/claude-tag/admins/add-connections.md#add-a-connection) for the tool and paste the key you created. The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](https://claude.com/docs/claude-tag/admins/add-connections.md#add-a-connection) before you save the connector.
184184
185185For the next tool, start again from **Add Claude to the tool as a member**. Claude keeps the one email address for every tool.
186186
187See [Give Claude access](/docs/claude-tag/admins/add-connections.md) for which services to connect first and what access to give each account, and the [per-service connection guides](/docs/claude-tag/admins/connections/overview) for the credential fields per tool.
187See [Give Claude access](https://claude.com/docs/claude-tag/admins/add-connections.md) for which services to connect first and what access to give each account, and the [per-service connection guides](https://claude.com/docs/claude-tag/admins/connections/overview) for the credential fields per tool.
188188
189189## Verify your setup
190190
from line 206
206206
207207**Passed when:** Claude replies in a thread under your message. The reply ends with a footer naming the model and a **Configure** link.
208208
209**If not:** a notice that starts "Claude isn't on in this channel yet" means you haven't finished [Launch Claude Tag](#launch-claude-tag). No reply at all means the channel isn't covered. Go to [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), check that the workspace appears on the **Channels** tab under **Claude's access**, then see [Nothing responds](/docs/claude-tag/admins/troubleshooting.md#nothing-responds).
209**If not:** a notice that starts "Claude isn't on in this channel yet" means you haven't finished [Launch Claude Tag](#launch-claude-tag). No reply at all means the channel isn't covered. Go to [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), check that the workspace appears on the **Channels** tab under **Claude's access**, then see [Nothing responds](https://claude.com/docs/claude-tag/admins/troubleshooting.md#nothing-responds).
210210
211211### Check a tool you connected
212212
from line 226
226226
227227**Passed when:** the first reply lists the tools you connected, the second comes back with data, and the request appears in that tool's audit log under Claude's account.
228228
229**If not:** when a tool is missing from the list, go to [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag) and open the **Connectors** tab under **Claude's access**. If the tool isn't there, [connect it again](/docs/claude-tag/admins/add-connections.md#add-a-connection). If it is, open its page and check that it applies to the channel you asked in. "I can't reach…" in a thread you started before connecting means Claude wasn't told about the new connector; start a fresh thread. Anything else, see [Access and connections](/docs/claude-tag/admins/troubleshooting.md#access-and-connections).
229**If not:** when a tool is missing from the list, go to [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag) and open the **Connectors** tab under **Claude's access**. If the tool isn't there, [connect it again](https://claude.com/docs/claude-tag/admins/add-connections.md#add-a-connection). If it is, open its page and check that it applies to the channel you asked in. "I can't reach…" in a thread you started before connecting means Claude wasn't told about the new connector; start a fresh thread. Anything else, see [Access and connections](https://claude.com/docs/claude-tag/admins/troubleshooting.md#access-and-connections).
230230
231231### Check GitHub
232232
from line 238
238238
239239**Passed when:** Claude lists the pull requests.
240240
241**If not:** see [GitHub doesn't work in this channel](/docs/claude-tag/admins/troubleshooting.md#github-doesn%E2%80%99t-work-in-this-channel).
241**If not:** see [GitHub doesn't work in this channel](https://claude.com/docs/claude-tag/admins/troubleshooting.md#github-doesn%E2%80%99t-work-in-this-channel).
242242
243For more tasks to hand Claude once the checks pass, see the [use case library](/docs/claude-tag/users/use-cases.md).
243For more tasks to hand Claude once the checks pass, see the [use case library](https://claude.com/docs/claude-tag/users/use-cases.md).
244244
245245## After setup
246246
247247After launch, you change Claude Tag from [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag). Organization-wide settings such as **Enable Claude Tag in Slack**, **Direct messages**, and **Model** sit at the top of the page. Below them, **Claude's access** holds what Claude can reach, in four tabs:
248248
249* **Bundles**: named sets of connectors, repositories, domains, plugins, and instructions that you add to more than one place. See [bundle](/docs/claude-tag/concepts/glossary.md#access-bundle) in the glossary.
249* **Bundles**: named sets of connectors, repositories, domains, plugins, and instructions that you add to more than one place. See [bundle](https://claude.com/docs/claude-tag/concepts/glossary.md#access-bundle) in the glossary.
250250* **Connectors**: each service Claude connects to, its credentials, and where Claude may use each one
251251* **Skills and plugins**: the skills and plugins Claude uses anywhere in Slack
252252* **Channels**: **Slack**, whose page holds the settings for every workspace and channel, then each connected workspace with its channel rules and channels
from line 255
255255
256256| To do this | Go to | Learn more |
257257| :- | :- | :- |
258| Change the model Claude replies with | **Model** at the top of the Claude Tag page to change the default everywhere, or **Model** on a workspace's or channel's page. | [Choose the model for a scope](/docs/claude-tag/admins/customize.md#choose-the-model-for-a-scope) |
259| Give Claude standing instructions | **Slack instructions** on the **Slack** page for every channel, or **Channel instructions** on one channel's page for that channel only. | [Customize](/docs/claude-tag/admins/customize.md) |
260| Connect a tool | **Add** on the **Connectors** tab. | [Give Claude access](/docs/claude-tag/admins/add-connections.md) |
261| Let Claude reach a site or API that has no credential | **Add > Domain** under **What's in it** on a bundle's page. | [Allow a host without a credential](/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential) |
262| Grant more repositories | The **GitHub** page, which you open from the **Connectors** tab. | [Configure GitHub access](/docs/claude-tag/admins/configure-github.md) |
263| Give one channel more than the default | The channel's page, from the **Channels** tab: **Add** under **Claude's access**, then pick what to add, such as **Connector**, **Domain**, or **Bundle**. | [Configure per-channel access](/docs/claude-tag/admins/attach-to-scope.md) |
264| Limit where Claude works or who can use it | | [Restrict where Claude operates](/docs/claude-tag/admins/restrict-access.md) |
265| Require review of personal connector results | On the Enterprise plan, the **Personal connectors** section of the admin page. | [Admin controls for personal connectors](/docs/claude-tag/concepts/personal-connectors.md#admin-controls-for-personal-connectors) |
266| Pair another workspace, or disconnect one | **Connected workspaces** on the **Slack** page. Disconnecting permanently deletes the workspace's Claude data. See [Data lifecycle and deletion](/docs/claude-tag/concepts/data-lifecycle.md). | [Manage workspaces](/docs/claude-tag/admins/workspaces.md) |
267| Change the spend limit | [`claude.ai/admin-settings/usage/claude-tag`](https://claude.ai/admin-settings/usage/claude-tag). | [Set a spend limit](/docs/claude-tag/admins/set-spend-limit.md) |
268| Turn Claude Tag off | The **Enable Claude Tag in Slack** switch at the top of the Claude Tag page. It also turns off direct messages. | [Turn Claude Tag on or off](/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-and-set-the-version-for-a-scope) |
269| Bring in the first users | | [Getting started for users](/docs/claude-tag/users/getting-started.md) |
258| Change the model Claude replies with | **Model** at the top of the Claude Tag page to change the default everywhere, or **Model** on a workspace's or channel's page. | [Choose the model for a scope](https://claude.com/docs/claude-tag/admins/customize.md#choose-the-model-for-a-scope) |
259| Give Claude standing instructions | **Slack instructions** on the **Slack** page for every channel, or **Channel instructions** on one channel's page for that channel only. | [Customize](https://claude.com/docs/claude-tag/admins/customize.md) |
260| Connect a tool | **Add** on the **Connectors** tab. | [Give Claude access](https://claude.com/docs/claude-tag/admins/add-connections.md) |
261| Let Claude reach a site or API that has no credential | **Add > Domain** under **What's in it** on a bundle's page. | [Allow a host without a credential](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential) |
262| Grant more repositories | The **GitHub** page, which you open from the **Connectors** tab. | [Configure GitHub access](https://claude.com/docs/claude-tag/admins/configure-github.md) |
263| Give one channel more than the default | The channel's page, from the **Channels** tab: **Add** under **Claude's access**, then pick what to add, such as **Connector**, **Domain**, or **Bundle**. | [Configure per-channel access](https://claude.com/docs/claude-tag/admins/attach-to-scope.md) |
264| Limit where Claude works or who can use it | | [Restrict where Claude operates](https://claude.com/docs/claude-tag/admins/restrict-access.md) |
265| Require review of personal connector results | On the Enterprise plan, the **Personal connectors** section of the admin page. | [Admin controls for personal connectors](https://claude.com/docs/claude-tag/concepts/personal-connectors.md#admin-controls-for-personal-connectors) |
266| Pair another workspace, or disconnect one | **Connected workspaces** on the **Slack** page. Disconnecting permanently deletes the workspace's Claude data. See [Data lifecycle and deletion](https://claude.com/docs/claude-tag/concepts/data-lifecycle.md). | [Manage workspaces](https://claude.com/docs/claude-tag/admins/workspaces.md) |
267| Change the spend limit | [`claude.ai/admin-settings/usage/claude-tag`](https://claude.ai/admin-settings/usage/claude-tag). | [Set a spend limit](https://claude.com/docs/claude-tag/admins/set-spend-limit.md) |
268| Turn Claude Tag off | The **Enable Claude Tag in Slack** switch at the top of the Claude Tag page. It also turns off direct messages. | [Turn Claude Tag on or off](https://claude.com/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-and-set-the-version-for-a-scope) |
269| Bring in the first users | | [Getting started for users](https://claude.com/docs/claude-tag/users/getting-started.md) |
270270
271271## Common setup issues
272272
273Every message setup can show instead of the next step, matched to its fix, is in [Setup errors](/docs/claude-tag/admins/troubleshooting.md#setup-errors) on the troubleshooting page.
273Every message setup can show instead of the next step, matched to its fix, is in [Setup errors](https://claude.com/docs/claude-tag/admins/troubleshooting.md#setup-errors) on the troubleshooting page.
274274
275275## Related resources
276276
277* [How Claude Tag works](/docs/claude-tag/concepts/how-it-works.md): what happens between a mention and a reply
278* [How agent identity works](/docs/claude-tag/concepts/agent-identity.md): why Claude gets its own accounts, and what that means for audit logs and access
279* [Configure per-channel access](/docs/claude-tag/admins/attach-to-scope.md#how-scopes-inherit): how Slack, workspaces, and channels inherit bundles
280* [Claude Tag settings map](/docs/claude-tag/concepts/settings-map.md): every setting, and whether admins, channel members, or users control it
281* [Glossary](/docs/claude-tag/concepts/glossary.md): bundle, scope, session, and the other terms on this page
282* [Network requirements](/docs/claude-tag/admins/network-requirements.md): what your services must allowlist so Claude can reach them
277* [How Claude Tag works](https://claude.com/docs/claude-tag/concepts/how-it-works.md): what happens between a mention and a reply
278* [How agent identity works](https://claude.com/docs/claude-tag/concepts/agent-identity.md): why Claude gets its own accounts, and what that means for audit logs and access
279* [Configure per-channel access](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#how-scopes-inherit): how Slack, workspaces, and channels inherit bundles
280* [Claude Tag settings map](https://claude.com/docs/claude-tag/concepts/settings-map.md): every setting, and whether admins, channel members, or users control it
281* [Glossary](https://claude.com/docs/claude-tag/concepts/glossary.md): bundle, scope, session, and the other terms on this page
282* [Network requirements](https://claude.com/docs/claude-tag/admins/network-requirements.md): what your services must allowlist so Claude can reach them
283283* [Claude Tag in production at Anthropic](https://claude.com/blog/ai-ci-cd-on-call): how Anthropic runs Claude Tag as its first responder for CI/CD failures
284284
claude-tag/admins/skills-repo Changed · +8 / -8 lines
from line 24
2424
2525**3. Grant Claude write access to the repository**
2626
27At [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), open a [bundle](/docs/claude-tag/admins/add-connections.md) on the **Bundles** tab under **Claude's access**. In its **What's in it** section, select **Add**, then **Repository**, and pick the repository. The Claude GitHub App must already be linked to your GitHub organization; see [Configure GitHub access](/docs/claude-tag/admins/configure-github.md).
27At [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), open a [bundle](https://claude.com/docs/claude-tag/admins/add-connections.md) on the **Bundles** tab under **Claude's access**. In its **What's in it** section, select **Add**, then **Repository**, and pick the repository. The Claude GitHub App must already be linked to your GitHub organization; see [Configure GitHub access](https://claude.com/docs/claude-tag/admins/configure-github.md).
2828
2929**4. Add the plugins to the bundle**
3030
31On the same bundle's page, select **Add**, then **Plugin**, and pick each plugin from your new marketplace. A plugin isn't in the bundle until you add it, and the bundle's plugins apply wherever the bundle applies; see [Choose where a bundle applies](/docs/claude-tag/admins/attach-to-scope.md#attach-the-bundle) and [Attach plugins](/docs/claude-tag/admins/add-connections.md#attach-plugins).
31On the same bundle's page, select **Add**, then **Plugin**, and pick each plugin from your new marketplace. A plugin isn't in the bundle until you add it, and the bundle's plugins apply wherever the bundle applies; see [Choose where a bundle applies](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#attach-the-bundle) and [Attach plugins](https://claude.com/docs/claude-tag/admins/add-connections.md#attach-plugins).
3232
3333**You'll see:** the repository and the plugins appear in the bundle's **What's in it** table, with **Repository** or **Plugin** as each row's type.
3434
from line 44
4444| The marketplace syncs | On push to the default branch, the updated plugin syncs to your organization automatically |
4545| New threads pick it up | The next thread in any covered channel uses the updated skill |
4646
47Claude opens the PR, and you merge it. To require a person's approval before a change reaches the default branch, see [Require a second approval on Claude's pull requests](/docs/claude-tag/admins/configure-github.md#require-a-second-approval-on-claude%E2%80%99s-pull-requests).
47Claude opens the PR, and you merge it. To require a person's approval before a change reaches the default branch, see [Require a second approval on Claude's pull requests](https://claude.com/docs/claude-tag/admins/configure-github.md#require-a-second-approval-on-claude%E2%80%99s-pull-requests).
4848
4949## Prompt Claude to propose updates
5050
from line 72
7272* The same layout inside a single top-level folder
7373* For a single skill, a `SKILL.md` at the top level whose frontmatter declares the plugin's components
7474
75An archive with no manifest, with more than one `plugin.json`, or with the manifest anywhere else is rejected at upload. After upload, the plugin is in your organization's catalog but not attached anywhere. To make it available in channels, add it to a bundle with **Add**, then **Plugin**, on the bundle's page, or add it for all of Slack from the **Skills and plugins** tab under **Claude's access**; see [Attach plugins](/docs/claude-tag/admins/add-connections.md#attach-plugins).
75An archive with no manifest, with more than one `plugin.json`, or with the manifest anywhere else is rejected at upload. After upload, the plugin is in your organization's catalog but not attached anywhere. To make it available in channels, add it to a bundle with **Add**, then **Plugin**, on the bundle's page, or add it for all of Slack from the **Skills and plugins** tab under **Claude's access**; see [Attach plugins](https://claude.com/docs/claude-tag/admins/add-connections.md#attach-plugins).
7676
7777## Repository context files and MCP servers
7878
79A granted repository's `CLAUDE.md` and `.claude/rules/*.md` load when Claude clones it, in the same format as Claude Code; see [What loads from a repository](/docs/claude-tag/admins/configure-github.md#what-loads-from-a-repository) and the [Claude Code memory docs](https://code.claude.com/docs/en/memory). A repository's `.mcp.json` is not loaded. To give Claude an MCP server, put the `.mcp.json` in a plugin, next to its `.claude-plugin/plugin.json`, and attach the plugin; the [Claude Code plugin docs](https://code.claude.com/docs/en/plugins) cover the `.mcp.json` format, and [Add a custom MCP server](/docs/claude-tag/admins/connections/custom.md#add-a-custom-mcp-server) covers the credential the server needs.
79A granted repository's `CLAUDE.md` and `.claude/rules/*.md` load when Claude clones it, in the same format as Claude Code; see [What loads from a repository](https://claude.com/docs/claude-tag/admins/configure-github.md#what-loads-from-a-repository) and the [Claude Code memory docs](https://code.claude.com/docs/en/memory). A repository's `.mcp.json` is not loaded. To give Claude an MCP server, put the `.mcp.json` in a plugin, next to its `.claude-plugin/plugin.json`, and attach the plugin; the [Claude Code plugin docs](https://code.claude.com/docs/en/plugins) cover the `.mcp.json` format, and [Add a custom MCP server](https://claude.com/docs/claude-tag/admins/connections/custom.md#add-a-custom-mcp-server) covers the credential the server needs.
8080
8181## What belongs in the repository
8282
from line 90
9090
9191## Related resources
9292
93* [Attach plugins](/docs/claude-tag/admins/add-connections.md#attach-plugins): how plugins and skills load into a scope
94* [Configure GitHub access](/docs/claude-tag/admins/configure-github.md): granting Claude write access to a repository
95* [What Claude Tag remembers](/docs/claude-tag/users/memory.md): when channel memory is the right place instead
93* [Attach plugins](https://claude.com/docs/claude-tag/admins/add-connections.md#attach-plugins): how plugins and skills load into a scope
94* [Configure GitHub access](https://claude.com/docs/claude-tag/admins/configure-github.md): granting Claude write access to a repository
95* [What Claude Tag remembers](https://claude.com/docs/claude-tag/users/memory.md): when channel memory is the right place instead
9696
claude-tag/admins/troubleshooting Changed · +67 / -67 lines
from line 10
1010
1111> [!NOTE]
1212>
13> For problems people can resolve on their own in a channel, like a missing reply or a thread that lost its work, see [Troubleshoot Claude Tag in channels and DMs](/docs/claude-tag/users/troubleshooting.md).
13> For problems people can resolve on their own in a channel, like a missing reply or a thread that lost its work, see [Troubleshoot Claude Tag in channels and DMs](https://claude.com/docs/claude-tag/users/troubleshooting.md).
1414
1515If someone reports that Claude can't reach a service you connected, check two things before anything else:
1616
17* The connector applies to that channel. To check, go to [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), open the **Channels** tab under **Claude's access**, and select the channel (or its workspace, if the channel isn't listed). The page's **Claude's access** table includes access [inherited from wider scopes](/docs/claude-tag/admins/attach-to-scope.md#how-scopes-inherit), and its **Inheritance** column names where each bundle, and each item outside a bundle, comes from. If the connector isn't there, add it to the channel, its workspace, or a [bundle that applies there](/docs/claude-tag/admins/attach-to-scope.md#attach-the-bundle).
17* The connector applies to that channel. To check, go to [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), open the **Channels** tab under **Claude's access**, and select the channel (or its workspace, if the channel isn't listed). The page's **Claude's access** table includes access [inherited from wider scopes](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#how-scopes-inherit), and its **Inheritance** column names where each bundle, and each item outside a bundle, comes from. If the connector isn't there, add it to the channel, its workspace, or a [bundle that applies there](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#attach-the-bundle).
1818* The test ran in a new thread; an existing thread isn't told about a connector added after it started, though the connector works there if the request names the service.
1919
2020## Setup errors
2121
22What you expected to see while running [setup](/docs/claude-tag/admins/setup-overview), what appeared instead, and what to do.
22What you expected to see while running [setup](https://claude.com/docs/claude-tag/admins/setup-overview), what appeared instead, and what to do.
2323
2424| You expected | But got | Do this |
2525| :- | :- | :- |
from line 33
3333| The spend limit picker on the **Launch Claude Tag** step | A **Buy usage credits** step | Your organization pays by card in US dollars and has no credits loaded. Load credits, or select **Skip** to continue without; nothing runs in channels until the balance is funded. Invoiced organizations and those billing in other currencies see the spend limit picker regardless of balance. |
3434| **Launch Claude Tag** to finish | "Couldn't turn on personal connectors in channels. Try again." | Launch didn't finish. Click **Launch Claude Tag** again. |
3535| Claude to join the channels you selected on the **Launch Claude Tag** step | "Couldn't add Claude to some channels. Add Claude from Slack instead." | Claude Tag is on, but Claude didn't join every channel you selected. Run `/invite @Claude` in each channel it's missing from. |
36| A reply from Claude while you're still in setup | A notice that starts "Claude isn't on in this channel yet." | Claude Tag isn't turned on until you finish [Launch Claude Tag](/docs/claude-tag/admins/setup-overview#launch-claude-tag). Finish setup, then mention `@Claude` again. A channel that's turned off after launch gets a different notice; see [Claude is disabled in this channel](#claude-is-disabled-in-this-channel). |
36| A reply from Claude while you're still in setup | A notice that starts "Claude isn't on in this channel yet." | Claude Tag isn't turned on until you finish [Launch Claude Tag](https://claude.com/docs/claude-tag/admins/setup-overview#launch-claude-tag). Finish setup, then mention `@Claude` again. A channel that's turned off after launch gets a different notice; see [Claude is disabled in this channel](#claude-is-disabled-in-this-channel). |
3737| A connected tool to work in your test | “I can't reach…” | Claude isn't told about a connector added after the thread started. Ask it to use the service by name, or start a fresh thread. |
3838| Claude to respond in Slack | "Claude Tag has been turned off for your Claude organization…" | The **Enable Claude Tag in Slack** switch is off. An Owner turns it on at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag). See [the troubleshooting entry](#claude-tag-is-turned-off-for-your-organization). |
3939| Claude to respond in Slack | "Claude Tag is unavailable because Routines aren't enabled for your organization…" | Routines isn't enabled for your Claude organization, which Claude Tag requires. An admin turns on [**Admin settings > Capabilities > Remote sessions > Routines**](https://claude.ai/admin-settings/capabilities). Anyone can then mention `@Claude` again. See [the troubleshooting entry](#claude-tag-is-unavailable-because-routines-are-not-enabled). |
from line 70
70702. Approve the consent screen Slack shows; it lists each permission being added. If Slack shows **Unapproved permissions requested** instead of completing, see [Unapproved permissions requested](#unapproved-permissions-requested).
71713. Run `@Claude connect` again. If the reinstall worked, the reply contains a pairing code (the link code the original message said it couldn't create) instead of this message.
7272
73Send that pairing code to whoever runs Claude setup in the console; it expires after 15 minutes. Slack's **Manage apps** page lists the permissions the app requests, not the permissions your workspace has granted, so seeing the missing permission listed there doesn't mean it's approved. The grant happens on the consent screen. For the app's permissions in one place, see [What the Claude Slack app can access](/docs/claude-tag/admins/for-slack-admins.md).
73Send that pairing code to whoever runs Claude setup in the console; it expires after 15 minutes. Slack's **Manage apps** page lists the permissions the app requests, not the permissions your workspace has granted, so seeing the missing permission listed there doesn't mean it's approved. The grant happens on the consent screen. For the app's permissions in one place, see [What the Claude Slack app can access](https://claude.com/docs/claude-tag/admins/for-slack-admins.md).
7474
7575### Unapproved permissions requested
7676
from line 124
124124
125125**What it means**
126126
127The **How should Claude work in channels with guests** setting is set to **Restrict** or **Channel only** for this channel's [scope](/docs/claude-tag/concepts/glossary.md#scope), so Claude checks the channel for guests before replying, and this install predates the `users:read` permission that check needs.
127The **How should Claude work in channels with guests** setting is set to **Restrict** or **Channel only** for this channel's [scope](https://claude.com/docs/claude-tag/concepts/glossary.md#scope), so Claude checks the channel for guests before replying, and this install predates the `users:read` permission that check needs.
128128
129129**How to resolve**
130130
from line 141
141141Claude joined the channel through one of these paths:
142142
143143* A member selected **Add to channel** on a channel Claude suggested in a direct message. Claude's welcome message, the introduction it posts when a member first opens a direct message with it, suggests a few public channels, each with an **Add to channel** button.
144* A member selected **Approve and post** on a message Claude drafted in a direct message for a public channel it wasn't a member of. When the member approves, Claude posts the message in the channel the member named and joins it. [What Claude can do in other channels](/docs/claude-tag/concepts/how-it-works.md#what-claude-can-do-in-other-channels) covers the flow.
145* The channel's name matches an [auto-join channel pattern](/docs/claude-tag/admins/restrict-access.md#block-or-auto-join-channels-by-name) an admin set, and Claude joined the public channel when it was created or renamed.
144* A member selected **Approve and post** on a message Claude drafted in a direct message for a public channel it wasn't a member of. When the member approves, Claude posts the message in the channel the member named and joins it. [What Claude can do in other channels](https://claude.com/docs/claude-tag/concepts/how-it-works.md#what-claude-can-do-in-other-channels) covers the flow.
145* The channel's name matches an [auto-join channel pattern](https://claude.com/docs/claude-tag/admins/restrict-access.md#block-or-auto-join-channels-by-name) an admin set, and Claude joined the public channel when it was created or renamed.
146146
147Claude performs that join with its own `channels:join` permission, so Slack's audit log records the join as the Claude app and shows no inviter; the member's selection is not visible in Slack's log. Outside these paths, Claude doesn't join a channel unprompted. [What the Claude Slack app can access](/docs/claude-tag/admins/for-slack-admins.md) covers how members add it.
147Claude performs that join with its own `channels:join` permission, so Slack's audit log records the join as the Claude app and shows no inviter; the member's selection is not visible in Slack's log. Outside these paths, Claude doesn't join a channel unprompted. [What the Claude Slack app can access](https://claude.com/docs/claude-tag/admins/for-slack-admins.md) covers how members add it.
148148
149149**How to resolve**
150150
151Nothing is misconfigured. If an auto-join pattern brought Claude in, review the auto-join patterns on the **Advanced** tab of the workspace's page or of the **Slack** page. If Claude shouldn't be in the channel, remove it with `/remove @Claude`, or [turn the scope's **Enable Claude Tag in this channel** switch off](/docs/claude-tag/admins/restrict-access.md#quiet-or-remove-claude-tag) so it stops responding there even if it's added again. If the **Slack** page has a single [**Respond in channels** switch](/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-on-the-team-plan) instead of per-channel switches, remove Claude and add a [blocked channel pattern](/docs/claude-tag/admins/restrict-access.md#block-or-auto-join-channels-by-name) for the channel's name. If you want every join in the audit log attributed to a person, ask members to add Claude with `/invite @Claude` rather than the buttons; Slack records an invite as the inviting member's action.
151Nothing is misconfigured. If an auto-join pattern brought Claude in, review the auto-join patterns on the **Advanced** tab of the workspace's page or of the **Slack** page. If Claude shouldn't be in the channel, remove it with `/remove @Claude`, or [turn the scope's **Enable Claude Tag in this channel** switch off](https://claude.com/docs/claude-tag/admins/restrict-access.md#quiet-or-remove-claude-tag) so it stops responding there even if it's added again. If the **Slack** page has a single [**Respond in channels** switch](https://claude.com/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-on-the-team-plan) instead of per-channel switches, remove Claude and add a [blocked channel pattern](https://claude.com/docs/claude-tag/admins/restrict-access.md#block-or-auto-join-channels-by-name) for the channel's name. If you want every join in the audit log attributed to a person, ask members to add Claude with `/invite @Claude` rather than the buttons; Slack records an invite as the inviting member's action.
152152
153153## Guest and shared channels
154154
from line 175
175175Either fix works:
176176
177177* Remove the guests from the channel, or move the conversation to a channel with no guests; this changes no settings, so no other channel is affected.
178* Change **How should Claude work in channels with guests** for the scope covering this channel. Go to [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), open the **Channels** tab under **Claude's access**, select the channel, its workspace, or **Slack**, and open the page's **Advanced** tab. **Channel only** restores replies with [channel-only access](/docs/claude-tag/admins/restrict-access.md#how-channel-only-works). **Full access** restores replies with the scope's full access, and only an organization Owner can choose it. See [restrict guest channels](/docs/claude-tag/admins/restrict-access.md#restrict-guest-channels) for what each value exposes.
178* Change **How should Claude work in channels with guests** for the scope covering this channel. Go to [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), open the **Channels** tab under **Claude's access**, select the channel, its workspace, or **Slack**, and open the page's **Advanced** tab. **Channel only** restores replies with [channel-only access](https://claude.com/docs/claude-tag/admins/restrict-access.md#how-channel-only-works). **Full access** restores replies with the scope's full access, and only an organization Owner can choose it. See [restrict guest channels](https://claude.com/docs/claude-tag/admins/restrict-access.md#restrict-guest-channels) for what each value exposes.
179179
180180Either value applies to every guest channel that scope covers. To limit the change to one channel, set the value on the channel's own page.
181181
from line 222
222222
223223The fix depends on which reply Claude posted:
224224
225* If the reply says the channel is shared with a workspace Claude hasn't been added to, have a Slack org admin [add the Claude app to that workspace](/docs/claude-tag/admins/workspaces.md#set-up-claude-tag-on-enterprise-grid). Once every workspace sharing the channel has the app, the membership check can run.
225* If the reply says the channel is shared with a workspace Claude hasn't been added to, have a Slack org admin [add the Claude app to that workspace](https://claude.com/docs/claude-tag/admins/workspaces.md#set-up-claude-tag-on-enterprise-grid). Once every workspace sharing the channel has the app, the membership check can run.
226226* Otherwise, use a channel that belongs to a single workspace.
227227
228228Setting the scope's guest setting to **Full access** removes the guest check that posts this message, but a Grid-shared channel still doesn't behave like a single-workspace one:
from line 260
260260
261261**What it means**
262262
263The channel is shared across more than one Slack workspace, and every one of those workspaces belongs to your Claude organization. Claude works there, but only with the access and settings on your [**Slack** page](/docs/claude-tag/admins/attach-to-scope.md), which apply in every workspace. Bundles, access, instructions, and memory added to a workspace or to this channel don't apply.
263The channel is shared across more than one Slack workspace, and every one of those workspaces belongs to your Claude organization. Claude works there, but only with the access and settings on your [**Slack** page](https://claude.com/docs/claude-tag/admins/attach-to-scope.md), which apply in every workspace. Bundles, access, instructions, and memory added to a workspace or to this channel don't apply.
264264
265265Claude posts the notice about once a month in each such channel, not on every reply, so replies there run under the same defaults even when no notice accompanies them.
266266
from line 337
337337**How to resolve**
338338
3393391. Find the Claude organization that holds the pairing. Check any other organizations your company has.
3402. Have an Owner in that organization [disconnect the workspace](/docs/claude-tag/admins/workspaces.md#revoke-a-pairing) under **Connected workspaces** on their **Slack** page.
3402. Have an Owner in that organization [disconnect the workspace](https://claude.com/docs/claude-tag/admins/workspaces.md#revoke-a-pairing) under **Connected workspaces** on their **Slack** page.
3413413. Send `@Claude connect` again for a fresh code and redeem it here.
342342
343343> [!WARNING]
344344>
345> Disconnecting deletes the workspace's Claude data, including its memory, channel configurations, sessions, and the routines set up in its channels. The deletion can't be undone. See [Data lifecycle and deletion](/docs/claude-tag/concepts/data-lifecycle.md) for the full list of what's deleted.
345> Disconnecting deletes the workspace's Claude data, including its memory, channel configurations, sessions, and the routines set up in its channels. The deletion can't be undone. See [Data lifecycle and deletion](https://claude.com/docs/claude-tag/concepts/data-lifecycle.md) for the full list of what's deleted.
346346
347347### This workspace is connected to a different Claude organization
348348
from line 356
356356>
357357> Signed in to a different Claude account in your browser? Sign out at claude.ai first, then click **Connect Claude account**.
358358
359If the workspace is covered by an [Enterprise Grid pairing](/docs/claude-tag/admins/workspaces.md#pair-an-enterprise-grid) rather than paired on its own, the DM is instead titled **This workspace isn't set up for your Claude organization yet** and adds that a Slack admin of the workspace can run `@Claude connect` to pair that one workspace with your organization.
359If the workspace is covered by an [Enterprise Grid pairing](https://claude.com/docs/claude-tag/admins/workspaces.md#pair-an-enterprise-grid) rather than paired on its own, the DM is instead titled **This workspace isn't set up for your Claude organization yet** and adds that a Slack admin of the workspace can run `@Claude connect` to pair that one workspace with your organization.
360360
361361**What it means**
362362
from line 404
404404* A notice that begins `:mute: Claude is muted in this thread` means the thread is muted and the session isn't stuck. Selecting the thumbs-down button under one of Claude's replies mutes the thread and posts that notice.
405405* A notice that ends `stopped Claude's response in this thread. Mention @Claude to pick up again.` means someone selected **Stop** on the working indicator. The session is intact, and a mention continues it.
406406
407To bring Claude back to a muted thread, send `@Claude !unmute` in the thread or @-mention Claude there, as [Thumbs-down button and muting](/docs/claude-tag/users/commands.md#thumbs-down-button-and-muting) describes.
407To bring Claude back to a muted thread, send `@Claude !unmute` in the thread or @-mention Claude there, as [Thumbs-down button and muting](https://claude.com/docs/claude-tag/users/commands.md#thumbs-down-button-and-muting) describes.
408408
409409Without either notice, the session behind that thread is stuck: it hasn't replied and hasn't posted an error. Because Claude responds everywhere else, the problem is confined to that one session, and none of the workspace-level fixes in the entries below apply.
410410
411411**How to resolve**
412412
413Have someone in the thread send [`@Claude !restart`](/docs/claude-tag/users/commands#restart-a-stuck-or-wrong-context-session). The command archives the stuck session and starts a fresh one that rereads the thread, so a follow-up message in the same thread gets an answer. Starting a new thread and restating the request also works.
413Have someone in the thread send [`@Claude !restart`](https://claude.com/docs/claude-tag/users/commands#restart-a-stuck-or-wrong-context-session). The command archives the stuck session and starts a fresh one that rereads the thread, so a follow-up message in the same thread gets an answer. Starting a new thread and restating the request also works.
414414
415415> [!WARNING]
416416>
417417> Restarting abandons whatever the session was midway through, and there's no way to resume it. A silent session may still be working through a long task, so treat `!restart` as a last resort.
418418
419If the same request stalls again on the fresh session, send [feedback](/docs/claude-tag/users/commands.md#send-feedback) from that thread so Anthropic can investigate.
419If the same request stalls again on the fresh session, send [feedback](https://claude.com/docs/claude-tag/users/commands.md#send-feedback) from that thread so Anthropic can investigate.
420420
421421### Claude is silent everywhere in the workspace
422422
from line 432
432432
433433**How to resolve**
434434
435Reinstall the Claude app over the existing install to restore the lost authorization. Don't uninstall first, because uninstalling [deletes the workspace's Claude data](/docs/claude-tag/concepts/data-lifecycle.md#actions-in-slack).
435Reinstall the Claude app over the existing install to restore the lost authorization. Don't uninstall first, because uninstalling [deletes the workspace's Claude data](https://claude.com/docs/claude-tag/concepts/data-lifecycle.md#actions-in-slack).
436436
4374371. As a Slack workspace admin, open [Claude for Slack](https://claude.com/claude-for-slack) and select **Add to Slack**.
4384382. Approve the consent screen Slack shows. If Slack shows **Unapproved permissions requested** instead of finishing the install, see [Unapproved permissions requested](#unapproved-permissions-requested).
from line 468
468468
469469**How to resolve**
470470
471Pair the whole Grid rather than one workspace. When a Grid Org Owner or Org Admin sends `@Claude connect`, the reply includes two codes; redeem the one starting with `enterprise_` (not the `workspace_` one) in the pairing step. See [Pair on Enterprise Grid](/docs/claude-tag/admins/workspaces.md#pair-an-enterprise-grid).
471Pair the whole Grid rather than one workspace. When a Grid Org Owner or Org Admin sends `@Claude connect`, the reply includes two codes; redeem the one starting with `enterprise_` (not the `workspace_` one) in the pairing step. See [Pair on Enterprise Grid](https://claude.com/docs/claude-tag/admins/workspaces.md#pair-an-enterprise-grid).
472472
473473### This workspace isn't set up for Claude Tag yet
474474
from line 486
486486
487487**How to resolve**
488488
489Run [the pairing flow](/docs/claude-tag/admins/setup-overview#pair-your-slack-workspace). If the fix worked, a mention in the workspace gets a reply.
489Run [the pairing flow](https://claude.com/docs/claude-tag/admins/setup-overview#pair-your-slack-workspace). If the fix worked, a mention in the workspace gets a reply.
490490
491491### The legacy Claude in Slack bot is retired effective October 5, 2026
492492
from line 500
500500
501501**How to resolve**
502502
503Check the **Claude Tag version** on the **Advanced** tab of the channel's page, then of its workspace's page, at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), and set it to **New**. **Inherit** works only when the workspace, or the **Slack** page above it, is set to **New**. See [Migrate from the earlier Claude in Slack](/docs/claude-tag/admins/migrate-from-earlier.md). The next mention in the channel gets a reply from Claude.
503Check the **Claude Tag version** on the **Advanced** tab of the channel's page, then of its workspace's page, at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), and set it to **New**. **Inherit** works only when the workspace, or the **Slack** page above it, is set to **New**. See [Migrate from the earlier Claude in Slack](https://claude.com/docs/claude-tag/admins/migrate-from-earlier.md). The next mention in the channel gets a reply from Claude.
504504
505505### Using the legacy Claude in Slack bot. Ask your Claude workspace owner to enable Claude Tag.
506506
from line 514
514514
515515**How to resolve**
516516
517An Owner turns on **Enable Claude Tag in Slack** at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag) and [pairs the workspace](/docs/claude-tag/admins/setup-overview#pair-your-slack-workspace). If the workspace is already paired, check the **Claude Tag version** on the **Advanced** tab of the workspace's page and set it to **New**; see [Migrate from the earlier Claude in Slack](/docs/claude-tag/admins/migrate-from-earlier.md). Once Claude Tag is on and the workspace is paired, the notice stops appearing.
517An Owner turns on **Enable Claude Tag in Slack** at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag) and [pairs the workspace](https://claude.com/docs/claude-tag/admins/setup-overview#pair-your-slack-workspace). If the workspace is already paired, check the **Claude Tag version** on the **Advanced** tab of the workspace's page and set it to **New**; see [Migrate from the earlier Claude in Slack](https://claude.com/docs/claude-tag/admins/migrate-from-earlier.md). Once Claude Tag is on and the workspace is paired, the notice stops appearing.
518518
519519### Claude Tag is turned off for your organization
520520
from line 530
530530
531531The **Enable Claude Tag in Slack** switch is off in admin settings, or your organization isn't enabled for Claude Tag. The switch that matters is the one in the Claude organization the reply's parenthetical points to.
532532
533An Owner may find that the switch can't be turned on, and that hovering over it shows "Your organization's policy doesn't allow changing this setting." In that case, a compliance configuration on your Claude organization is blocking Claude Tag, and an Owner can't turn it on, even though the reply says an admin can. [Plan and organization requirements](/docs/claude-tag/admins/healthcare.md#plan-and-organization-requirements), on the healthcare organizations page, lists the configurations under which Claude Tag isn't available.
533An Owner may find that the switch can't be turned on, and that hovering over it shows "Your organization's policy doesn't allow changing this setting." In that case, a compliance configuration on your Claude organization is blocking Claude Tag, and an Owner can't turn it on, even though the reply says an admin can. [Plan and organization requirements](https://claude.com/docs/claude-tag/admins/healthcare.md#plan-and-organization-requirements), on the healthcare organizations page, lists the configurations under which Claude Tag isn't available.
534534
535535**How to resolve**
536536
from line 537
537537If the switch can't be turned on, start at step 2. When the workspace is already paired to the intended organization, ask your account team about creating a separate Claude organization without that configuration, and connect your Slack workspace to it instead.
538538
5395391. An Owner turns on the **Enable Claude Tag in Slack** switch at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag). If the switch was the problem, a mention in Slack now gets a normal reply.
5402. If the message persists, check which Claude organization the workspace is paired to. If your company has more than one (a trial organization alongside the main one, for example), an Owner in the wrong organization can [revoke the pairing](/docs/claude-tag/admins/workspaces.md#revoke-a-pairing) so you can pair the workspace to the right one.
5402. If the message persists, check which Claude organization the workspace is paired to. If your company has more than one (a trial organization alongside the main one, for example), an Owner in the wrong organization can [revoke the pairing](https://claude.com/docs/claude-tag/admins/workspaces.md#revoke-a-pairing) so you can pair the workspace to the right one.
5415413. If the right organization has the switch on and the message persists, contact your account team to confirm Claude Tag is enabled for it.
542542
543543> [!WARNING]
544544>
545> Revoking the pairing deletes the workspace's Claude data, including its memory, channel configurations, sessions, and the routines set up in its channels. The deletion can't be undone. See [Data lifecycle and deletion](/docs/claude-tag/concepts/data-lifecycle.md) for the full list of what's deleted.
545> Revoking the pairing deletes the workspace's Claude data, including its memory, channel configurations, sessions, and the routines set up in its channels. The deletion can't be undone. See [Data lifecycle and deletion](https://claude.com/docs/claude-tag/concepts/data-lifecycle.md) for the full list of what's deleted.
546546
547547### Claude Tag is unavailable because Routines are not enabled
548548
from line 580
580580
581581**What it means**
582582
583Your Claude organization has a restricted compliance configuration, such as Zero Data Retention (ZDR). Claude Tag retains channel memory and session transcripts, so it isn't available to organizations under that configuration; see [what Claude Tag retains](/docs/claude-tag/concepts/security-and-data.md).
583Your Claude organization has a restricted compliance configuration, such as Zero Data Retention (ZDR). Claude Tag retains channel memory and session transcripts, so it isn't available to organizations under that configuration; see [what Claude Tag retains](https://claude.com/docs/claude-tag/concepts/security-and-data.md).
584584
585585**How to resolve**
586586
5871. In a channel, the message is about the organization the workspace is paired to. Check which Claude organization that is. If your company has more than one, such as a trial organization alongside the main one, the workspace may be paired to the wrong one; an Owner in that organization can [revoke the pairing](/docs/claude-tag/admins/workspaces.md#revoke-a-pairing) so you can pair the workspace to the right one.
5871. In a channel, the message is about the organization the workspace is paired to. Check which Claude organization that is. If your company has more than one, such as a trial organization alongside the main one, the workspace may be paired to the wrong one; an Owner in that organization can [revoke the pairing](https://claude.com/docs/claude-tag/admins/workspaces.md#revoke-a-pairing) so you can pair the workspace to the right one.
5885882. In a DM or on Claude's Home tab, the message is about the organization your own Claude account is connected to. If you also belong to a Claude organization without a restricted compliance configuration, click **Disconnect** on Claude's Home tab, then reconnect with that organization active.
5895893. If the organization in question is the intended one, no setting lifts the restriction; Claude Tag isn't available to organizations under it. Contact your account team with questions about your organization's compliance configuration.
590590
from line 600
600600
601601**What it means**
602602
603This channel's **Enable Claude Tag in this channel** switch is off, either set on the channel's page itself or inherited from its workspace, or from the **Slack** page, whose **Respond in all channels** switch is off. If the **Slack** page has a single [**Respond in channels** switch](/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-on-the-team-plan) instead of per-channel switches, the same notice means that switch is off, or the channel's workspace is switched off on its own.
603This channel's **Enable Claude Tag in this channel** switch is off, either set on the channel's page itself or inherited from its workspace, or from the **Slack** page, whose **Respond in all channels** switch is off. If the **Slack** page has a single [**Respond in channels** switch](https://claude.com/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-on-the-team-plan) instead of per-channel switches, the same notice means that switch is off, or the channel's workspace is switched off on its own.
604604
605605**How to resolve**
606606
607An Owner or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) turns the channel back on:
607An Owner or a [Claude Tag admin](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) turns the channel back on:
608608
6096091. Open [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag).
6106102. Under **Claude's access**, open the **Channels** tab and select the channel.
from line 612
612612
613613If the switch is inherited from the **Slack** page, you can instead select the **Slack** row on the **Channels** tab and turn on **Respond in all channels** at the top of its **General** tab. That also turns Claude back on in every other channel that inherits the switch from the **Slack** page.
614614
615If the **Slack** page has a single [**Respond in channels** switch](/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-on-the-team-plan) instead of per-channel switches, select the **Slack** row on the **Channels** tab and check that **Respond in channels** is on. If the fix worked, a mention in the channel gets a reply.
615If the **Slack** page has a single [**Respond in channels** switch](https://claude.com/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-on-the-team-plan) instead of per-channel switches, select the **Slack** row on the **Channels** tab and check that **Respond in channels** is on. If the fix worked, a mention in the channel gets a reply.
616616
617617## Access and connections
618618
from line 626
626626
627627**What it means**
628628
629A channel session's outbound network access is deny-by-default. A host is reachable when a connector or an [allowed domain](/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential) that applies to the channel allows it, or when the network access setting of the environment the scope's sessions run on allows it; anything else is blocked. Web search is separate and works regardless, so Claude can answer from search while being unable to fetch the same page; enabling web search in claude.ai admin settings doesn't open network access for channels. See [Web search vs. network requests](/docs/claude-tag/concepts/agent-identity.md#web-search-vs-network-requests).
629A channel session's outbound network access is deny-by-default. A host is reachable when a connector or an [allowed domain](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential) that applies to the channel allows it, or when the network access setting of the environment the scope's sessions run on allows it; anything else is blocked. Web search is separate and works regardless, so Claude can answer from search while being unable to fetch the same page; enabling web search in claude.ai admin settings doesn't open network access for channels. See [Web search vs. network requests](https://claude.com/docs/claude-tag/concepts/agent-identity.md#web-search-vs-network-requests).
630630
631631**How to resolve**
632632
633* For specific hosts, [add each one as a domain](/docs/claude-tag/admins/add-connections.md#add-a-domain) that applies to the channel, for example with **Add > Domain** on the page of a bundle that applies there. A credential-bearing service belongs in a connector instead.
633* For specific hosts, [add each one as a domain](https://claude.com/docs/claude-tag/admins/add-connections.md#add-a-domain) that applies to the channel, for example with **Add > Domain** on the page of a bundle that applies there. A credential-bearing service belongs in a connector instead.
634634* For broad access, pin an organization-scoped environment whose network access level is Full access in the **Environment** setting on the **Advanced** tab of the channel's, workspace's, or **Slack** page; see [the environment entry below](#channel-sessions-use-the-wrong-environment-or-can%E2%80%99t-find-one).
635635
636636Test in a new thread. If the fix worked, the fetch that failed succeeds there.
from line 639
639639
640640**What you see**
641641
642Members report that in channel threads and [routine](/docs/claude-tag/users/proactivity.md) runs, Claude says a permission check blocked an action, and the blocked actions are ones it carried out before, such as calling an external API.
642Members report that in channel threads and [routine](https://claude.com/docs/claude-tag/users/proactivity.md) runs, Claude says a permission check blocked an action, and the blocked actions are ones it carried out before, such as calling an external API.
643643
644644**What it means**
645645
646646Channel sessions and routines run in [auto mode](https://code.claude.com/docs/en/permission-modes#eliminate-prompts-with-auto-mode), where Claude's permission checker reviews each action and can stop it. The checker runs on Claude Sonnet 5, even when the sessions and routines themselves run on a different model.
647647
648On the Enterprise plan, an admin can turn a model off for the whole organization, and while Claude Sonnet 5 is off, the checker blocks actions it would otherwise allow. Actions that an [auto mode allow rule](/docs/claude-tag/admins/customize.md#auto-mode-allow-rules) names still run. For the setting and the models it affects, see [Models your organization allows](/docs/claude-tag/admins/customize.md#models-your-organization-allows).
648On the Enterprise plan, an admin can turn a model off for the whole organization, and while Claude Sonnet 5 is off, the checker blocks actions it would otherwise allow. Actions that an [auto mode allow rule](https://claude.com/docs/claude-tag/admins/customize.md#auto-mode-allow-rules) names still run. For the setting and the models it affects, see [Models your organization allows](https://claude.com/docs/claude-tag/admins/customize.md#models-your-organization-allows).
649649
650650**How to resolve**
651651
652An Owner or Admin turns Claude Sonnet 5 back on under **Model access** on the [**Models**](https://claude.ai/admin-settings/models) page. If members use [personal connectors](/docs/claude-tag/concepts/personal-connectors.md#admin-controls-for-personal-connectors) in channels, turn Claude Opus 5 on there too. Sessions and routines keep running on the models you chose for them, and auto mode allow rules you already added can stay.
652An Owner or Admin turns Claude Sonnet 5 back on under **Model access** on the [**Models**](https://claude.ai/admin-settings/models) page. If members use [personal connectors](https://claude.com/docs/claude-tag/concepts/personal-connectors.md#admin-controls-for-personal-connectors) in channels, turn Claude Opus 5 on there too. Sessions and routines keep running on the models you chose for them, and auto mode allow rules you already added can stay.
653653
654654A routine picks up the change on its next run. If the fix worked, the next run of a routine that was blocked completes the API calls the checker was blocking.
655655
from line 665
665665
666666**How to resolve**
667667
668Apply the connector to the failing channel. Open the connector's page from the **Connectors** tab under **Claude's access**. Under **Assign access**, pick the credential in the **Access** column of the channel's workspace, or select **Add place** to add the channel, then select **Save changes**. See [Add a connector](/docs/claude-tag/admins/add-connections.md#add-a-connection). If a bundle holds the connector, add the channel to that bundle's **Where it applies** list instead. You can also move the work to a channel the connector already covers. Test in a new thread, or ask Claude to use the service by name in the existing one. If the fix worked, asking `@Claude what can you access from this channel?` in a new thread lists the service.
668Apply the connector to the failing channel. Open the connector's page from the **Connectors** tab under **Claude's access**. Under **Assign access**, pick the credential in the **Access** column of the channel's workspace, or select **Add place** to add the channel, then select **Save changes**. See [Add a connector](https://claude.com/docs/claude-tag/admins/add-connections.md#add-a-connection). If a bundle holds the connector, add the channel to that bundle's **Where it applies** list instead. You can also move the work to a channel the connector already covers. Test in a new thread, or ask Claude to use the service by name in the existing one. If the fix worked, asking `@Claude what can you access from this channel?` in a new thread lists the service.
669669
670670### GitHub doesn't work in this channel
671671
from line 681
681681
682682Go through these checks in order; the same checks, in the same order, apply when GitHub worked in a channel and then stopped.
683683
6841. **The repository granted to this channel**: open the channel from the **Channels** tab under **Claude's access** and check that the repository is in its **Claude's access** table, whether added on the channel's page, inherited from its workspace or the **Slack** page, or held by a bundle that applies there. [Grant repository access](/docs/claude-tag/admins/configure-github.md#grant-repository-access) covers granting it, and [Attach the bundle to a scope](/docs/claude-tag/admins/attach-to-scope.md) covers how access inherits. Granting makes the repository available to clone, but the code doesn't enter a session until a request names it.
6841. **The repository granted to this channel**: open the channel from the **Channels** tab under **Claude's access** and check that the repository is in its **Claude's access** table, whether added on the channel's page, inherited from its workspace or the **Slack** page, or held by a bundle that applies there. [Grant repository access](https://claude.com/docs/claude-tag/admins/configure-github.md#grant-repository-access) covers granting it, and [Attach the bundle to a scope](https://claude.com/docs/claude-tag/admins/attach-to-scope.md) covers how access inherits. Granting makes the repository available to clone, but the code doesn't enter a session until a request names it.
6856852. **A fresh thread**: a new thread picks up every configuration change, so test in one before checking anything further. If the repository is granted, asking Claude to read a file from it works in a new thread.
6863. **The GitHub App installation covers the repository**: if Claude reports a repository isn't available, isn't configured, or returned a 403, check the installation, since the app's repository selection is upstream of the grant in Claude. At [`claude.ai/admin-settings/source-control`](https://claude.ai/admin-settings/source-control), the organization that owns the repository should show **Connected** in the **GitHub** section. If its row shows a **Needs permissions** status instead, the install is waiting on a GitHub organization owner. Click **Review permissions** to approve it on github.com. If you aren't a GitHub organization owner, click the **Not the GitHub owner? Send instructions** link on that page. In the dialog that opens, click **Copy message** to copy a request you can send to someone who is. If the organization isn't listed at all, install the app with the **Add organization** button beside the **GitHub** heading (it reads **Connect** until a GitHub account is connected); [Link your GitHub organization](/docs/claude-tag/admins/configure-github.md#link-your-github-organization) covers both.
6863. **The GitHub App installation covers the repository**: if Claude reports a repository isn't available, isn't configured, or returned a 403, check the installation, since the app's repository selection is upstream of the grant in Claude. At [`claude.ai/admin-settings/source-control`](https://claude.ai/admin-settings/source-control), the organization that owns the repository should show **Connected** in the **GitHub** section. If its row shows a **Needs permissions** status instead, the install is waiting on a GitHub organization owner. Click **Review permissions** to approve it on github.com. If you aren't a GitHub organization owner, click the **Not the GitHub owner? Send instructions** link on that page. In the dialog that opens, click **Copy message** to copy a request you can send to someone who is. If the organization isn't listed at all, install the app with the **Add organization** button beside the **GitHub** heading (it reads **Connect** until a GitHub account is connected); [Link your GitHub organization](https://claude.com/docs/claude-tag/admins/configure-github.md#link-your-github-organization) covers both.
687687
688For GitHub Enterprise Server repositories, confirm [the GHE host is registered](/docs/claude-tag/admins/configure-github.md#github-enterprise-server) instead. The github.com App install doesn't cover them.
688For GitHub Enterprise Server repositories, confirm [the GHE host is registered](https://claude.com/docs/claude-tag/admins/configure-github.md#github-enterprise-server) instead. The github.com App install doesn't cover them.
689689
690690### I hit an authentication error and couldn't finish this turn
691691
from line 735
735735
736736**What it means**
737737
738The session was created and is still waiting for compute to run it. Why it waits differs between Anthropic-hosted and self-hosted [environments](/docs/claude-tag/admins/customize.md#configure-the-environment-for-a-scope).
738The session was created and is still waiting for compute to run it. Why it waits differs between Anthropic-hosted and self-hosted [environments](https://claude.com/docs/claude-tag/admins/customize.md#configure-the-environment-for-a-scope).
739739
740740On an Anthropic-hosted environment, capacity is temporarily busy or the session is taking longer than usual to start, and the session normally starts on its own. If it never starts, Claude posts the [Session failed to start](#session-failed-to-start-the-session-container-never-connected) message instead.
741741
from line 782
782782| "That environment or repo isn't configured for Claude Code. Check claude.ai/code and try again." | The scope's pinned environment isn't set up; see [Channel sessions use the wrong environment](#channel-sessions-use-the-wrong-environment-or-can%E2%80%99t-find-one) |
783783| "Claude is having trouble starting sessions right now. Try again in a minute." | The service that runs sessions is briefly unavailable; retry |
784784| "You don't have permission to start a session here." | A permission check refused to start the session; when Claude knows which check failed, the message names it |
785| "Session failed to start: the environment's setup script exited with an error. Fix the setup script in your environment settings, then mention Claude in this thread to retry." | The setup script of the [environment the scope uses](/docs/claude-tag/admins/customize.md#configure-the-environment-for-a-scope) exited with an error; every session in that scope runs the same script at start, so fix the script, then mention Claude in the thread |
785| "Session failed to start: the environment's setup script exited with an error. Fix the setup script in your environment settings, then mention Claude in this thread to retry." | The setup script of the [environment the scope uses](https://claude.com/docs/claude-tag/admins/customize.md#configure-the-environment-for-a-scope) exited with an error; every session in that scope runs the same script at start, so fix the script, then mention Claude in the thread |
786786
787787**What it means**
788788
from line 800
800800
801801**What it means**
802802
803Sessions run on the environment or runner pool set on the nearest scope above them, or on the organization's default environment when none is set; [Configure the environment for a scope](/docs/claude-tag/admins/customize.md#configure-the-environment-for-a-scope) covers the picker. The picker only lists environments scoped to the organization; an environment created under an individual account doesn't appear, because channel sessions run with no user account attached.
803Sessions run on the environment or runner pool set on the nearest scope above them, or on the organization's default environment when none is set; [Configure the environment for a scope](https://claude.com/docs/claude-tag/admins/customize.md#configure-the-environment-for-a-scope) covers the picker. The picker only lists environments scoped to the organization; an environment created under an individual account doesn't appear, because channel sessions run with no user account attached.
804804
805805**How to resolve**
806806
807If the environment you want isn't in the picker, create it as an [organization-shared environment](https://code.claude.com/docs/en/cloud-environments#organization-shared-environments) from the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings), then pin it on the scope. Don't create it at [`claude.ai/code`](https://claude.ai/code): environments you create there belong to your individual account, so they never appear in the picker. If the fix worked, a new thread's session runs on the pinned environment. See the [glossary entry on environments](/docs/claude-tag/concepts/glossary.md#environment).
807If the environment you want isn't in the picker, create it as an [organization-shared environment](https://code.claude.com/docs/en/cloud-environments#organization-shared-environments) from the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings), then pin it on the scope. Don't create it at [`claude.ai/code`](https://claude.ai/code): environments you create there belong to your individual account, so they never appear in the picker. If the fix worked, a new thread's session runs on the pinned environment. See the [glossary entry on environments](https://claude.com/docs/claude-tag/concepts/glossary.md#environment).
808808
809809## Related resources
810810
811* [Setup overview](/docs/claude-tag/admins/setup-overview): re-walk the setup steps if the failure points to one you skipped
812* [User troubleshooting](/docs/claude-tag/users/troubleshooting.md): for problems people hit in channels
811* [Setup overview](https://claude.com/docs/claude-tag/admins/setup-overview): re-walk the setup steps if the failure points to one you skipped
812* [User troubleshooting](https://claude.com/docs/claude-tag/users/troubleshooting.md): for problems people hit in channels
813813* [Give feedback](https://support.claude.com): when it's a bug, not a configuration issue
814814
claude-tag/admins/workspaces Changed · +15 / -15 lines
from line 8
88
99This page covers managing Slack workspace pairings after initial setup: adding more workspaces, installing the app and pairing across a Slack Enterprise Grid, choosing which Claude Tag version each one runs, turning Claude on or off on the Team plan, and disconnecting a workspace.
1010
11A workspace pairing links one Slack workspace (or Enterprise Grid) to your Claude organization so `@Claude` can run there. Your first pairing was created during [setup](/docs/claude-tag/admins/setup-overview). To add more, you must be an Owner in your Claude organization, and a Workspace Admin (or Grid Org Admin) in the Slack workspace you're adding.
11A workspace pairing links one Slack workspace (or Enterprise Grid) to your Claude organization so `@Claude` can run there. Your first pairing was created during [setup](https://claude.com/docs/claude-tag/admins/setup-overview). To add more, you must be an Owner in your Claude organization, and a Workspace Admin (or Grid Org Admin) in the Slack workspace you're adding.
1212
1313## Pair another workspace
1414
from line 16
1616
1717A Slack workspace or Enterprise Grid pairs with one Claude organization at a time.
1818
19To move a pairing to a different Claude organization, an Owner in the organization that currently holds it must [disconnect it](#revoke-a-pairing) first. Until then, Claude Tag refuses the new pairing as [already connected to a different organization](/docs/claude-tag/admins/troubleshooting.md#already-connected-to-a-different-organization). Once the pairing moves, changes the previous organization's admins make in their settings no longer reach that workspace.
19To move a pairing to a different Claude organization, an Owner in the organization that currently holds it must [disconnect it](#revoke-a-pairing) first. Until then, Claude Tag refuses the new pairing as [already connected to a different organization](https://claude.com/docs/claude-tag/admins/troubleshooting.md#already-connected-to-a-different-organization). Once the pairing moves, changes the previous organization's admins make in their settings no longer reach that workspace.
2020
2121If your company has more than one Claude organization (a subsidiary with its own, for example), agree on which one holds the pairing before connecting.
2222
from line 28
2828
2929In any channel of the new workspace, send `@Claude connect` with no other text, as a new top-level message or in a thread where Claude isn't already working, then paste the code Claude sends you into the dialog.
3030
31Pick a channel that belongs to just the new workspace. Claude can decline to reply in [guest and shared channels](/docs/claude-tag/admins/troubleshooting.md#guest-and-shared-channels).
31Pick a channel that belongs to just the new workspace. Claude can decline to reply in [guest and shared channels](https://claude.com/docs/claude-tag/admins/troubleshooting.md#guest-and-shared-channels).
3232
3333**3. Finish the dialog and launch**
3434
from line 54
5454
5555On the [Claude for Slack](https://claude.com/claude-for-slack) listing, select **Add to Slack > Install to entire organization**.
5656
57If some workspaces in the Grid already installed the app on their own, leave those installations in place and choose **Install to entire organization** anyway. Don't uninstall first, because uninstalling the app from a workspace [deletes that workspace's Claude data](/docs/claude-tag/concepts/data-lifecycle.md#actions-in-slack).
57If some workspaces in the Grid already installed the app on their own, leave those installations in place and choose **Install to entire organization** anyway. Don't uninstall first, because uninstalling the app from a workspace [deletes that workspace's Claude data](https://claude.com/docs/claude-tag/concepts/data-lifecycle.md#actions-in-slack).
5858
5959**3. Add the app to each workspace**
6060
from line 66
6666
6767Paste the `enterprise_` code in one of these places:
6868
69* **During setup:** paste the code into the **Paste the pairing code** field on the [setup page](/docs/claude-tag/admins/setup-overview#pair-your-slack-workspace)
69* **During setup:** paste the code into the **Paste the pairing code** field on the [setup page](https://claude.com/docs/claude-tag/admins/setup-overview#pair-your-slack-workspace)
7070* **After setup:** click **Connect new** under **Connected workspaces** on the **Slack** page, as in [Pair another workspace](#pair-another-workspace), and paste the code into the dialog. If a workspace you've already paired belongs to a Grid you haven't paired, the list also has an **Enterprise Grid** row with the status **Not connected**, and **Connect** on that row opens the same dialog.
7171
7272> [!NOTE]
from line 90
9090| Label | Effect |
9191| :- | :- |
9292| **New** | Claude Tag. Bundles, skills, and custom instructions apply |
93| **Legacy** | The earlier per-user Claude in Slack. In channels it replies only with a retirement notice, and you can't switch a scope to it; see [Migrate from the earlier app](/docs/claude-tag/admins/migrate-from-earlier.md) |
93| **Legacy** | The earlier per-user Claude in Slack. In channels it replies only with a retirement notice, and you can't switch a scope to it; see [Migrate from the earlier app](https://claude.com/docs/claude-tag/admins/migrate-from-earlier.md) |
9494| **Inherit** | Use the parent's value. Not shown on the **Slack** page |
9595
9696Turning off **Respond in all channels** doesn't stop Claude in a workspace or channel whose own enable switch is on. On the Enterprise plan, launching setup for a single workspace turns on that workspace's enable switch, so Claude keeps responding in that workspace. The switch is at the top of the **General** tab on the **Slack** page, which sets the default for every workspace and channel. Direct messages from members who have connected a Claude account are unaffected.
from line 97
9797
9898Both versions answer through the same @Claude app, so turning off a workspace's or channel's enable switch silences the Legacy version there too.
9999
100Switching a workspace or channel between **New** and **Inherit** is reversible; see [Migrate from the earlier app](/docs/claude-tag/admins/migrate-from-earlier.md).
100Switching a workspace or channel between **New** and **Inherit** is reversible; see [Migrate from the earlier app](https://claude.com/docs/claude-tag/admins/migrate-from-earlier.md).
101101
102102### What each Claude Tag switch turns off
103103
104Each of these switches turns Claude off in a different part of Slack. To stop only direct messages, see [Allow or disable direct messages](/docs/claude-tag/admins/restrict-access.md#allow-or-disable-direct-messages).
104Each of these switches turns Claude off in a different part of Slack. To stop only direct messages, see [Allow or disable direct messages](https://claude.com/docs/claude-tag/admins/restrict-access.md#allow-or-disable-direct-messages).
105105
106106| Switch | Where it is | When it's off |
107107| :- | :- | :- |
from line 126
126126
127127### Turn Claude off in channels
128128
129Turn off **Respond in channels** on the **Slack** page. An @-mention in any channel gets "Claude is disabled in this channel" while the switch is off. One-to-one direct messages from members who have connected a Claude account keep working. To stop those too, go to [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), click **Edit** on the **Direct messages** row, and turn off [**Allow direct messages**](/docs/claude-tag/admins/restrict-access.md#allow-or-disable-direct-messages). For members who haven't connected an account, see [Stop direct messages from members without a Claude account](/docs/claude-tag/admins/restrict-access.md#stop-direct-messages-from-members-without-a-claude-account).
129Turn off **Respond in channels** on the **Slack** page. An @-mention in any channel gets "Claude is disabled in this channel" while the switch is off. One-to-one direct messages from members who have connected a Claude account keep working. To stop those too, go to [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), click **Edit** on the **Direct messages** row, and turn off [**Allow direct messages**](https://claude.com/docs/claude-tag/admins/restrict-access.md#allow-or-disable-direct-messages). For members who haven't connected an account, see [Stop direct messages from members without a Claude account](https://claude.com/docs/claude-tag/admins/restrict-access.md#stop-direct-messages-from-members-without-a-claude-account).
130130
131131### Turn Claude back on
132132
133Turn on **Respond in channels** on the **Slack** page. Everything you set on the **Slack** page and on each workspace's and channel's page, such as [bundles](/docs/claude-tag/admins/attach-to-scope.md) and [custom instructions](/docs/claude-tag/admins/attach-to-scope.md#add-custom-instructions), applies again. A workspace that was turned off on its own stays off, along with its channels.
133Turn on **Respond in channels** on the **Slack** page. Everything you set on the **Slack** page and on each workspace's and channel's page, such as [bundles](https://claude.com/docs/claude-tag/admins/attach-to-scope.md) and [custom instructions](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#add-custom-instructions), applies again. A workspace that was turned off on its own stays off, along with its channels.
134134
135135### Turn Claude off for the whole organization
136136
from line 138
138138
139139### Keep Claude out of specific channels
140140
141The switch has no per-channel setting. Add [blocked channel patterns](/docs/claude-tag/admins/restrict-access.md#block-or-auto-join-channels-by-name) for the channels instead.
141The switch has no per-channel setting. Add [blocked channel patterns](https://claude.com/docs/claude-tag/admins/restrict-access.md#block-or-auto-join-channels-by-name) for the channels instead.
142142
143143### Notices that settings aren't applied
144144
from line 172
172172
173173After you disconnect, the workspace leaves the **Connected workspaces** list. If it was your only connected workspace, the top of Claude Tag admin settings shows that it was disconnected from Slack, with a **Reconnect** button. **Reconnect** reopens the pairing dialog, where you redeem a fresh code from `@Claude connect`.
174174
175The Slack app stays installed, so a workspace admin can pair the workspace again by sending `@Claude connect` in it, to the same Claude organization or a different one. If you intend the data to be deleted, wait a few minutes before pairing the workspace to the same organization again, because a new pairing that arrives while the deletion is still starting can cancel it. Once the deletion has run, the new pairing starts without the deleted data. Uninstalling the app from the workspace in Slack deletes the same data, whether or not you disconnected first; see [Quiet or remove Claude Tag](/docs/claude-tag/admins/restrict-access.md#quiet-or-remove-claude-tag).
175The Slack app stays installed, so a workspace admin can pair the workspace again by sending `@Claude connect` in it, to the same Claude organization or a different one. If you intend the data to be deleted, wait a few minutes before pairing the workspace to the same organization again, because a new pairing that arrives while the deletion is still starting can cancel it. Once the deletion has run, the new pairing starts without the deleted data. Uninstalling the app from the workspace in Slack deletes the same data, whether or not you disconnected first; see [Quiet or remove Claude Tag](https://claude.com/docs/claude-tag/admins/restrict-access.md#quiet-or-remove-claude-tag).
176176
177177## Related resources
178178
179* [Data lifecycle and deletion](/docs/claude-tag/concepts/data-lifecycle.md): what disconnecting deletes, what it keeps, and what other actions do to Claude-side data
180* [Migrate from the earlier app](/docs/claude-tag/admins/migrate-from-earlier.md): the upgrade path and what changes for existing users
181* [Pair your Slack workspace](/docs/claude-tag/admins/setup-overview#pair-your-slack-workspace): the first pairing, with the Slack-admin handoff
179* [Data lifecycle and deletion](https://claude.com/docs/claude-tag/concepts/data-lifecycle.md): what disconnecting deletes, what it keeps, and what other actions do to Claude-side data
180* [Migrate from the earlier app](https://claude.com/docs/claude-tag/admins/migrate-from-earlier.md): the upgrade path and what changes for existing users
181* [Pair your Slack workspace](https://claude.com/docs/claude-tag/admins/setup-overview#pair-your-slack-workspace): the first pairing, with the Slack-admin handoff
182182
claude-tag/concepts/agent-identity Changed · +19 / -19 lines
from line 8
88
99Claude Tag's identity depends on where you message it.
1010
11In Slack channels, and in [group DMs](#group-dms) that include Claude, Claude acts with its own service accounts, rather than as a specific user. An organization Owner [provisions this identity](/docs/claude-tag/admins/setup-overview#give-claude-access-to-your-tools), so Claude has its own account in each system it works in: the Claude app in Slack, the Claude GitHub App on GitHub, and a service account in every other connected tool. Actions it takes are attributed to those accounts; for example, posts come from the Claude app and pull requests show the Claude GitHub App as the author. Claude can also use your own claude.ai connectors for a task you hand it in a channel, after you allow it. See [Personal connectors in a channel](#personal-connectors-in-a-channel).
11In Slack channels, and in [group DMs](#group-dms) that include Claude, Claude acts with its own service accounts, rather than as a specific user. An organization Owner [provisions this identity](https://claude.com/docs/claude-tag/admins/setup-overview#give-claude-access-to-your-tools), so Claude has its own account in each system it works in: the Claude app in Slack, the Claude GitHub App on GitHub, and a service account in every other connected tool. Actions it takes are attributed to those accounts; for example, posts come from the Claude app and pull requests show the Claude GitHub App as the author. Claude can also use your own claude.ai connectors for a task you hand it in a channel, after you allow it. See [Personal connectors in a channel](#personal-connectors-in-a-channel).
1212
13In one-to-one direct messages (DMs) between `@Claude` and a user who has connected a Claude account, the session runs on [the individual's own claude.ai account](#direct-message-channels), with their personal connectors. A pull request opened from a DM is authored by the Claude GitHub App, the same as in channels, though the session can only work with repositories connected on that user's own account. An Owner can turn off DMs for the whole organization; see [Allow or disable direct messages](/docs/claude-tag/admins/restrict-access.md#allow-or-disable-direct-messages). For DMs from users who haven't connected a Claude account, see [Direct messages from members without a Claude account](/docs/claude-tag/admins/restrict-access.md#direct-messages-from-members-without-a-claude-account).
13In one-to-one direct messages (DMs) between `@Claude` and a user who has connected a Claude account, the session runs on [the individual's own claude.ai account](#direct-message-channels), with their personal connectors. A pull request opened from a DM is authored by the Claude GitHub App, the same as in channels, though the session can only work with repositories connected on that user's own account. An Owner can turn off DMs for the whole organization; see [Allow or disable direct messages](https://claude.com/docs/claude-tag/admins/restrict-access.md#allow-or-disable-direct-messages). For DMs from users who haven't connected a Claude account, see [Direct messages from members without a Claude account](https://claude.com/docs/claude-tag/admins/restrict-access.md#direct-messages-from-members-without-a-claude-account).
1414
1515> [!NOTE]
1616>
17> How Claude behaves in channels (its standing instructions, plugins, and channel memory) is configured separately from its identity; see [custom instructions](/docs/claude-tag/admins/attach-to-scope.md#add-custom-instructions), [plugins](/docs/claude-tag/admins/add-connections.md#attach-plugins), and [memory](/docs/claude-tag/users/memory.md) for more information.
17> How Claude behaves in channels (its standing instructions, plugins, and channel memory) is configured separately from its identity; see [custom instructions](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#add-custom-instructions), [plugins](https://claude.com/docs/claude-tag/admins/add-connections.md#attach-plugins), and [memory](https://claude.com/docs/claude-tag/users/memory.md) for more information.
1818
1919## Channel sessions
2020
from line 22
2222
2323* The ask happens in your Slack workspace, when a user tags Claude to do something or a scheduled task starts.
2424* The work Claude does runs in a sandbox, an isolated working environment built for the thread.
25* The agent's credentials for any additional Claude Tag connectors, such as GitHub or a data warehouse, reach those systems to pull the required information. An organization Owner sets up those credentials as part of [provisioning the identity](/docs/claude-tag/admins/setup-overview#create-accounts-for-claude%E2%80%99s-other-tools).
25* The agent's credentials for any additional Claude Tag connectors, such as GitHub or a data warehouse, reach those systems to pull the required information. An organization Owner sets up those credentials as part of [provisioning the identity](https://claude.com/docs/claude-tag/admins/setup-overview#create-accounts-for-claude%E2%80%99s-other-tools).
2626
2727The diagram below traces one request through this process.
2828
from line 42
4242
4343**4. Agent Proxy attaches a credential**
4444
45A matching credential comes from the credential store, which keeps the credentials of the [connectors](/docs/claude-tag/admins/add-connections.md) an admin added. Once saved, a credential is never displayed again; Agent Proxy retrieves it only at the moment of injection and attaches it to the request at the boundary, so the model and the sandbox itself are not given the key.
45A matching credential comes from the credential store, which keeps the credentials of the [connectors](https://claude.com/docs/claude-tag/admins/add-connections.md) an admin added. Once saved, a credential is never displayed again; Agent Proxy retrieves it only at the moment of injection and attaches it to the request at the boundary, so the model and the sandbox itself are not given the key.
4646
4747**5. The result posts back, as Claude**
4848
from line 54
5454
5555| When the destination | Result |
5656| :- | :- |
57| Matches a credential's rule, its [allowed websites](/docs/claude-tag/admins/add-connections.md#set-allowed-websites) | The proxy attaches that credential and forwards the request. The credential stays at the proxy; the model and sandbox are not given it. |
58| Is an [allowed domain](/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential) that applies to the channel, but matches no credential | The proxy forwards the request without a credential. |
59| Is allowed by the network access setting of the [environment](/docs/claude-tag/concepts/glossary.md#environment) the [scope](/docs/claude-tag/concepts/glossary.md#scope)'s sessions run on | The proxy forwards the request without a credential. |
57| Matches a credential's rule, its [allowed websites](https://claude.com/docs/claude-tag/admins/add-connections.md#set-allowed-websites) | The proxy attaches that credential and forwards the request. The credential stays at the proxy; the model and sandbox are not given it. |
58| Is an [allowed domain](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential) that applies to the channel, but matches no credential | The proxy forwards the request without a credential. |
59| Is allowed by the network access setting of the [environment](https://claude.com/docs/claude-tag/concepts/glossary.md#environment) the [scope](https://claude.com/docs/claude-tag/concepts/glossary.md#scope)'s sessions run on | The proxy forwards the request without a credential. |
6060| Matches none of these | The proxy blocks the request. |
6161
6262A new environment's network access level defaults to Trusted access, so a fresh setup can reach a documented set of package registries and developer hosts before an admin has configured anything. The [cloud environments documentation](https://code.claude.com/docs/en/cloud-environments#default-allowed-domains) lists the covered hosts. To narrow that default, pin an environment with a stricter level, such as No access.
from line 65
6565
6666Agent Proxy carries HTTP and HTTPS only. A protocol that isn't HTTP, such as SSH or a database's native wire protocol, can't cross the proxy even to an allowed host.
6767
68For the endpoints and addresses your network team may need to allowlist, see [Network requirements](/docs/claude-tag/admins/network-requirements.md).
68For the endpoints and addresses your network team may need to allowlist, see [Network requirements](https://claude.com/docs/claude-tag/admins/network-requirements.md).
6969
7070### How a host gets allowed
7171
72A host that none of the three layers above allows is blocked, and Claude names the blocked host in the thread so an admin can add it; see [Give Claude access to your tools](/docs/claude-tag/admins/add-connections.md).
72A host that none of the three layers above allows is blocked, and Claude names the blocked host in the thread so an admin can add it; see [Give Claude access to your tools](https://claude.com/docs/claude-tag/admins/add-connections.md).
7373
7474### Web search vs. network requests
7575
from line 79
7979
8080Searching and opening a page are different actions. A search returns content from the pages it matches, which Claude reads and cites, so it can answer from a page that search surfaced. Opening a URL, whether one you pasted or one a search returned, is a fetch from the sandbox, and the host needs an allow layer. That is why Claude can quote a page it found through search and still report that it can't open the same link.
8181
82The web search capability setting in your organization's claude.ai admin settings governs claude.ai chat; it doesn't govern Claude Tag sessions, in channels or DMs. If Claude reports that it can't reach a host from a channel, the fix is a [domain entry](/docs/claude-tag/admins/add-connections.md#add-a-domain) or the scope's [environment](/docs/claude-tag/concepts/glossary.md#environment), not that setting.
82The web search capability setting in your organization's claude.ai admin settings governs claude.ai chat; it doesn't govern Claude Tag sessions, in channels or DMs. If Claude reports that it can't reach a host from a channel, the fix is a [domain entry](https://claude.com/docs/claude-tag/admins/add-connections.md#add-a-domain) or the scope's [environment](https://claude.com/docs/claude-tag/concepts/glossary.md#environment), not that setting.
8383
8484### Agent access
8585
86What Claude can reach in a channel comes from the [connectors, repositories, and plugins](/docs/claude-tag/admins/add-connections.md) an admin applies to that channel, to its workspace, or to all of Slack, either directly or through a bundle. Anyone in the channel gets the same capability, and the same request can do more in `#platform-eng` than in a general channel.
86What Claude can reach in a channel comes from the [connectors, repositories, and plugins](https://claude.com/docs/claude-tag/admins/add-connections.md) an admin applies to that channel, to its workspace, or to all of Slack, either directly or through a bundle. Anyone in the channel gets the same capability, and the same request can do more in `#platform-eng` than in a general channel.
8787
8888This design has four consequences.
8989
from line 96
9696
9797### Personal connectors in a channel
9898
99A channel session works with the access an admin applied to the channel, so the [connectors on your own claude.ai account](/docs/connectors/getting-started.md) are not part of it. When a task you hand Claude needs something only your connectors can reach, Claude can use your connector for that part of the work, and it asks you before it starts. The work runs with your permissions and is recorded under your name. Requests other people make to Claude in the task's thread run with the channel's own access, not with your connectors. Claude is designed to take direction from you, treating what other people post in the thread as information for the task rather than as instructions.
99A channel session works with the access an admin applied to the channel, so the [connectors on your own claude.ai account](https://claude.com/docs/connectors/getting-started.md) are not part of it. When a task you hand Claude needs something only your connectors can reach, Claude can use your connector for that part of the work, and it asks you before it starts. The work runs with your permissions and is recorded under your name. Requests other people make to Claude in the task's thread run with the channel's own access, not with your connectors. Claude is designed to take direction from you, treating what other people post in the thread as information for the task rather than as instructions.
100100
101[Personal connectors in channels](/docs/claude-tag/concepts/personal-connectors.md) covers how you approve connector use, when Claude holds a result for your review before posting, what other people in the channel see, and how to stop a task.
101[Personal connectors in channels](https://claude.com/docs/claude-tag/concepts/personal-connectors.md) covers how you approve connector use, when Claude holds a result for your review before posting, what other people in the channel see, and how to stop a task.
102102
103103## Direct message channels
104104
from line 117
117117
118118Two of those differences are worth spelling out.
119119
120* **Connectors.** The [connectors on your account](/docs/connectors/getting-started.md) are available, including MCP servers you've added.
120* **Connectors.** The [connectors on your account](https://claude.com/docs/connectors/getting-started.md) are available, including MCP servers you've added.
121121* **Billing.** Usage bills to your seat rather than the organization's service key.
122122
123123DM work runs under your credentials, so most of it is attributed to you and can reach only what your own accounts can. Pull requests are the exception: Claude authors them as the Claude GitHub App from DMs too, so a repository's history shows the same author either way, while the repositories it can reach are still only the ones connected on your own account.
from line 141
141141
142142In a group DM that includes Claude, Claude acts with its own service accounts, using the connections an admin set for the workspace and the organization. The work bills to the organization. Claude can also use the connectors on your claude.ai account for a task you ask for, after you allow it, as described in [Personal connectors in a channel](#personal-connectors-in-a-channel).
143143
144[Use Claude Tag in a group DM](/docs/claude-tag/users/group-dms.md) covers how to add Claude and what differs from a channel. If you're an admin, [Group DMs](/docs/claude-tag/admins/restrict-access.md#group-dms) covers how who is in a group DM can change whether Claude answers, and the settings that stop Claude from answering there.
144[Use Claude Tag in a group DM](https://claude.com/docs/claude-tag/users/group-dms.md) covers how to add Claude and what differs from a channel. If you're an admin, [Group DMs](https://claude.com/docs/claude-tag/admins/restrict-access.md#group-dms) covers how who is in a group DM can change whether Claude answers, and the settings that stop Claude from answering there.
145145
146146## Related resources
147147
148* [Security and data handling](/docs/claude-tag/concepts/security-and-data.md): where credentials are stored, what leaves your tenant, and what runs unattended
149* [Give Claude access](/docs/claude-tag/admins/add-connections.md): provision the access this page describes
150* [Restrict where Claude Tag operates](/docs/claude-tag/admins/restrict-access.md): narrow where this agent identity is allowed to act
148* [Security and data handling](https://claude.com/docs/claude-tag/concepts/security-and-data.md): where credentials are stored, what leaves your tenant, and what runs unattended
149* [Give Claude access](https://claude.com/docs/claude-tag/admins/add-connections.md): provision the access this page describes
150* [Restrict where Claude Tag operates](https://claude.com/docs/claude-tag/admins/restrict-access.md): narrow where this agent identity is allowed to act
151151
claude-tag/concepts/data-lifecycle Changed · +20 / -20 lines
from line 15
1515| What | What it contains |
1616| :- | :- |
1717| Session transcripts | The record of one thread's, channel's, or direct message's work. A transcript holds the messages Claude was shown in the conversation and who sent them, files attached there, earlier versions of messages that were later edited, what Claude retrieved while working (Slack search results, messages it read in channels it's in, and data from connected tools), and everything Claude said and did |
18| Memory | The notes Claude saves for each channel, the workspace notes it saves from public channels, and separate notes for each direct-message conversation. See [What Claude Tag remembers](/docs/claude-tag/users/memory.md) |
18| Memory | The notes Claude saves for each channel, the workspace notes it saves from public channels, and separate notes for each direct-message conversation. See [What Claude Tag remembers](https://claude.com/docs/claude-tag/users/memory.md) |
1919| Routines | The scheduled and run-once tasks set up in channels or in direct messages, with their instructions and run history |
20| Scopes and their settings | Each workspace and channel [scope](/docs/claude-tag/concepts/glossary.md#scope), with its custom instructions, version setting, and the bundles and access applied there |
21| Bundles and connectors | The [bundles](/docs/claude-tag/concepts/glossary.md#bundle), connectors, and credentials set up for Claude Tag. They belong to your organization, not to a workspace |
20| Scopes and their settings | Each workspace and channel [scope](https://claude.com/docs/claude-tag/concepts/glossary.md#scope), with its custom instructions, version setting, and the bundles and access applied there |
21| Bundles and connectors | The [bundles](https://claude.com/docs/claude-tag/concepts/glossary.md#bundle), connectors, and credentials set up for Claude Tag. They belong to your organization, not to a workspace |
2222| Account links | The link between each member's Slack account and their Claude account, and the tokens that link uses |
23| Published artifacts | Pages a session published to claude.ai. See [Artifact visibility](/docs/claude-tag/concepts/security-and-data.md#artifact-visibility) |
23| Published artifacts | Pages a session published to claude.ai. See [Artifact visibility](https://claude.com/docs/claude-tag/concepts/security-and-data.md#artifact-visibility) |
2424| The app's installation credential | The token the Claude app uses to read and post in your Slack workspace |
2525
2626Deleting or editing a message or file in Slack doesn't remove it from a transcript that already includes it. Messages from other people in the conversation, including guests, become part of the transcript the same way and are held as your organization's data.
from line 29
2929
3030During the beta there is no automatic retention period for Claude Tag data. Session transcripts, memory, routines, scopes, and account links are kept until one of the actions on this page deletes them. Your organization's custom data retention setting doesn't apply to Claude Tag transcripts or memory. It does apply to artifacts a session published, which follow the same retention rules as your organization's other shared artifacts.
3131
32Sessions Claude stops using are archived, not deleted. That includes a thread's session after someone sends [`@Claude !restart`](/docs/claude-tag/users/commands#restart-a-stuck-or-wrong-context-session), a session that closed because the thread's first message was deleted, and the channel-level sessions Claude replaces after about an hour of quiet or about a day of age. An archived session keeps its full transcript until the channel's or workspace's data is deleted.
32Sessions Claude stops using are archived, not deleted. That includes a thread's session after someone sends [`@Claude !restart`](https://claude.com/docs/claude-tag/users/commands#restart-a-stuck-or-wrong-context-session), a session that closed because the thread's first message was deleted, and the channel-level sessions Claude replaces after about an hour of quiet or about a day of age. An archived session keeps its full transcript until the channel's or workspace's data is deleted.
3333
34Letting a plan lapse, turning Claude Tag off, or no longer using it doesn't delete anything on its own. To delete a workspace's data when you stop using Claude Tag, [disconnect the workspace](/docs/claude-tag/admins/workspaces.md#revoke-a-pairing) or uninstall the app.
34Letting a plan lapse, turning Claude Tag off, or no longer using it doesn't delete anything on its own. To delete a workspace's data when you stop using Claude Tag, [disconnect the workspace](https://claude.com/docs/claude-tag/admins/workspaces.md#revoke-a-pairing) or uninstall the app.
3535
3636When an action below deletes data, deletion starts right away and completes in the background. Copies can remain in routine backups for a limited period after that before they age out.
3737
from line 47
4747| On Enterprise Grid, a Grid admin removes an org-wide installation of the app, from the whole grid or from one of its workspaces | Nothing is deleted. To delete the data, an Owner disconnects the grid, or a workspace that has its own pairing, in your Claude admin settings | No |
4848| A channel is deleted in Slack | Deleted: that channel's sessions and transcripts, including earlier sessions Claude had archived there, its channel memory, and its scope with the routines and artifacts that belong to it. Workspace notes Claude saved from a public channel aren't tied to the channel and stay until you delete them or disconnect the workspace, as does anything created under the workspace scope rather than the channel's own | Not applicable |
4949| A channel is archived in Slack | Nothing is deleted. Unarchiving the channel picks its memory, routines, and sessions back up | Not while the channel is archived |
50| A public channel is made private | Nothing is deleted. Claude archives the channel's earlier sessions. The channel's notes stay with the channel, and workspace notes Claude saved from it while it was public stay shared; see [Channel and workspace memory](/docs/claude-tag/users/memory.md#channel-and-workspace-memory) | Yes |
50| A public channel is made private | Nothing is deleted. Claude archives the channel's earlier sessions. The channel's notes stay with the channel, and workspace notes Claude saved from it while it was public stay shared; see [Channel and workspace memory](https://claude.com/docs/claude-tag/users/memory.md#channel-and-workspace-memory) | Yes |
5151| Someone removes Claude from a channel with `/remove @Claude` | Nothing is deleted. The channel's memory, routines, and past sessions stay on record, and re-adding Claude picks them back up. The channel's routines keep firing while Claude is out of the channel but can't post there | No |
5252| Someone edits a message Claude read | Claude receives the edit as a note, and the transcript keeps both the earlier and the edited text | Yes |
5353| Someone deletes a reply in a thread | Nothing is removed from the transcript, and Claude isn't notified | Yes |
from line 59
5959
6060| Action | Claude-side data | Does Claude keep responding? |
6161| :- | :- | :- |
62| An Owner [disconnects a workspace](/docs/claude-tag/admins/workspaces.md#revoke-a-pairing) | Deleted: the workspace's sessions and transcripts, including members' direct-message conversations there; its channel, workspace, and direct-message memory; the routines set up in its channels and the artifacts published from them; its scopes with their instructions and bundle bindings; and members' account links. The Slack app and its installation credential stay so a workspace admin can pair again, and bundles, routines members set up in one-to-one direct messages, and what Claude posted in Slack stay too. Pairing the same workspace to the same organization again within a few minutes can cancel the deletion | Stops in channels immediately. One-to-one direct messages keep working on each member's own Claude account until the deletion removes that member's account link |
62| An Owner [disconnects a workspace](https://claude.com/docs/claude-tag/admins/workspaces.md#revoke-a-pairing) | Deleted: the workspace's sessions and transcripts, including members' direct-message conversations there; its channel, workspace, and direct-message memory; the routines set up in its channels and the artifacts published from them; its scopes with their instructions and bundle bindings; and members' account links. The Slack app and its installation credential stay so a workspace admin can pair again, and bundles, routines members set up in one-to-one direct messages, and what Claude posted in Slack stay too. Pairing the same workspace to the same organization again within a few minutes can cancel the deletion | Stops in channels immediately. One-to-one direct messages keep working on each member's own Claude account until the deletion removes that member's account link |
6363| An Owner disconnects an Enterprise Grid | The same as disconnecting a workspace, for every workspace in the grid that doesn't have its own workspace pairing, plus the app's installation credentials for those workspaces. Workspaces you paired individually stay connected and keep their data until you disconnect them | Stops in the affected workspaces |
6464| An Owner removes a channel's scope with **Remove this scope** in the **⋯** menu of the channel's page | Deleted: the channel's sessions and transcripts recorded up to that moment, including threads still in progress, its memory, its routines, and the artifacts published from it. The Slack channel itself is unchanged | Yes, where the channel's workspace has its own setting on, or has no setting of its own and the **Slack** page's setting is on. Claude stays in the channel and, when tagged again, starts fresh under the access it inherits from the workspace. To stop it as well, first run `/remove @Claude` |
65| An Owner or a Claude Tag admin turns off a workspace's **Enable Claude Tag in this workspace** switch, a channel's **Enable Claude Tag in this channel** switch, or **Respond in all channels** (or **Respond in channels**) on the **Slack** page, or an Owner turns off **Enable Claude Tag in Slack** for the organization or [direct messages](/docs/claude-tag/admins/restrict-access.md#allow-or-disable-direct-messages) | Nothing is deleted. Turning the setting back on resumes with the existing memory, routines, and sessions | No, where the setting is off |
66| An Owner or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) removes a place from a bundle's **Where it applies** list, or deletes a bundle | Removing a place removes the binding, and deleting a bundle deletes its credentials everywhere it applied. Memory, routines, and transcripts are unaffected | Yes, without that access |
65| An Owner or a Claude Tag admin turns off a workspace's **Enable Claude Tag in this workspace** switch, a channel's **Enable Claude Tag in this channel** switch, or **Respond in all channels** (or **Respond in channels**) on the **Slack** page, or an Owner turns off **Enable Claude Tag in Slack** for the organization or [direct messages](https://claude.com/docs/claude-tag/admins/restrict-access.md#allow-or-disable-direct-messages) | Nothing is deleted. Turning the setting back on resumes with the existing memory, routines, and sessions | No, where the setting is off |
66| An Owner or a [Claude Tag admin](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) removes a place from a bundle's **Where it applies** list, or deletes a bundle | Removing a place removes the binding, and deleting a bundle deletes its credentials everywhere it applied. Memory, routines, and transcripts are unaffected | Yes, without that access |
6767| An Owner deletes entries from a scope's memory files, or someone in the channel tells Claude to forget an entry | The entry is removed from what Claude reads and from the memory files view. Earlier versions of the scope's memory remain stored with the scope until the scope's data is deleted | Yes |
68| An Owner deletes a channel's routine from the [**Scheduled work** tab](/docs/claude-tag/admins/audit.md#what-the-activity-page-lists), or someone asks Claude to delete a routine in the channel or direct message where it was set up | The routine and the sessions it ran are deleted. Pausing a routine there, or disabling it from the channel, keeps it on record | Yes |
68| An Owner deletes a channel's routine from the [**Scheduled work** tab](https://claude.com/docs/claude-tag/admins/audit.md#what-the-activity-page-lists), or someone asks Claude to delete a routine in the channel or direct message where it was set up | The routine and the sessions it ran are deleted. Pausing a routine there, or disabling it from the channel, keeps it on record | Yes |
6969| A member selects **Disconnect** in the Claude app's **Home** tab in Slack | Removes the link between their Slack and Claude accounts and revokes the tokens Claude Tag held for them. Their earlier direct-message conversations and notes, and channel work they started, aren't deleted; those go with the workspace | In channels, yes. One-to-one direct messages and personal connectors stop working for that member until they reconnect |
7070| A member is removed from your Claude organization | Nothing is deleted. They lose access within minutes, and routines they set up in one-to-one direct messages are turned off. Their account link, direct-message conversations, and notes stay until the workspace is disconnected | Not to that member |
7171| A member deletes their own Claude account | On Team and Enterprise plans, deleting an individual account doesn't remove the Claude Tag data your organization holds about that member, including their direct-message conversations and notes and their account link. A member who wants the link and its tokens removed can select **Disconnect** in Slack before deleting their account | Not to that member |
7272| Your Claude organization is deleted | All Claude Tag data for every paired workspace is deleted as part of the organization deletion. The Slack app isn't uninstalled by this, and its installation credential remains until the app is uninstalled, so uninstall it from each workspace in Slack as well | No |
73| Your organization adopts Zero Data Retention or another restricted compliance configuration after pairing | Nothing already stored is deleted. Disconnect each workspace to delete its data | No. Claude stops responding in Slack and new pairings are refused; see [Restricted compliance settings block Claude Tag](/docs/claude-tag/admins/troubleshooting.md#restricted-compliance-settings-block-claude-tag) |
73| Your organization adopts Zero Data Retention or another restricted compliance configuration after pairing | Nothing already stored is deleted. Disconnect each workspace to delete its data | No. Claude stops responding in Slack and new pairings are refused; see [Restricted compliance settings block Claude Tag](https://claude.com/docs/claude-tag/admins/troubleshooting.md#restricted-compliance-settings-block-claude-tag) |
7474
7575## Direct messages
7676
from line 84
8484
8585The controls that delete Claude Tag data, from largest to smallest:
8686
87* **Disconnect a workspace or an Enterprise Grid** under **Connected workspaces** on the **Slack** page, which you open with the **Slack** row on the **Channels** tab under **Claude's access** at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), or uninstall the app from the workspace in Slack. Deletes all of that workspace's data. See [Revoke a pairing](/docs/claude-tag/admins/workspaces.md#revoke-a-pairing)
87* **Disconnect a workspace or an Enterprise Grid** under **Connected workspaces** on the **Slack** page, which you open with the **Slack** row on the **Channels** tab under **Claude's access** at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), or uninstall the app from the workspace in Slack. Deletes all of that workspace's data. See [Revoke a pairing](https://claude.com/docs/claude-tag/admins/workspaces.md#revoke-a-pairing)
8888* **Remove a channel's scope**: open the channel from the **Channels** tab under **Claude's access**, then select **Remove this scope** in the page's **⋯** menu, if the menu lists it. Deletes that channel's data recorded so far
89* **Delete memory files**: open the workspace's page from the **Channels** tab (or a channel's page, when that channel has memory of its own), choose **View memory files** from its **⋯** menu if the menu lists it, pick a file, then select **Delete**. Deleting requires the Owner role. You can also tell Claude in the channel to forget an entry. See [Check and correct what Claude Tag remembers](/docs/claude-tag/users/memory.md#check-and-correct-what-claude-tag-remembers)
90* **Delete a routine**: an Owner deletes a channel's routine from the **Scheduled work** tab. You can also ask Claude to delete a routine in the channel or direct message where it was set up. See [Audit Claude Tag activity](/docs/claude-tag/admins/audit.md)
89* **Delete memory files**: open the workspace's page from the **Channels** tab (or a channel's page, when that channel has memory of its own), choose **View memory files** from its **⋯** menu if the menu lists it, pick a file, then select **Delete**. Deleting requires the Owner role. You can also tell Claude in the channel to forget an entry. See [Check and correct what Claude Tag remembers](https://claude.com/docs/claude-tag/users/memory.md#check-and-correct-what-claude-tag-remembers)
90* **Delete a routine**: an Owner deletes a channel's routine from the **Scheduled work** tab. You can also ask Claude to delete a routine in the channel or direct message where it was set up. See [Audit Claude Tag activity](https://claude.com/docs/claude-tag/admins/audit.md)
9191
9292There is no control in Slack or in your Claude admin settings that deletes a single thread's transcript on its own. During the beta, Claude Tag session transcripts and memory aren't included in your organization's data exports, and the Compliance API doesn't list or delete Claude Tag sessions. For a deletion request these controls don't cover, contact your account team or [[email protected]](mailto:[email protected]).
9393
from line 97
9797
9898## Related resources
9999
100* [Security and data handling](/docs/claude-tag/concepts/security-and-data.md): sandbox isolation, credential storage, and artifact visibility
101* [Manage workspaces and versions](/docs/claude-tag/admins/workspaces.md#revoke-a-pairing): the Disconnect control and what it deletes
102* [Restrict where Claude Tag operates](/docs/claude-tag/admins/restrict-access.md#quiet-or-remove-claude-tag): the ways to quiet or remove Claude, and which keep data
103* [What Claude Tag remembers](/docs/claude-tag/users/memory.md): reading, correcting, and deleting memory
104* [Audit Claude Tag activity](/docs/claude-tag/admins/audit.md): scheduled work, memory files, and network events
100* [Security and data handling](https://claude.com/docs/claude-tag/concepts/security-and-data.md): sandbox isolation, credential storage, and artifact visibility
101* [Manage workspaces and versions](https://claude.com/docs/claude-tag/admins/workspaces.md#revoke-a-pairing): the Disconnect control and what it deletes
102* [Restrict where Claude Tag operates](https://claude.com/docs/claude-tag/admins/restrict-access.md#quiet-or-remove-claude-tag): the ways to quiet or remove Claude, and which keep data
103* [What Claude Tag remembers](https://claude.com/docs/claude-tag/users/memory.md): reading, correcting, and deleting memory
104* [Audit Claude Tag activity](https://claude.com/docs/claude-tag/admins/audit.md): scheduled work, memory files, and network events
105105
claude-tag/concepts/for-claude-code-users Changed · +25 / -25 lines
from line 6
66>
77> Claude Tag is in public beta. Features and behavior described here may change before general availability.
88
9Claude Tag runs the same engine as Claude Code. When you tag `@Claude` in Slack with a task, a session starts in a sandbox that your organization configures, not on your machine. That sandbox is the same infrastructure that runs [Claude Code on the web](https://code.claude.com/docs/en/web-quickstart), described in [Compute and the sandbox](/docs/claude-tag/concepts/security-and-data.md#compute-and-the-sandbox).
9Claude Tag runs the same engine as Claude Code. When you tag `@Claude` in Slack with a task, a session starts in a sandbox that your organization configures, not on your machine. That sandbox is the same infrastructure that runs [Claude Code on the web](https://code.claude.com/docs/en/web-quickstart), described in [Compute and the sandbox](https://claude.com/docs/claude-tag/concepts/security-and-data.md#compute-and-the-sandbox).
1010
1111If you use Claude Code on the web, a session works the way a web session does, from a fresh clone of your repository rather than from files on your machine. The `CLAUDE.md` files and skills you checked into that repository apply in the session as they do in a web session.
1212
from line 14
1414
1515## What happens when a session starts
1616
17A session begins with a fresh sandbox and no repository checked out. Your repository's Claude Code configuration takes effect only after Claude clones the repository, which happens when your message names a repository that an admin has [granted to the channel](/docs/claude-tag/admins/configure-github.md#grant-repository-access).
17A session begins with a fresh sandbox and no repository checked out. Your repository's Claude Code configuration takes effect only after Claude clones the repository, which happens when your message names a repository that an admin has [granted to the channel](https://claude.com/docs/claude-tag/admins/configure-github.md#grant-repository-access).
1818
1919| Step | What applies |
2020| :- | :- |
2121| You tag `@Claude` with a task | Your message is the task, and Claude starts work in a sandbox with no repository |
2222| Your message names a granted repository | Claude clones it into the sandbox |
23| The clone completes | `CLAUDE.md`, `.claude/CLAUDE.md`, `.claude/rules/*.md`, and the skills in `.claude/skills/` [load into the session](/docs/claude-tag/admins/configure-github.md#what-loads-from-a-repository) |
23| The clone completes | `CLAUDE.md`, `.claude/CLAUDE.md`, `.claude/rules/*.md`, and the skills in `.claude/skills/` [load into the session](https://claude.com/docs/claude-tag/admins/configure-github.md#what-loads-from-a-repository) |
2424
2525[Hooks](https://code.claude.com/docs/en/hooks) in the repository's `.claude/settings.json` don't run in the session.
2626
from line 36
3636
3737| Claude Code setting on your machine | In Claude Tag |
3838| :- | :- |
39| `/model` | An admin sets the [default model per channel](/docs/claude-tag/admins/customize.md#choose-the-model-for-a-scope), and you can [switch models in a thread](/docs/claude-tag/users/models.md) |
40| `/fast` | Once an Owner [allows fast mode](/docs/claude-tag/admins/customize.md#allow-fast-mode), you [turn it on for one thread](/docs/claude-tag/users/models.md#run-a-thread-in-fast-mode) with `@Claude !fast` |
39| `/model` | An admin sets the [default model per channel](https://claude.com/docs/claude-tag/admins/customize.md#choose-the-model-for-a-scope), and you can [switch models in a thread](https://claude.com/docs/claude-tag/users/models.md) |
40| `/fast` | Once an Owner [allows fast mode](https://claude.com/docs/claude-tag/admins/customize.md#allow-fast-mode), you [turn it on for one thread](https://claude.com/docs/claude-tag/users/models.md#run-a-thread-in-fast-mode) with `@Claude !fast` |
4141| Effort level | Not configurable. Sessions run at the model's default effort. |
42| MCP servers in `.mcp.json` | Not loaded, even when `.mcp.json` is checked into the repository. A session reaches external services only through the [connections an admin set for the channel](/docs/claude-tag/admins/add-connections.md), and each connection holds that service's credentials. |
43| Secrets and API keys in your environment | An admin provisions them as channel connections. The raw key never enters the sandbox. It is [added to requests at the network layer](/docs/claude-tag/concepts/agent-identity.md#agent-proxy). |
44| Environment variables | An admin sets them on the [environment the channel's sessions run on](/docs/claude-tag/admins/customize.md#configure-the-environment-for-a-scope), and every session in the channel reads them. There is no per-person environment to customize. The values are readable in every session on the environment, so ask an admin to add secrets as connections instead. |
42| MCP servers in `.mcp.json` | Not loaded, even when `.mcp.json` is checked into the repository. A session reaches external services only through the [connections an admin set for the channel](https://claude.com/docs/claude-tag/admins/add-connections.md), and each connection holds that service's credentials. |
43| Secrets and API keys in your environment | An admin provisions them as channel connections. The raw key never enters the sandbox. It is [added to requests at the network layer](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy). |
44| Environment variables | An admin sets them on the [environment the channel's sessions run on](https://claude.com/docs/claude-tag/admins/customize.md#configure-the-environment-for-a-scope), and every session in the channel reads them. There is no per-person environment to customize. The values are readable in every session on the environment, so ask an admin to add secrets as connections instead. |
4545| A personal `settings.json` | Not loaded. |
46| A setup script for your workspace | An admin sets a setup script on the [environment the channel's sessions run on](/docs/claude-tag/admins/customize.md#configure-the-environment-for-a-scope), and what it installs is in place when each session in the channel starts. For setup that belongs to one repository, use `CLAUDE.md` [install steps](/docs/claude-tag/admins/configure-github.md#install-project-dependencies) instead. |
47| Permission prompts | Sessions run in auto mode, where Claude's permission checker reviews each action and can stop it. An admin pre-approves routine actions with [auto mode allow rules](/docs/claude-tag/admins/customize.md#auto-mode-allow-rules) instead of you approving in the moment. |
46| A setup script for your workspace | An admin sets a setup script on the [environment the channel's sessions run on](https://claude.com/docs/claude-tag/admins/customize.md#configure-the-environment-for-a-scope), and what it installs is in place when each session in the channel starts. For setup that belongs to one repository, use `CLAUDE.md` [install steps](https://claude.com/docs/claude-tag/admins/configure-github.md#install-project-dependencies) instead. |
47| Permission prompts | Sessions run in auto mode, where Claude's permission checker reviews each action and can stop it. An admin pre-approves routine actions with [auto mode allow rules](https://claude.com/docs/claude-tag/admins/customize.md#auto-mode-allow-rules) instead of you approving in the moment. |
4848
49To change what a session can reach for everyone, ask an admin to [add a connection](/docs/claude-tag/admins/add-connections.md). The change applies to every session in the channel.
49To change what a session can reach for everyone, ask an admin to [add a connection](https://claude.com/docs/claude-tag/admins/add-connections.md). The change applies to every session in the channel.
5050
5151## How Slack threads map to sessions
5252
53You start a session by tagging `@Claude` in a thread with a task, and that session gets its own sandbox. Each reply in the same thread continues the session, so there is no `--continue` or `/resume` to run, and a session stays attached to the thread it started in. See [the lifecycle of a request](/docs/claude-tag/concepts/how-it-works.md#lifecycle-of-a-request) for what happens between replies.
53You start a session by tagging `@Claude` in a thread with a task, and that session gets its own sandbox. Each reply in the same thread continues the session, so there is no `--continue` or `/resume` to run, and a session stays attached to the thread it started in. See [the lifecycle of a request](https://claude.com/docs/claude-tag/concepts/how-it-works.md#lifecycle-of-a-request) for what happens between replies.
5454
55Each thread is its own session with its own sandbox, so run parallel tasks in separate threads the way you would in separate terminal tabs. The sandbox is released after a quiet period, but the conversation stays in the thread, and a later reply continues the session. See [what survives between replies](/docs/claude-tag/concepts/how-it-works.md#what-survives-between-replies).
55Each thread is its own session with its own sandbox, so run parallel tasks in separate threads the way you would in separate terminal tabs. The sandbox is released after a quiet period, but the conversation stays in the thread, and a later reply continues the session. See [what survives between replies](https://claude.com/docs/claude-tag/concepts/how-it-works.md#what-survives-between-replies).
5656
5757## Whose credentials a session uses
5858
from line 60
6060
6161### In a channel
6262
63In a channel, Claude acts with credentials of its own, service accounts that [an admin provisions](/docs/claude-tag/concepts/agent-identity.md#channel-sessions). A pull request comes from the Claude GitHub App rather than from you, and a query against a connected service runs with the channel's credentials no matter who asked. For your own requests, Claude can also [use the connectors on your claude.ai account](/docs/claude-tag/concepts/personal-connectors.md) in the channel, after you allow it.
63In a channel, Claude acts with credentials of its own, service accounts that [an admin provisions](https://claude.com/docs/claude-tag/concepts/agent-identity.md#channel-sessions). A pull request comes from the Claude GitHub App rather than from you, and a query against a connected service runs with the channel's credentials no matter who asked. For your own requests, Claude can also [use the connectors on your claude.ai account](https://claude.com/docs/claude-tag/concepts/personal-connectors.md) in the channel, after you allow it.
6464
6565### In a direct message
6666
67A [one-to-one direct message](/docs/claude-tag/concepts/agent-identity.md#direct-message-channels) runs on your own claude.ai account, with the connectors you added to that account rather than the connections an admin set for the channel, so a DM is the closest match to a Claude Code session on your own credentials.
67A [one-to-one direct message](https://claude.com/docs/claude-tag/concepts/agent-identity.md#direct-message-channels) runs on your own claude.ai account, with the connectors you added to that account rather than the connections an admin set for the channel, so a DM is the closest match to a Claude Code session on your own credentials.
6868
6969## Steer a session in the thread
7070
71Where you would interrupt Claude Code and edit a file or reprompt, [reply in the thread](/docs/claude-tag/concepts/how-it-works.md#reply-in-the-thread-to-steer). Corrections and added constraints land as messages, and Claude folds them into the running task.
71Where you would interrupt Claude Code and edit a file or reprompt, [reply in the thread](https://claude.com/docs/claude-tag/concepts/how-it-works.md#reply-in-the-thread-to-steer). Corrections and added constraints land as messages, and Claude folds them into the running task.
7272
7373### Keep instructions in channel memory
7474
from line 78
7878@Claude remember for this channel: reports go out as tables
7979```
8080
81See [What Claude remembers](/docs/claude-tag/users/memory.md) for how memory is scoped and how to correct it.
81See [What Claude remembers](https://claude.com/docs/claude-tag/users/memory.md) for how memory is scoped and how to correct it.
8282
8383## Claude Tag versus a bot you build on the API
8484
from line 86
8686
8787Claude Tag is Anthropic's hosted Slack app. It takes care of the parts you would otherwise build.
8888
89* **Hosting.** Each thread gets a Claude Code session in a sandbox Anthropic runs, or in the [environment](/docs/claude-tag/concepts/glossary.md#environment) your organization pins, under an [agent identity](/docs/claude-tag/concepts/agent-identity.md) of its own.
90* **Credentials.** An admin gives Claude [connections](/docs/claude-tag/admins/add-connections.md) to your tools, and [Agent Proxy](/docs/claude-tag/concepts/agent-identity.md#agent-proxy) attaches the credentials at the network boundary, outside the sandbox.
91* **Customization.** [Custom instructions](/docs/claude-tag/admins/attach-to-scope.md#add-custom-instructions), [channel memory](/docs/claude-tag/users/memory.md), and [routines](/docs/claude-tag/users/proactivity.md) are built in.
92* **Governance and billing.** [Access controls](/docs/claude-tag/admins/restrict-access.md) and spend limits are set in claude.ai admin settings, and usage is [billed to the organization's usage balance](/docs/claude-tag/overview.md#billing-and-spend-limits).
89* **Hosting.** Each thread gets a Claude Code session in a sandbox Anthropic runs, or in the [environment](https://claude.com/docs/claude-tag/concepts/glossary.md#environment) your organization pins, under an [agent identity](https://claude.com/docs/claude-tag/concepts/agent-identity.md) of its own.
90* **Credentials.** An admin gives Claude [connections](https://claude.com/docs/claude-tag/admins/add-connections.md) to your tools, and [Agent Proxy](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy) attaches the credentials at the network boundary, outside the sandbox.
91* **Customization.** [Custom instructions](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#add-custom-instructions), [channel memory](https://claude.com/docs/claude-tag/users/memory.md), and [routines](https://claude.com/docs/claude-tag/users/proactivity.md) are built in.
92* **Governance and billing.** [Access controls](https://claude.com/docs/claude-tag/admins/restrict-access.md) and spend limits are set in claude.ai admin settings, and usage is [billed to the organization's usage balance](https://claude.com/docs/claude-tag/overview.md#billing-and-spend-limits).
9393
9494## Related resources
9595
96* [How Claude Tag works](/docs/claude-tag/concepts/how-it-works.md): the session model this page maps your setup onto
97* [How agent identity works](/docs/claude-tag/concepts/agent-identity.md): why a channel uses the agent's access and a one-to-one DM uses yours
98* [Claude Tag settings map](/docs/claude-tag/concepts/settings-map.md): where each setting your organization owns is set
99* [Configure GitHub access](/docs/claude-tag/admins/configure-github.md): what loads from a repository and how installs work in the sandbox
96* [How Claude Tag works](https://claude.com/docs/claude-tag/concepts/how-it-works.md): the session model this page maps your setup onto
97* [How agent identity works](https://claude.com/docs/claude-tag/concepts/agent-identity.md): why a channel uses the agent's access and a one-to-one DM uses yours
98* [Claude Tag settings map](https://claude.com/docs/claude-tag/concepts/settings-map.md): where each setting your organization owns is set
99* [Configure GitHub access](https://claude.com/docs/claude-tag/admins/configure-github.md): what loads from a repository and how installs work in the sandbox
100100
claude-tag/concepts/glossary Changed · +17 / -17 lines
from line 8
88
99## Agent identity
1010
11The service accounts Claude acts with: the Claude app in Slack, the Claude GitHub App on code, and the credentials an admin provisions for every other tool. See [How agent identity works](/docs/claude-tag/concepts/agent-identity.md).
11The service accounts Claude acts with: the Claude app in Slack, the Claude GitHub App on code, and the credentials an admin provisions for every other tool. See [How agent identity works](https://claude.com/docs/claude-tag/concepts/agent-identity.md).
1212
1313## Agent Proxy
1414
15The network layer that injects credentials into Claude's outbound requests. The model and the sandbox are not given the key; Agent Proxy adds the credential at the network boundary when a request matches the rules an admin set. See [How agent identity works](/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
15The network layer that injects credentials into Claude's outbound requests. The model and the sandbox are not given the key; Agent Proxy adds the credential at the network boundary when a request matches the rules an admin set. See [How agent identity works](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
1616
1717## Bundle
1818
19A named set of connectors, repositories, [allowed domains](/docs/claude-tag/admins/add-connections.md#add-a-domain), plugins, and instructions that Claude uses for one kind of work, such as support triage. An Owner or a [Claude Tag admin](#claude-tag-admin) creates bundles on the **Bundles** tab under **Claude's access** at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), then adds the places where each one applies: all of Slack, a workspace, or a channel. One bundle can apply in many places, and an Owner can also apply one to every channel whose name matches a pattern. See [Give Claude access](/docs/claude-tag/admins/add-connections.md).
19A named set of connectors, repositories, [allowed domains](https://claude.com/docs/claude-tag/admins/add-connections.md#add-a-domain), plugins, and instructions that Claude uses for one kind of work, such as support triage. An Owner or a [Claude Tag admin](#claude-tag-admin) creates bundles on the **Bundles** tab under **Claude's access** at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), then adds the places where each one applies: all of Slack, a workspace, or a channel. One bundle can apply in many places, and an Owner can also apply one to every channel whose name matches a pattern. See [Give Claude access](https://claude.com/docs/claude-tag/admins/add-connections.md).
2020
2121## Channel manager
2222
23A member of your Claude organization named to set up specific channels. For each channel assigned to them, a channel manager sets the default model, adds repositories their own GitHub account is an admin of, and manages credentials and plugins in the channel's own bundle, without holding the Owner role. See [Delegate channel setup to channel managers](/docs/claude-tag/admins/restrict-access.md#delegate-channel-setup-to-channel-managers).
23A member of your Claude organization named to set up specific channels. For each channel assigned to them, a channel manager sets the default model, adds repositories their own GitHub account is an admin of, and manages credentials and plugins in the channel's own bundle, without holding the Owner role. See [Delegate channel setup to channel managers](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-channel-setup-to-channel-managers).
2424
2525## Channel memory
2626
27Facts Claude retains while working in a channel, including facts you told it to remember and notes it writes itself. Each channel keeps its own entries. From a public channel Claude can also save workspace notes, which it reads in every channel in the workspace. See [What Claude Tag remembers](/docs/claude-tag/users/memory.md).
27Facts Claude retains while working in a channel, including facts you told it to remember and notes it writes itself. Each channel keeps its own entries. From a public channel Claude can also save workspace notes, which it reads in every channel in the workspace. See [What Claude Tag remembers](https://claude.com/docs/claude-tag/users/memory.md).
2828
2929## Claude Tag admin
3030
31A member of your Claude organization whose custom role includes the **Claude Tag Admin** permission, available on the Enterprise plan. A Claude Tag admin manages [bundles](#bundle), chooses where they apply, and edits workspace and channel settings, without holding the Owner role. A Claude Tag admin whose role also sets **Identity & Access** to **Can manage** can add and remove [channel managers](#channel-manager). See [Delegate Claude Tag administration](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration).
31A member of your Claude organization whose custom role includes the **Claude Tag Admin** permission, available on the Enterprise plan. A Claude Tag admin manages [bundles](#bundle), chooses where they apply, and edits workspace and channel settings, without holding the Owner role. A Claude Tag admin whose role also sets **Identity & Access** to **Can manage** can add and remove [channel managers](#channel-manager). See [Delegate Claude Tag administration](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration).
3232
3333## The earlier Claude in Slack
3434
from line 41
4141| Memory | None | Per-channel memory, plus workspace notes shared from public channels |
4242| Proactive work | None | Routines and channel watching |
4343
44Your admin chooses which generation answers `@Claude` in a given channel, so two channels in the same workspace can work differently. See [Migrate from the earlier Claude in Slack](/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-and-set-the-version-for-a-scope).
44Your admin chooses which generation answers `@Claude` in a given channel, so two channels in the same workspace can work differently. See [Migrate from the earlier Claude in Slack](https://claude.com/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-and-set-the-version-for-a-scope).
4545
4646## Connector
4747
48A service Claude Tag reaches with a credential of its own. An Owner or a [Claude Tag admin](#claude-tag-admin) adds connectors on the **Connectors** tab under **Claude's access**, and each connector holds one or more credentials, such as an API key for the service, that belong to the agent identity rather than to any user. To add a connector and choose where its credentials apply, see [Add a connector](/docs/claude-tag/admins/add-connections.md#add-a-connection). The [federated access](/docs/claude-tag/admins/federated-access/overview) pages and their console screens say **connection** for a gateway, cloud role, or authorization server Claude reaches with a token instead of a stored key.
48A service Claude Tag reaches with a credential of its own. An Owner or a [Claude Tag admin](#claude-tag-admin) adds connectors on the **Connectors** tab under **Claude's access**, and each connector holds one or more credentials, such as an API key for the service, that belong to the agent identity rather than to any user. To add a connector and choose where its credentials apply, see [Add a connector](https://claude.com/docs/claude-tag/admins/add-connections.md#add-a-connection). The [federated access](https://claude.com/docs/claude-tag/admins/federated-access/overview) pages and their console screens say **connection** for a gateway, cloud role, or authorization server Claude reaches with a token instead of a stored key.
4949
50A channel session uses the Claude Tag connectors that apply to its channel. Claude can also [use your personal connectors there](/docs/claude-tag/concepts/personal-connectors.md) for your own tasks, after you allow it. A one-to-one DM uses your own account instead, as [how DMs work in this model](/docs/claude-tag/concepts/agent-identity.md#direct-message-channels) describes.
50A channel session uses the Claude Tag connectors that apply to its channel. Claude can also [use your personal connectors there](https://claude.com/docs/claude-tag/concepts/personal-connectors.md) for your own tasks, after you allow it. A one-to-one DM uses your own account instead, as [how DMs work in this model](https://claude.com/docs/claude-tag/concepts/agent-identity.md#direct-message-channels) describes.
5151
5252## Environment
5353
from line 55
5555
5656## Personal connector
5757
58A tool you add to your own claude.ai account, like Gmail, Google Drive, or a custom MCP server, listed under [Customize > Connectors](https://claude.ai/customize/connectors). Personal connectors apply in your one-to-one DMs with Claude. Claude can also [use them in a channel](/docs/claude-tag/concepts/personal-connectors.md) for your own tasks, after you allow it. For the connectors an admin adds for Claude Tag, see [Connector](#connection).
58A tool you add to your own claude.ai account, like Gmail, Google Drive, or a custom MCP server, listed under [Customize > Connectors](https://claude.ai/customize/connectors). Personal connectors apply in your one-to-one DMs with Claude. Claude can also [use them in a channel](https://claude.com/docs/claude-tag/concepts/personal-connectors.md) for your own tasks, after you allow it. For the connectors an admin adds for Claude Tag, see [Connector](#connection).
5959
6060## Plugin
6161
62A package of skills that teaches Claude how to use a specific tool or follow a specific process. An Owner or a [Claude Tag admin](#claude-tag-admin) adds a plugin to a bundle, or to all of Slack, a workspace, or a channel directly. Anthropic provides plugins for common tools; you can add your own. See [Attach plugins](/docs/claude-tag/admins/add-connections.md#attach-plugins).
62A package of skills that teaches Claude how to use a specific tool or follow a specific process. An Owner or a [Claude Tag admin](#claude-tag-admin) adds a plugin to a bundle, or to all of Slack, a workspace, or a channel directly. Anthropic provides plugins for common tools; you can add your own. See [Attach plugins](https://claude.com/docs/claude-tag/admins/add-connections.md#attach-plugins).
6363
6464## Routine
6565
from line 69
6969
7070## Rule
7171
72The match conditions Agent Proxy checks against each outbound request. Each credential has a rule that decides when to inject it, and a request that matches the rule gets the credential attached at the boundary. A request that nothing allows (no rule, no domain entry, no [environment](#environment) network access setting) is blocked. See [Agent Proxy](/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
72The match conditions Agent Proxy checks against each outbound request. Each credential has a rule that decides when to inject it, and a request that matches the rule gets the credential attached at the boundary. A request that nothing allows (no rule, no domain entry, no [environment](#environment) network access setting) is blocked. See [Agent Proxy](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
7373
7474## Scope
7575
76One of three levels Claude's settings can target: all of Slack (the **Slack** page, the organization-wide root), one Slack workspace, or one channel (public or private). Scopes inherit downward, so a channel gets its workspace's settings plus any of its own. In Claude Tag admin settings, all of Slack, each workspace, and each channel have their own pages, which you open from the **Channels** tab under **Claude's access**. An Owner or a [Claude Tag admin](#claude-tag-admin) adds [bundles](#bundle), connectors, plugins, and instructions there. See [Attach the bundle to a scope](/docs/claude-tag/admins/attach-to-scope.md).
76One of three levels Claude's settings can target: all of Slack (the **Slack** page, the organization-wide root), one Slack workspace, or one channel (public or private). Scopes inherit downward, so a channel gets its workspace's settings plus any of its own. In Claude Tag admin settings, all of Slack, each workspace, and each channel have their own pages, which you open from the **Channels** tab under **Claude's access**. An Owner or a [Claude Tag admin](#claude-tag-admin) adds [bundles](#bundle), connectors, plugins, and instructions there. See [Attach the bundle to a scope](https://claude.com/docs/claude-tag/admins/attach-to-scope.md).
7777
7878## Session
7979
80The unit of work behind one conversation. Each Slack thread binds to one persistent session, and anyone in the channel can continue it by replying in the thread. A channel where Claude works at the top level, outside threads, also carries one session for the channel itself, separate from every thread's. See [How Claude Tag works](/docs/claude-tag/concepts/how-it-works.md) and [Restart a stuck or wrong-context session](/docs/claude-tag/users/commands.md#restart-a-stuck-or-wrong-context-session).
80The unit of work behind one conversation. Each Slack thread binds to one persistent session, and anyone in the channel can continue it by replying in the thread. A channel where Claude works at the top level, outside threads, also carries one session for the channel itself, separate from every thread's. See [How Claude Tag works](https://claude.com/docs/claude-tag/concepts/how-it-works.md) and [Restart a stuck or wrong-context session](https://claude.com/docs/claude-tag/users/commands.md#restart-a-stuck-or-wrong-context-session).
8181
8282## Related resources
8383
84* [How Claude Tag works](/docs/claude-tag/concepts/how-it-works.md): the scope, channel, and thread model in action
85* [How agent identity works](/docs/claude-tag/concepts/agent-identity.md): how connectors, scopes, and Agent Proxy fit together when Claude runs a task
86* [Set up Claude Tag](/docs/claude-tag/admins/setup-overview): where bundles and connectors get set up in Claude Tag admin settings
84* [How Claude Tag works](https://claude.com/docs/claude-tag/concepts/how-it-works.md): the scope, channel, and thread model in action
85* [How agent identity works](https://claude.com/docs/claude-tag/concepts/agent-identity.md): how connectors, scopes, and Agent Proxy fit together when Claude runs a task
86* [Set up Claude Tag](https://claude.com/docs/claude-tag/admins/setup-overview): where bundles and connectors get set up in Claude Tag admin settings
8787
claude-tag/concepts/how-it-works Changed · +28 / -28 lines
from line 8
88
99Claude Tag is Claude, working inside your team's Slack channels. An organization Owner gives it its own accounts to the tools your team uses, so it arrives already able to act, and anyone in a channel can tag it into a problem without setting anything up.
1010
11When someone tags Claude in at a channel's top level, the channel's own [session](/docs/claude-tag/concepts/glossary.md#session) picks the message up. A task that needs investigation, tools, or a longer exchange gets a working session in a thread under the message, and that thread binds to its own session from then on. Claude works through the task and posts the result back into the conversation. The work runs in an ephemeral cloud sandbox, not on your local machine.
11When someone tags Claude in at a channel's top level, the channel's own [session](https://claude.com/docs/claude-tag/concepts/glossary.md#session) picks the message up. A task that needs investigation, tools, or a longer exchange gets a working session in a thread under the message, and that thread binds to its own session from then on. Claude works through the task and posts the result back into the conversation. The work runs in an ephemeral cloud sandbox, not on your local machine.
1212
1313This page covers:
1414
from line 77
7777
7878* **Editing a message**: Claude receives a note each time you edit, showing what the message said before the edit and what it says now. Both versions become part of the session's transcript, so editing a message doesn't remove the earlier text from what Anthropic stores. An edit doesn't start a new task or re-address Claude, even if you add `@Claude` to it.
7979* **Deleting a reply**: Claude gets no notification and keeps the version it already read. Deleting the reply in Slack doesn't remove it from the session's transcript.
80* **Deleting the thread's first message**: Claude stops working in that thread and the session closes, whether or not the thread has replies. Anything Claude already pushed or posted persists, per [what survives between replies](#what-survives-between-replies), and you start a new thread to pick the task back up. Closing the session archives it rather than deleting it, so its transcript, including the message you deleted, stays with the channel's Claude data until that data is [deleted](/docs/claude-tag/admins/workspaces.md#revoke-a-pairing).
80* **Deleting the thread's first message**: Claude stops working in that thread and the session closes, whether or not the thread has replies. Anything Claude already pushed or posted persists, per [what survives between replies](#what-survives-between-replies), and you start a new thread to pick the task back up. Closing the session archives it rather than deleting it, so its transcript, including the message you deleted, stays with the channel's Claude data until that data is [deleted](https://claude.com/docs/claude-tag/admins/workspaces.md#revoke-a-pairing).
8181* **Correcting course**: Claude responds to replies; edits reach it only as notes, and a deleted reply not at all. Say the change in a new reply; the reply is also how you walk back a message it already read.
8282
8383## Team channels and personal DMs
from line 92
9292
9393The Access column is about external systems. A channel session reaches what the channel was granted, and a one-to-one DM session reaches what your own account is connected to.
9494
95Everything below describes channel sessions, where most of the model lives. For one-to-one DMs, see [direct message channels](/docs/claude-tag/concepts/agent-identity.md#direct-message-channels). For group DMs, see [Use Claude Tag in a group DM](/docs/claude-tag/users/group-dms.md). For choosing where to ask, see [pick the right surface](/docs/claude-tag/users/good-habits.md#pick-the-right-surface).
95Everything below describes channel sessions, where most of the model lives. For one-to-one DMs, see [direct message channels](https://claude.com/docs/claude-tag/concepts/agent-identity.md#direct-message-channels). For group DMs, see [Use Claude Tag in a group DM](https://claude.com/docs/claude-tag/users/group-dms.md). For choosing where to ask, see [pick the right surface](https://claude.com/docs/claude-tag/users/good-habits.md#pick-the-right-surface).
9696
9797## How Claude Tag differs from Cowork and Claude Code
9898
from line 111
111111
112112Three ideas recur across this page and the rest of these docs.
113113
114* **Agent identity**: in channels, Claude acts under its own service accounts that an admin provisions, not as the person who asked. What it can reach is set per channel, so everyone in a channel works with the same access. See [How agent identity works](/docs/claude-tag/concepts/agent-identity.md).
115* **Scheduling and long-running work**: a task can run on a schedule, follow a pull request and act when it changes, or keep going across many turns in one thread. The same channel access applies whether a person or a schedule started it. See [Set up routines](/docs/claude-tag/users/proactivity.md).
116* **Memory**: Claude keeps notes for each channel, and the workspace notes it saves from public channels are read in every channel in the workspace. See [What Claude remembers](/docs/claude-tag/users/memory.md).
114* **Agent identity**: in channels, Claude acts under its own service accounts that an admin provisions, not as the person who asked. What it can reach is set per channel, so everyone in a channel works with the same access. See [How agent identity works](https://claude.com/docs/claude-tag/concepts/agent-identity.md).
115* **Scheduling and long-running work**: a task can run on a schedule, follow a pull request and act when it changes, or keep going across many turns in one thread. The same channel access applies whether a person or a schedule started it. See [Set up routines](https://claude.com/docs/claude-tag/users/proactivity.md).
116* **Memory**: Claude keeps notes for each channel, and the workspace notes it saves from public channels are read in every channel in the workspace. See [What Claude remembers](https://claude.com/docs/claude-tag/users/memory.md).
117117
118118## Lifecycle of a request
119119
120120Every session, in any channel, follows the same five-step loop.
121121
1221. **The session starts.** Someone tags `@Claude` with a task that needs a working session, or a [scheduled routine](/docs/claude-tag/users/proactivity.md) runs. At a channel's top level, the channel's own session picks the message up and starts the thread's session.
1221. **The session starts.** Someone tags `@Claude` with a task that needs a working session, or a [scheduled routine](https://claude.com/docs/claude-tag/users/proactivity.md) runs. At a channel's top level, the channel's own session picks the message up and starts the thread's session.
1231232. **A sandbox builds.** Each thread gets its own isolated working environment.
1241243. **The working loop runs.** Claude works through the task with the channel's access, editing its checklist in place.
1251254. **The result lands in the thread.** An answer, a doc, a chart, or a pull request.
from line 133
133133
134134Two threads in the same channel are two separate sessions with separate sandboxes; sessions don't share state directly.
135135
136A channel where Claude works at the top level, outside threads, also carries one session for the channel itself, separate from every thread's. That session reads the channel's top-level messages and handles top-level @-mentions, so context carries across separate top-level asks in the same channel; [What survives between replies](#what-survives-between-replies) covers how long it lives. For a task that needs investigation, tools, or a longer exchange, it starts a dedicated session in a thread under the message. At the channel's top level, [`!restart`](/docs/claude-tag/users/commands#restart-a-stuck-or-wrong-context-session) replaces the channel's session.
136A channel where Claude works at the top level, outside threads, also carries one session for the channel itself, separate from every thread's. That session reads the channel's top-level messages and handles top-level @-mentions, so context carries across separate top-level asks in the same channel; [What survives between replies](#what-survives-between-replies) covers how long it lives. For a task that needs investigation, tools, or a longer exchange, it starts a dedicated session in a thread under the message. At the channel's top level, [`!restart`](https://claude.com/docs/claude-tag/users/commands#restart-a-stuck-or-wrong-context-session) replaces the channel's session.
137137
138138Even with nothing connected, every session starts from the same baseline.
139139
from line 152
152152| A page kept current | Any of the above, edited in place over time | Digests, indexes, standing reports |
153153| A hosted page | A web page published on claude.ai, linked in the thread | Dashboards, prototypes, reports |
154154
155A hosted page stays available after the session ends, and Claude updates it when you ask in the thread. Anyone with access to the channel can open it. [Artifact visibility](/docs/claude-tag/concepts/security-and-data.md#artifact-visibility) covers the access model. These are the same artifacts [Claude Code publishes](https://code.claude.com/docs/en/artifacts), with channel-based access in place of owner-controlled sharing.
155A hosted page stays available after the session ends, and Claude updates it when you ask in the thread. Anyone with access to the channel can open it. [Artifact visibility](https://claude.com/docs/claude-tag/concepts/security-and-data.md#artifact-visibility) covers the access model. These are the same artifacts [Claude Code publishes](https://code.claude.com/docs/en/artifacts), with channel-based access in place of owner-controlled sharing.
156156
157157For code work, the result is usually a draft pull request opened under the Claude GitHub App, with the link posted in the thread.
158158
from line 160
160160
161161For a longer task, Claude's first reply is a checklist, a live task list that it edits in place as it goes. Slack does not send notifications when a message is edited, so the thread can look frozen while the list is still moving.
162162
163A quiet thread usually means Claude is mid-task, not stuck. Open the thread. Checklist items checked off since you last looked mean the work is moving. In the walkthrough, nothing new arrived in anyone's notifications between 9:02 and 9:06, while the checklist ticked through fourteen threads of reading. If the work hits a wall, Claude usually says so in a reply rather than going silent. When a thread stays silent well past what the task should need, treat it as a stuck session; see [Claude reacted or started thinking, then never replied](/docs/claude-tag/users/troubleshooting.md#claude-reacted-or-started-thinking-then-never-replied).
163A quiet thread usually means Claude is mid-task, not stuck. Open the thread. Checklist items checked off since you last looked mean the work is moving. In the walkthrough, nothing new arrived in anyone's notifications between 9:02 and 9:06, while the checklist ticked through fourteen threads of reading. If the work hits a wall, Claude usually says so in a reply rather than going silent. When a thread stays silent well past what the task should need, treat it as a stuck session; see [Claude reacted or started thinking, then never replied](https://claude.com/docs/claude-tag/users/troubleshooting.md#claude-reacted-or-started-thinking-then-never-replied).
164164
165165### Channel access
166166
167Claude Tag connectors extend a session's reach into your own systems. An organization admin applies access to all of Slack, to one workspace, or to a single channel, either directly or through a [bundle](/docs/claude-tag/concepts/glossary.md#bundle), so the same request can do more in one channel than in another, and everyone in a given channel works with the same capability.
167Claude Tag connectors extend a session's reach into your own systems. An organization admin applies access to all of Slack, to one workspace, or to a single channel, either directly or through a [bundle](https://claude.com/docs/claude-tag/concepts/glossary.md#bundle), so the same request can do more in one channel than in another, and everyone in a given channel works with the same capability.
168168
169169A thread locks in its skills, plugins, and custom instructions when it starts, and a running thread keeps that set. Connectors and domain rules are enforced on each request, so one an admin adds mid-thread works in a running thread. Claude doesn't announce a new connector in an existing thread; ask it to use the service by name. A new thread picks up every kind of change, so after a configuration change, start a new top-level thread.
170170
from line 173
173173Because access is set per channel rather than per person, the way to find out what a session can reach is to ask it, not to guess from your own permissions.
174174
175175* **Ask what Claude can reach.** In any channel, `@Claude what can you access from this channel?` lists its current reach.
176* **If Claude cannot reach something, the channel was not granted access.** Another channel may have the access, and an Owner or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) of your Claude organization can add it. [How agent identity works](/docs/claude-tag/concepts/agent-identity.md) covers the model.
177* **Personal connectors are separate from Claude Tag connectors.** A connector an admin applies to a channel is separate from a connector on your personal claude.ai account. Your own connectors work in your one-to-one DMs. Claude can also [use them in a channel](/docs/claude-tag/concepts/personal-connectors.md) for your own tasks, after you allow it.
176* **If Claude cannot reach something, the channel was not granted access.** Another channel may have the access, and an Owner or a [Claude Tag admin](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) of your Claude organization can add it. [How agent identity works](https://claude.com/docs/claude-tag/concepts/agent-identity.md) covers the model.
177* **Personal connectors are separate from Claude Tag connectors.** A connector an admin applies to a channel is separate from a connector on your personal claude.ai account. Your own connectors work in your one-to-one DMs. Claude can also [use them in a channel](https://claude.com/docs/claude-tag/concepts/personal-connectors.md) for your own tasks, after you allow it.
178178
179179### What Claude can do in other channels
180180
from line 192
192192* **Attribution line**: every message Claude posts outside the conversation you asked from carries a line under it that names where it came from. When you ask in a thread, the line links back to that thread and names whoever last addressed Claude there, as in "Sent by Claude in #team-eng on behalf of @jordan". When you ask in a DM, the line names the person who approved the post, as in "Sent by Claude, approved by @jordan".
193193* **Replies**: when you ask from a channel, Claude follows the thread it posted into, so replies there reach the session you asked in. Claude reads them and responds in the conversation where you asked, not in the other thread. Replies don't reach it while the conversation where you asked includes guests or is shared with another organization. When you ask from a one-to-one DM, replies under the post don't reach your DM; reply in the DM to follow up.
194194* **Following a channel or thread**: ask Claude to watch another public channel or a thread in one, for example `@Claude follow #incidents and tell me here if anything mentions billing`. Claude must be a member of that channel. Claude reads new messages there and acts in the conversation where you asked, without posting in the followed channel. It doesn't receive them while the conversation where you asked includes guests or is shared with another organization. Ask Claude to stop following when it no longer matters. A follow you set up from a thread ends once that thread goes 7 days without a new message.
195* **Which channels Claude can post into**: a public channel in the same Slack workspace that Claude is already a member of. Claude can't post into a Slack Connect channel or a [channel shared across workspaces](/docs/claude-tag/admins/restrict-access.md#channels-shared-across-workspaces-in-your-enterprise-grid), wherever you ask from.
195* **Which channels Claude can post into**: a public channel in the same Slack workspace that Claude is already a member of. Claude can't post into a Slack Connect channel or a [channel shared across workspaces](https://claude.com/docs/claude-tag/admins/restrict-access.md#channels-shared-across-workspaces-in-your-enterprise-grid), wherever you ask from.
196196* **If Claude isn't a member of the target channel**: when you ask from a channel, add Claude by sending `/invite @Claude` from inside the target channel. When you ask from a DM, approving the post adds Claude to the target channel.
197* **Channels with guests**: Claude can post into a [channel that includes guests](/docs/claude-tag/admins/restrict-access.md#restrict-guest-channels) only when the **How should Claude work in channels with guests** setting covering that channel is **Full access**.
197* **Channels with guests**: Claude can post into a [channel that includes guests](https://claude.com/docs/claude-tag/admins/restrict-access.md#restrict-guest-channels) only when the **How should Claude work in channels with guests** setting covering that channel is **Full access**.
198198
199199### One-off and scheduled tasks
200200
201A session starts the same way whether a person triggers it or a schedule does. A tagged task runs in its thread's session, and the sandbox is released once the work finishes. A routine runs the same loop on a schedule, a channel watch, or a repository event, with the channel's connections, so a recurring digest or watcher gets the same access a typed request would. See [set up routines](/docs/claude-tag/users/proactivity.md).
201A session starts the same way whether a person triggers it or a schedule does. A tagged task runs in its thread's session, and the sandbox is released once the work finishes. A routine runs the same loop on a schedule, a channel watch, or a repository event, with the channel's connections, so a recurring digest or watcher gets the same access a typed request would. See [set up routines](https://claude.com/docs/claude-tag/users/proactivity.md).
202202
203203## Session context and memory
204204
from line 208
208208
209209A session reads its own thread and its channel. Mentioning `@Claude` partway into an existing thread gives it a window of the thread's messages, not the whole thread, with other bots' replies filtered out. In long threads, restate anything critical.
210210
211Claude works in channels it has been added to, but workspace search can still find messages by keyword from public channels it's not a member of (the same search any Slack user has). Workspace search is unavailable in [channels that include guests](/docs/claude-tag/admins/restrict-access.md#restrict-guest-channels), and an admin can [limit search to channels Claude is in](/docs/claude-tag/admins/restrict-access.md#limit-which-channels-claude-can-search). Finding something is broader than being able to act somewhere; to have it participate in a channel directly, invite it with `/invite @Claude`.
211Claude works in channels it has been added to, but workspace search can still find messages by keyword from public channels it's not a member of (the same search any Slack user has). Workspace search is unavailable in [channels that include guests](https://claude.com/docs/claude-tag/admins/restrict-access.md#restrict-guest-channels), and an admin can [limit search to channels Claude is in](https://claude.com/docs/claude-tag/admins/restrict-access.md#limit-which-channels-claude-can-search). Finding something is broader than being able to act somewhere; to have it participate in a channel directly, invite it with `/invite @Claude`.
212212
213213### What survives between replies
214214
from line 216
216216
217217| When | What Claude does |
218218| :- | :- |
219| Someone sends [`@Claude !restart`](/docs/claude-tag/users/commands#restart-a-stuck-or-wrong-context-session) | Archives the session right away and starts a fresh one that rereads the thread |
220| The session [gets stuck and fails](/docs/claude-tag/users/troubleshooting.md#claude-reacted-or-started-thinking-then-never-replied) | Starts the replacement when the next message arrives in the thread |
219| Someone sends [`@Claude !restart`](https://claude.com/docs/claude-tag/users/commands#restart-a-stuck-or-wrong-context-session) | Archives the session right away and starts a fresh one that rereads the thread |
220| The session [gets stuck and fails](https://claude.com/docs/claude-tag/users/troubleshooting.md#claude-reacted-or-started-thinking-then-never-replied) | Starts the replacement when the next message arrives in the thread |
221221
222222
223223
from line 228
228228| Work pushed, posted, or opened as a PR | Yes, in the external system |
229229| Files that exist only in the sandbox | No. Claude recreates them if asked. |
230230
231For long tasks, ask it to push branches and post drafts as it goes, so deliverables are saved somewhere durable while the work is still running. See [Good habits](/docs/claude-tag/users/good-habits.md#give-every-task-a-definition-of-done).
231For long tasks, ask it to push branches and post drafts as it goes, so deliverables are saved somewhere durable while the work is still running. See [Good habits](https://claude.com/docs/claude-tag/users/good-habits.md#give-every-task-a-definition-of-done).
232232
233233A running thread isn't told about configuration changes an admin makes after it started, such as a new connection, plugin, skill, repository grant, or custom instruction. A new thread starts from the scope's current configuration, so after changing a scope, start a fresh thread to see the change.
234234
235235The channel's own session, the one that handles top-level messages outside any thread, lives longer than a thread's. Claude replaces it with a fresh one after about an hour with no activity in the channel or its threads, or when the channel's configuration has changed since the session started. Claude also replaces a session once it's about a day old, but waits until the channel and the threads it's working in have gone quiet. Channel memory and the channel's history are unaffected, so the only visible effect is that Claude no longer carries what the previous session had been working on.
236236
237Claude also stops reading a channel's top-level messages once about 100 of them have arrived since it last posted or replied there. An `@Claude` mention in the channel starts it reading again; see [When Claude stops reading a channel](/docs/claude-tag/users/when-claude-responds.md#when-claude-stops-reading-a-channel). These thresholds are defaults and can change, so treat the numbers as approximate.
237Claude also stops reading a channel's top-level messages once about 100 of them have arrived since it last posted or replied there. An `@Claude` mention in the channel starts it reading again; see [When Claude stops reading a channel](https://claude.com/docs/claude-tag/users/when-claude-responds.md#when-claude-stops-reading-a-channel). These thresholds are defaults and can change, so treat the numbers as approximate.
238238
239239### Channel and workspace memory
240240
from line 244
244244
245245A private channel reads the workspace notes but can't add to them. Everything Claude saves there goes to that channel's own notes.
246246
247To see what it holds, ask `@Claude what do you remember about this channel?`. Anyone in the channel can correct or remove entries. [What Claude Tag remembers](/docs/claude-tag/users/memory.md) covers reading, correcting, and adding to memory.
247To see what it holds, ask `@Claude what do you remember about this channel?`. Anyone in the channel can correct or remove entries. [What Claude Tag remembers](https://claude.com/docs/claude-tag/users/memory.md) covers reading, correcting, and adding to memory.
248248
249249The whole model so far fits in one picture, with access set at the scope, memory kept per channel, work in progress per thread, and one-to-one DMs outside all of it.
250250
251251
252252
253One-to-one DMs are outside this picture; they run on your own account, as covered in [Team channels and personal DMs](#team-channels-and-personal-dms). An Owner can turn off DMs for the whole organization; see [Allow or disable direct messages](/docs/claude-tag/admins/restrict-access.md#allow-or-disable-direct-messages).
253One-to-one DMs are outside this picture; they run on your own account, as covered in [Team channels and personal DMs](#team-channels-and-personal-dms). An Owner can turn off DMs for the whole organization; see [Allow or disable direct messages](https://claude.com/docs/claude-tag/admins/restrict-access.md#allow-or-disable-direct-messages).
254254
255255## What admins can see of your conversations with Claude
256256
from line 257
257257Admins have no page or export that shows the individual messages people send Claude.
258258
259259* **Analytics:** the [analytics page](https://claude.ai/analytics/claude-tag) reports spend by channel and by kind of work
260* **Activity page:** the [**Activity** page](/docs/claude-tag/admins/audit.md) in Claude Tag admin settings, available to Owners, lists scheduled work, memory files, and network events
260* **Activity page:** the [**Activity** page](https://claude.com/docs/claude-tag/admins/audit.md) in Claude Tag admin settings, available to Owners, lists scheduled work, memory files, and network events
261261* **Slack threads:** everyone in a channel can read the threads where Claude works, admins included
262* **Session transcripts:** Anthropic keeps a [transcript of each session](/docs/claude-tag/concepts/data-lifecycle.md#what-anthropic-stores)
262* **Session transcripts:** Anthropic keeps a [transcript of each session](https://claude.com/docs/claude-tag/concepts/data-lifecycle.md#what-anthropic-stores)
263263
264264## Related resources
265265
266* [Getting started](/docs/claude-tag/users/getting-started.md): hand Claude your first task
267* [How agent identity works](/docs/claude-tag/concepts/agent-identity.md): why an admin sets access per channel, and how credentials stay out of the sandbox
268* [Good habits](/docs/claude-tag/users/good-habits.md): write tasks that survive the sandbox lifecycle
266* [Getting started](https://claude.com/docs/claude-tag/users/getting-started.md): hand Claude your first task
267* [How agent identity works](https://claude.com/docs/claude-tag/concepts/agent-identity.md): why an admin sets access per channel, and how credentials stay out of the sandbox
268* [Good habits](https://claude.com/docs/claude-tag/users/good-habits.md): write tasks that survive the sandbox lifecycle
269269
claude-tag/concepts/personal-connectors Changed · +11 / -11 lines
from line 8
88
99Personal connectors are the tools you add to your own claude.ai account, like your calendar or your email. When a task you ask for in a Slack channel needs one of your own tools, Claude can offer to use your connector for it.
1010
11Personal connectors in channels are on for every organization on the Team plan, with nothing for an admin to set up. On the Enterprise plan, an admin manages them in the **Personal connectors** dialog, which opens with **Edit** on the **Personal connectors** row at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag); see [Admin controls for personal connectors](#admin-controls-for-personal-connectors). A channel also keeps working with the Claude Tag connectors an admin attached to it, as described in [how agent identity works](/docs/claude-tag/concepts/agent-identity.md).
11Personal connectors in channels are on for every organization on the Team plan, with nothing for an admin to set up. On the Enterprise plan, an admin manages them in the **Personal connectors** dialog, which opens with **Edit** on the **Personal connectors** row at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag); see [Admin controls for personal connectors](#admin-controls-for-personal-connectors). A channel also keeps working with the Claude Tag connectors an admin attached to it, as described in [how agent identity works](https://claude.com/docs/claude-tag/concepts/agent-identity.md).
1212
1313## Where your connectors apply
1414
from line 23
2323
2424* **You ask in a channel.** When your task needs one of your own tools, Claude can use your connector for it. The channel also uses the Claude Tag connectors an admin attached to it, and everyone who asks there gets the same access.
2525* **Someone else asks in a channel.** Your connectors serve only you. Their request doesn't control or use your connectors, even in a shared channel.
26* **Claude starts work on its own.** [Routines](/docs/claude-tag/users/proactivity.md) and other work Claude starts on its own in a channel use the channel's own access, never your connectors.
27* **You ask in a [group DM](/docs/claude-tag/users/group-dms.md).** Claude uses your connectors after you allow it, and only your own requests use them.
28* **You ask in a one-to-one direct message (DM).** Your connectors apply on their own, because a DM runs on [your own claude.ai account](/docs/claude-tag/concepts/agent-identity.md#direct-message-channels).
26* **Claude starts work on its own.** [Routines](https://claude.com/docs/claude-tag/users/proactivity.md) and other work Claude starts on its own in a channel use the channel's own access, never your connectors.
27* **You ask in a [group DM](https://claude.com/docs/claude-tag/users/group-dms.md).** Claude uses your connectors after you allow it, and only your own requests use them.
28* **You ask in a one-to-one direct message (DM).** Your connectors apply on their own, because a DM runs on [your own claude.ai account](https://claude.com/docs/claude-tag/concepts/agent-identity.md#direct-message-channels).
2929
30To add or remove connectors on your account, open the **Customize > Connectors** page on claude.ai; see [connectors on claude.ai](/docs/connectors/getting-started.md) for setup.
30To add or remove connectors on your account, open the **Customize > Connectors** page on claude.ai; see [connectors on claude.ai](https://claude.com/docs/connectors/getting-started.md) for setup.
3131
3232### Example calendar request in a channel
3333
from line 45
4545
4646Claude Tag connectors an admin attached to the channel give everyone in the channel the same access. They use the account the admin set up for Claude in each service, so Claude reaches whatever that account can reach, whoever asks.
4747
48If a Claude Tag connector in the channel can open a document your own account can't, Claude can still read and summarize it in that channel when you ask. See [agent access](/docs/claude-tag/concepts/agent-identity.md#agent-access) for how admins limit what a channel can reach.
48If a Claude Tag connector in the channel can open a document your own account can't, Claude can still read and summarize it in that channel when you ask. See [agent access](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-access) for how admins limit what a channel can reach.
4949
5050## Control connector use
5151
from line 89
8989* **Require human review of every message.** On the Enterprise plan, an admin can turn this switch on so that Claude holds every result for the requester's review, not only the ones the [sensitive-content check](#review-results-before-posting) flags. With it on, the prompt no longer offers **Allow** and the **Home** tab no longer offers **Auto mode**. With it off, and on the Team plan, which has no such switch, each member's own [choice](#approve-connector-use) decides which results Claude holds.
9090* **Sensitive information requiring review.** Shows examples of what the check looks for. An Owner can add topics of their own under **Additional topics**, for example "Board meeting notes are confidential", and Claude holds results that touch them.
9191
92There is no setting that turns personal connectors in channels off for an organization. To keep a service out of channels entirely, manage the connector itself in your organization's [connector settings](/docs/connectors/getting-started.md).
92There is no setting that turns personal connectors in channels off for an organization. To keep a service out of channels entirely, manage the connector itself in your organization's [connector settings](https://claude.com/docs/connectors/getting-started.md).
9393
94On the Enterprise plan, keep Claude Opus 5 turned on under **Model access** on your organization's [**Models**](https://claude.ai/admin-settings/models) page, which an Owner or Admin can edit. With Claude Opus 5 turned off for the organization, Claude declines tasks that need a member's personal connectors, whichever model the thread runs on. Claude runs the checks on those tasks on Claude Opus 5, and other channel work continues. For the member's side of this, see [Claude says it needs Claude Opus 5 to use my personal connectors](/docs/claude-tag/users/troubleshooting.md#claude-says-it-needs-claude-opus-5-to-use-my-personal-connectors).
94On the Enterprise plan, keep Claude Opus 5 turned on under **Model access** on your organization's [**Models**](https://claude.ai/admin-settings/models) page, which an Owner or Admin can edit. With Claude Opus 5 turned off for the organization, Claude declines tasks that need a member's personal connectors, whichever model the thread runs on. Claude runs the checks on those tasks on Claude Opus 5, and other channel work continues. For the member's side of this, see [Claude says it needs Claude Opus 5 to use my personal connectors](https://claude.com/docs/claude-tag/users/troubleshooting.md#claude-says-it-needs-claude-opus-5-to-use-my-personal-connectors).
9595
9696### Stop connector use
9797
from line 111
111111
112112## Related resources
113113
114* [How agent identity works](/docs/claude-tag/concepts/agent-identity.md): whose identity and access Claude uses in channels and DMs
115* [Connectors](/docs/connectors/getting-started.md): set up and manage connectors on your claude.ai account
116* [Get started](/docs/claude-tag/users/getting-started.md): hand Claude your first task in a channel
114* [How agent identity works](https://claude.com/docs/claude-tag/concepts/agent-identity.md): whose identity and access Claude uses in channels and DMs
115* [Connectors](https://claude.com/docs/connectors/getting-started.md): set up and manage connectors on your claude.ai account
116* [Get started](https://claude.com/docs/claude-tag/users/getting-started.md): hand Claude your first task in a channel
117117
claude-tag/concepts/security-and-data Changed · +25 / -25 lines
from line 6
66>
77> Claude Tag is in public beta. Features and behavior described here may change before general availability.
88
9In channels, Claude acts under its own service accounts. By default it can read and post in Slack channels it's been added to and search public channels by keyword; it has no access to your external systems until an Owner or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) adds Claude Tag connectors. An admin chooses where each connector applies, from every channel down to one, and the actions Claude takes in connected tools are attributable to its own service accounts.
9In channels, Claude acts under its own service accounts. By default it can read and post in Slack channels it's been added to and search public channels by keyword; it has no access to your external systems until an Owner or a [Claude Tag admin](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) adds Claude Tag connectors. An admin chooses where each connector applies, from every channel down to one, and the actions Claude takes in connected tools are attributable to its own service accounts.
1010
1111Every channel request, whether a person typed it or a schedule triggered it, follows the same path: it runs in an isolated sandbox, and the credentials you provision aren't placed in that sandbox. In an Anthropic-hosted environment, requests leave that sandbox only through Agent Proxy and reach your systems under the agent's own accounts. Sessions in a [self-hosted environment](https://code.claude.com/docs/en/self-hosted-environments) run on runners inside your network, and Claude can't use the connectors an admin adds in those sessions.
1212
13One-to-one DMs from members who have connected a Claude account run on the member's own claude.ai account instead and are covered separately on [How agent identity works](/docs/claude-tag/concepts/agent-identity.md#direct-message-channels). For DMs from members who haven't, see [Direct messages from members without a Claude account](/docs/claude-tag/admins/restrict-access.md#access-in-a-direct-message-from-a-member-without-a-claude-account).
13One-to-one DMs from members who have connected a Claude account run on the member's own claude.ai account instead and are covered separately on [How agent identity works](https://claude.com/docs/claude-tag/concepts/agent-identity.md#direct-message-channels). For DMs from members who haven't, see [Direct messages from members without a Claude account](https://claude.com/docs/claude-tag/admins/restrict-access.md#access-in-a-direct-message-from-a-member-without-a-claude-account).
1414
1515## How a request travels
1616
from line 21
2121| Checkpoint | The guarantee |
2222| :- | :- |
2323| The sandbox | Holds none of the credentials you provision |
24| Agent Proxy | Injects credentials from the credential store at request time, and blocks a request that no [credential's allowed websites](/docs/claude-tag/admins/add-connections.md#set-allowed-websites), [allowed domain](/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential), or [environment network access level](/docs/claude-tag/admins/add-connections.md#broad-web-access-through-the-environment) allows |
24| Agent Proxy | Injects credentials from the credential store at request time, and blocks a request that no [credential's allowed websites](https://claude.com/docs/claude-tag/admins/add-connections.md#set-allowed-websites), [allowed domain](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential), or [environment network access level](https://claude.com/docs/claude-tag/admins/add-connections.md#broad-web-access-through-the-environment) allows |
2525| Your systems | See the agent's own accounts, so its actions there are attributable |
2626
2727### Compute and the sandbox
from line 33
3333* **Persists:** The thread, its visible work, and anything pushed to a branch, opened as a pull request, or posted into Slack.
3434* **Does not persist:** Files that existed only inside the sandbox. To keep generated files, ask Claude to push them to a branch or post them in the thread.
3535
36Claude Tag retains channel memory and session transcripts. Because of that retention, Claude Tag isn't available to organizations with Zero Data Retention (ZDR) enabled. Claude Tag also isn't available to organizations with a customer-managed encryption (CMEK) policy, or to organizations that have the [HIPAA configuration applied to Claude Code (local mode) and Cowork (local mode)](/docs/claude-tag/admins/healthcare.md#plan-and-organization-requirements).
36Claude Tag retains channel memory and session transcripts. Because of that retention, Claude Tag isn't available to organizations with Zero Data Retention (ZDR) enabled. Claude Tag also isn't available to organizations with a customer-managed encryption (CMEK) policy, or to organizations that have the [HIPAA configuration applied to Claude Code (local mode) and Cowork (local mode)](https://claude.com/docs/claude-tag/admins/healthcare.md#plan-and-organization-requirements).
3737
3838### Credential storage
3939
40Credentials you provision are kept in a separate credential store, not in the proxy itself. When an outbound request matches a rule, [Agent Proxy](/docs/claude-tag/concepts/agent-identity.md#agent-proxy), the network layer between the sandbox and any external host, retrieves the credential from that store and injects it at the boundary, so the model and the sandbox are not given the key.
40Credentials you provision are kept in a separate credential store, not in the proxy itself. When an outbound request matches a rule, [Agent Proxy](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy), the network layer between the sandbox and any external host, retrieves the credential from that store and injects it at the boundary, so the model and the sandbox are not given the key.
4141
4242This means:
4343
4444* **A saved credential is not displayed again.** The setup screens are write-only.
4545* **The credential travels only to the hosts you named** when you added it.
46* **You can narrow the credential further**, to one host, one path prefix, or read-only methods; see [Restrict by path or method](/docs/claude-tag/admins/add-connections.md#restrict-by-path-or-method).
46* **You can narrow the credential further**, to one host, one path prefix, or read-only methods; see [Restrict by path or method](https://claude.com/docs/claude-tag/admins/add-connections.md#restrict-by-path-or-method).
4747
4848### Network egress
4949
50In an Anthropic-hosted environment, outbound traffic from a channel session's sandbox is default-deny. Requests go only to hosts an allow layer covers, and the layers are a [credential's allowed websites](/docs/claude-tag/admins/connections/custom.md#fill-out-the-custom-tool-form), the [allowed domains](/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential) that apply to the channel, and the network access setting of the [environment](/docs/claude-tag/concepts/glossary.md#environment) the scope's sessions run on. A new environment's default level, Trusted access, already covers a [documented set of package registries and developer hosts](https://code.claude.com/docs/en/cloud-environments#default-allowed-domains). See [Agent Proxy](/docs/claude-tag/concepts/agent-identity.md#agent-proxy) for what happens to a request under each layer.
50In an Anthropic-hosted environment, outbound traffic from a channel session's sandbox is default-deny. Requests go only to hosts an allow layer covers, and the layers are a [credential's allowed websites](https://claude.com/docs/claude-tag/admins/connections/custom.md#fill-out-the-custom-tool-form), the [allowed domains](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential) that apply to the channel, and the network access setting of the [environment](https://claude.com/docs/claude-tag/concepts/glossary.md#environment) the scope's sessions run on. A new environment's default level, Trusted access, already covers a [documented set of package registries and developer hosts](https://code.claude.com/docs/en/cloud-environments#default-allowed-domains). See [Agent Proxy](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy) for what happens to a request under each layer.
5151
5252
5353
54Because requests to any other host are blocked, data can only leave the sandbox to hosts an allow layer covers. An admin sets the allowed websites on each credential and the allowed domains. An admin sets the environment's network access level, which defaults to Trusted access, from the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings). See [Set allowed websites](/docs/claude-tag/admins/add-connections.md#set-allowed-websites) and [Allow a host without a credential](/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential).
54Because requests to any other host are blocked, data can only leave the sandbox to hosts an allow layer covers. An admin sets the allowed websites on each credential and the allowed domains. An admin sets the environment's network access level, which defaults to Trusted access, from the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings). See [Set allowed websites](https://claude.com/docs/claude-tag/admins/add-connections.md#set-allowed-websites) and [Allow a host without a credential](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential).
5555
56Allow-all egress is a `*` domain. The entry admits requests to any host on the ports it lists, still without credentials. Private and internal network addresses and cloud metadata endpoints remain blocked. See [Allow all hosts](/docs/claude-tag/admins/add-connections.md#allow-all-hosts).
56Allow-all egress is a `*` domain. The entry admits requests to any host on the ports it lists, still without credentials. Private and internal network addresses and cloud metadata endpoints remain blocked. See [Allow all hosts](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-all-hosts).
5757
5858### Service accounts
5959
60In channels, Claude acts under service credentials of its own, not under the account of the person who tagged it. The Slack surface is the Claude app, code work goes through the Claude GitHub App, and every other connected tool uses a service account whose credential a [connector](/docs/claude-tag/concepts/glossary.md#connection) holds. See [How agent identity works](/docs/claude-tag/concepts/agent-identity.md) for the full model.
60In channels, Claude acts under service credentials of its own, not under the account of the person who tagged it. The Slack surface is the Claude app, code work goes through the Claude GitHub App, and every other connected tool uses a service account whose credential a [connector](https://claude.com/docs/claude-tag/concepts/glossary.md#connection) holds. See [How agent identity works](https://claude.com/docs/claude-tag/concepts/agent-identity.md) for the full model.
6161
62A connector's credential belongs to that agent identity and is shared by everyone in the channels where it applies. Anyone in one of those channels can ask Claude to act with the credential, so whatever the connected account can read or write is available to every member of those channels. Connect a dedicated identity you control for each service, such as a `[email protected]` seat or a native service account, rather than a personal login. A dedicated account keeps the agent's actions separately auditable in each tool's logs and lets you revoke its access without affecting a person; see [Create a dedicated account per service](/docs/claude-tag/admins/add-connections.md#create-a-dedicated-account-per-service).
62A connector's credential belongs to that agent identity and is shared by everyone in the channels where it applies. Anyone in one of those channels can ask Claude to act with the credential, so whatever the connected account can read or write is available to every member of those channels. Connect a dedicated identity you control for each service, such as a `[email protected]` seat or a native service account, rather than a personal login. A dedicated account keeps the agent's actions separately auditable in each tool's logs and lets you revoke its access without affecting a person; see [Create a dedicated account per service](https://claude.com/docs/claude-tag/admins/add-connections.md#create-a-dedicated-account-per-service).
6363
64One-to-one DMs with `@Claude` from a member who has connected a Claude account run on that member's own claude.ai account instead, with that member's personal connectors, and work there is attributed to them, except pull requests, which the Claude GitHub App authors from DMs as well. For DMs from members who haven't, see [Direct messages from members without a Claude account](/docs/claude-tag/admins/restrict-access.md#access-in-a-direct-message-from-a-member-without-a-claude-account). An Owner can turn off DMs for the whole organization; see [Allow or disable direct messages](/docs/claude-tag/admins/restrict-access.md#allow-or-disable-direct-messages).
64One-to-one DMs with `@Claude` from a member who has connected a Claude account run on that member's own claude.ai account instead, with that member's personal connectors, and work there is attributed to them, except pull requests, which the Claude GitHub App authors from DMs as well. For DMs from members who haven't, see [Direct messages from members without a Claude account](https://claude.com/docs/claude-tag/admins/restrict-access.md#access-in-a-direct-message-from-a-member-without-a-claude-account). An Owner can turn off DMs for the whole organization; see [Allow or disable direct messages](https://claude.com/docs/claude-tag/admins/restrict-access.md#allow-or-disable-direct-messages).
6565
66Claude uses a user's [personal connectors in a channel](/docs/claude-tag/concepts/personal-connectors.md) only for that user's own tasks, after the user allows it. The work runs with that user's permissions and is recorded under their name. Requests other people make to Claude in the task's thread run with the channel's own access, not with that user's connectors. Claude is designed to take direction from the connector's owner, treating what other people post in the thread as information for the task rather than as instructions, and the owner can tell Claude in the task's thread to stop. On the Enterprise plan, an admin can require [the user's review of every result](/docs/claude-tag/concepts/personal-connectors.md#admin-controls-for-personal-connectors) before it posts. See [Personal connectors in channels](/docs/claude-tag/concepts/personal-connectors.md).
66Claude uses a user's [personal connectors in a channel](https://claude.com/docs/claude-tag/concepts/personal-connectors.md) only for that user's own tasks, after the user allows it. The work runs with that user's permissions and is recorded under their name. Requests other people make to Claude in the task's thread run with the channel's own access, not with that user's connectors. Claude is designed to take direction from the connector's owner, treating what other people post in the thread as information for the task rather than as instructions, and the owner can tell Claude in the task's thread to stop. On the Enterprise plan, an admin can require [the user's review of every result](https://claude.com/docs/claude-tag/concepts/personal-connectors.md#admin-controls-for-personal-connectors) before it posts. See [Personal connectors in channels](https://claude.com/docs/claude-tag/concepts/personal-connectors.md).
6767
6868### Isolate credentials between channels
6969
from line 71
7171
7272* **The channel itself.** Access added on the channel's page, or a bundle applied to the channel, reaches that channel only.
7373* **The channel's workspace.** Access added on the workspace's page, or a bundle applied to the workspace, reaches every channel of that workspace.
74* **All of Slack.** Access added on the **Slack** page, or a bundle applied there, reaches every channel of every paired workspace. The first credential you add for a service on the **Connectors** tab is on here as soon as you save it. See [how scopes inherit](/docs/claude-tag/admins/attach-to-scope.md#how-scopes-inherit).
74* **All of Slack.** Access added on the **Slack** page, or a bundle applied there, reaches every channel of every paired workspace. The first credential you add for a service on the **Connectors** tab is on here as soon as you save it. See [how scopes inherit](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#how-scopes-inherit).
7575* **A channel rule.** A bundle an Owner applies to a channel name pattern reaches every matching channel in all of Slack or in one workspace, including channels created or renamed later.
7676
7777Access applied anywhere else in your organization is invisible to the session, and no request from the session's sandbox can carry a credential that doesn't apply to its channel.
from line 84
8484 * In a bundle whose **Where it applies** list holds only that channel.
8585 * From the channel's page. Under **Claude's access**, click **Add** and select **Connector**. On the dialog's **Connectors** tab, select the service under **Connect new** and click **Continue**. The credential you enter in the connect form applies in that channel only.
8686 * On the page of a connector already on the **Connectors** tab, select **Add credential** from the **⋮** menu at the top of the page. The new credential is off everywhere until you pick it in the channel's row under **Assign access**, selecting **Add place** if the channel isn't listed.
872. Keep the channel private. Access on a public channel [reaches anyone who joins](/docs/claude-tag/admins/attach-to-scope.md#attach-to-a-channel).
872. Keep the channel private. Access on a public channel [reaches anyone who joins](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#attach-to-a-channel).
88883. Open the channel from the **Channels** tab under **Claude's access** at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag) and check its **Claude's access** table. It lists the access that reaches the channel, and an item a bundle brings is listed under that bundle's row. The **Inheritance** column shows whether each bundle, and each item outside a bundle, was added on the channel's page or inherited from the workspace or from **Slack**.
8989
90In a channel shared with another company through [Slack Connect](/docs/claude-tag/admins/restrict-access.md#slack-connect-channels), once Claude is turned on there, it has the connector credentials from the [bundles attached directly to that channel](/docs/claude-tag/admins/restrict-access.md#what-access-claude-has-in-a-slack-connect-channel), including bundles attached before the channel was shared. It also has those from any bundle attached specifically for Slack Connect channels, and it can use them for anyone it answers there, including the other company's people. Credentials inherited from the workspace or the **Slack** page don't reach that channel, and neither do members' [personal connectors](/docs/claude-tag/concepts/personal-connectors.md). Before you share a channel that already has bundles, check its **Claude's access** table and [remove the channel from any bundle](/docs/claude-tag/admins/attach-to-scope.md#choose-where-a-bundle-applies) you don't want used for the other company's people.
90In a channel shared with another company through [Slack Connect](https://claude.com/docs/claude-tag/admins/restrict-access.md#slack-connect-channels), once Claude is turned on there, it has the connector credentials from the [bundles attached directly to that channel](https://claude.com/docs/claude-tag/admins/restrict-access.md#what-access-claude-has-in-a-slack-connect-channel), including bundles attached before the channel was shared. It also has those from any bundle attached specifically for Slack Connect channels, and it can use them for anyone it answers there, including the other company's people. Credentials inherited from the workspace or the **Slack** page don't reach that channel, and neither do members' [personal connectors](https://claude.com/docs/claude-tag/concepts/personal-connectors.md). Before you share a channel that already has bundles, check its **Claude's access** table and [remove the channel from any bundle](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#choose-where-a-bundle-applies) you don't want used for the other company's people.
9191
92When you ask Claude in one channel to post into another, Claude works with the access and instructions of the channel you asked in, not the target channel's. From a private channel, Claude doesn't post anywhere else, and nothing asked elsewhere makes Claude post into a private channel. [What Claude can do in other channels](/docs/claude-tag/concepts/how-it-works.md#what-claude-can-do-in-other-channels) covers where Claude can post from each place you ask.
92When you ask Claude in one channel to post into another, Claude works with the access and instructions of the channel you asked in, not the target channel's. From a private channel, Claude doesn't post anywhere else, and nothing asked elsewhere makes Claude post into a private channel. [What Claude can do in other channels](https://claude.com/docs/claude-tag/concepts/how-it-works.md#what-claude-can-do-in-other-channels) covers where Claude can post from each place you ask.
9393
94Isolating a credential doesn't isolate what Claude knows. The [workspace notes](/docs/claude-tag/users/memory.md) it saves from a public channel are read by sessions in every channel of the workspace, and it can [search public channels by keyword](/docs/claude-tag/admins/restrict-access.md#controls-that-aren%E2%80%99t-available) without being added to them, the same way any workspace member can.
94Isolating a credential doesn't isolate what Claude knows. The [workspace notes](https://claude.com/docs/claude-tag/users/memory.md) it saves from a public channel are read by sessions in every channel of the workspace, and it can [search public channels by keyword](https://claude.com/docs/claude-tag/admins/restrict-access.md#controls-that-aren%E2%80%99t-available) without being added to them, the same way any workspace member can.
9595
9696## Artifact visibility
9797
98A session can publish an artifact, a web page hosted on claude.ai with the link posted in the thread, and the page stays available after the sandbox is released. Anyone with access to the source Slack channel can open it, which in a public channel covers everyone in the workspace. Someone who opens the link without that access can't see the page and has no option to request access. There is no share setting for anyone to change. Updates go through Claude: ask in the Slack thread, or [send Claude a comment on the page](/docs/claude-tag/users/use-cases/create-artifacts.md#comment-on-the-page-to-ask-for-changes), which anyone who can post in the channel can do.
98A session can publish an artifact, a web page hosted on claude.ai with the link posted in the thread, and the page stays available after the sandbox is released. Anyone with access to the source Slack channel can open it, which in a public channel covers everyone in the workspace. Someone who opens the link without that access can't see the page and has no option to request access. There is no share setting for anyone to change. Updates go through Claude: ask in the Slack thread, or [send Claude a comment on the page](https://claude.com/docs/claude-tag/users/use-cases/create-artifacts.md#comment-on-the-page-to-ask-for-changes), which anyone who can post in the channel can do.
9999
100While a Slack guest is in a channel set to [**Channel only**](/docs/claude-tag/admins/restrict-access.md#how-channel-only-works), Claude doesn't publish artifacts there.
100While a Slack guest is in a channel set to [**Channel only**](https://claude.com/docs/claude-tag/admins/restrict-access.md#how-channel-only-works), Claude doesn't publish artifacts there.
101101
102102Artifacts you publish from your own Claude Code sessions work differently: they belong to you, and you control who can open them, with sharing options that depend on your plan and organization settings. See the [Claude Code artifacts documentation](https://code.claude.com/docs/en/artifacts).
103103
from line 108
108108* **Team plans**: **Restrict to your organization** limits Claude to people with a Claude account in your organization
109109* **Enterprise plans**: **Restrict to roles with Claude Tag access** limits Claude to members whose role grants the **Claude Tag in Slack** capability
110110
111See [Restrict who can use Claude](/docs/claude-tag/admins/restrict-access.md#restrict-who-can-use-claude). The restriction governs DMs as well as channels.
111See [Restrict who can use Claude](https://claude.com/docs/claude-tag/admins/restrict-access.md#restrict-who-can-use-claude). The restriction governs DMs as well as channels.
112112
113113## Related resources
114114
115* [How agent identity works](/docs/claude-tag/concepts/agent-identity.md): the identity model in full, including DM attribution
116* [Data lifecycle and deletion](/docs/claude-tag/concepts/data-lifecycle.md): what Anthropic stores, how long it's kept, and what each action deletes
117* [Restrict where Claude Tag operates](/docs/claude-tag/admins/restrict-access.md): the controls that exist and the ones that don't
118* [Audit Claude Tag activity](/docs/claude-tag/admins/audit.md): the trails for tracing what it did
115* [How agent identity works](https://claude.com/docs/claude-tag/concepts/agent-identity.md): the identity model in full, including DM attribution
116* [Data lifecycle and deletion](https://claude.com/docs/claude-tag/concepts/data-lifecycle.md): what Anthropic stores, how long it's kept, and what each action deletes
117* [Restrict where Claude Tag operates](https://claude.com/docs/claude-tag/admins/restrict-access.md): the controls that exist and the ones that don't
118* [Audit Claude Tag activity](https://claude.com/docs/claude-tag/admins/audit.md): the trails for tracing what it did
119119
claude-tag/concepts/settings-map Changed · +23 / -23 lines
from line 10
1010
1111| Surface | Who changes it | What it controls |
1212| :- | :- | :- |
13| [**Organization settings > Claude Tag**](https://claude.ai/admin-settings/claude-tag) | An Owner in your Claude organization, or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) on the Enterprise plan | Access, behavior, and restrictions for channels, mostly per [workspace and channel](/docs/claude-tag/concepts/glossary.md#scope) |
13| [**Organization settings > Claude Tag**](https://claude.ai/admin-settings/claude-tag) | An Owner in your Claude organization, or a [Claude Tag admin](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) on the Enterprise plan | Access, behavior, and restrictions for channels, mostly per [workspace and channel](https://claude.com/docs/claude-tag/concepts/glossary.md#scope) |
1414| [Usage page](https://claude.ai/admin-settings/usage/claude-tag) | An admin | Spend limits and each channel's spend against them |
1515| [Analytics page](https://claude.ai/analytics/claude-tag) | Anyone who can view the Analytics dashboard | Spend trends, projections, and per-channel reports; read-only |
16| The **Configure** link in the footer of any Claude reply in a channel | Channel members (unless an admin restricts editing) and [channel managers](/docs/claude-tag/admins/restrict-access.md#delegate-channel-setup-to-channel-managers) for their assigned channels | One channel's instructions and whether Claude replies there without an @-mention. Channel managers also set the channel's default model, repositories, connections, and plugins |
17| [Customize > Connectors](https://claude.ai/customize/connectors) on your own claude.ai account | You | Which of your personal tools apply in [one-to-one DMs](/docs/claude-tag/concepts/agent-identity.md#direct-message-channels) and for [your own tasks in a channel](/docs/claude-tag/concepts/personal-connectors.md) |
16| The **Configure** link in the footer of any Claude reply in a channel | Channel members (unless an admin restricts editing) and [channel managers](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-channel-setup-to-channel-managers) for their assigned channels | One channel's instructions and whether Claude replies there without an @-mention. Channel managers also set the channel's default model, repositories, connections, and plugins |
17| [Customize > Connectors](https://claude.ai/customize/connectors) on your own claude.ai account | You | Which of your personal tools apply in [one-to-one DMs](https://claude.com/docs/claude-tag/concepts/agent-identity.md#direct-message-channels) and for [your own tasks in a channel](https://claude.com/docs/claude-tag/concepts/personal-connectors.md) |
1818
19Channel memory and routines aren't in the table because you change them by talking to Claude in the channel; see [what anyone can change from the channel](/docs/claude-tag/admins/customize.md#change-behavior-from-the-channel). Owners can review both on the **Scheduled work** and **Memory** tabs of the [**Activity** page](/docs/claude-tag/admins/audit.md). Only an Owner can edit or delete memory entries.
19Channel memory and routines aren't in the table because you change them by talking to Claude in the channel; see [what anyone can change from the channel](https://claude.com/docs/claude-tag/admins/customize.md#change-behavior-from-the-channel). Owners can review both on the **Scheduled work** and **Memory** tabs of the [**Activity** page](https://claude.com/docs/claude-tag/admins/audit.md). Only an Owner can edit or delete memory entries.
2020
2121## Claude Tag admin settings
2222
23Everything an admin configures for channels lives at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag). Most settings there apply per scope (a channel, a workspace, or the whole organization), and each scope has its own page on the **Channels** tab under **Claude's access**. A scope without its own setting inherits from its parent, and a channel's setting overrides its workspace's, so two channels can run with different connectors, models, and instructions. Most controls need the Owner role or, on the Enterprise plan, the [**Claude Tag Admin** permission](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration); the [permissions table](/docs/claude-tag/admins/restrict-access.md#permissions-by-role) lists each action and who can take it.
23Everything an admin configures for channels lives at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag). Most settings there apply per scope (a channel, a workspace, or the whole organization), and each scope has its own page on the **Channels** tab under **Claude's access**. A scope without its own setting inherits from its parent, and a channel's setting overrides its workspace's, so two channels can run with different connectors, models, and instructions. Most controls need the Owner role or, on the Enterprise plan, the [**Claude Tag Admin** permission](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration); the [permissions table](https://claude.com/docs/claude-tag/admins/restrict-access.md#permissions-by-role) lists each action and who can take it.
2424
25* **Bundles**: the connectors, domains, repositories, plugins, and instructions Claude uses in the workspaces and channels a bundle applies to. The **Connectors** and **Skills and plugins** tabs add a new connector, plugin, or skill. See [Give Claude access](/docs/claude-tag/admins/add-connections.md).
26* **Custom instructions**: standing guidance Claude reads in every session on a scope. See [Add custom instructions](/docs/claude-tag/admins/attach-to-scope.md#add-custom-instructions).
27* **Model**: the model new sessions in a scope start on, set in the **Model** row on the main Claude Tag page for the whole organization and on each workspace's and channel's page. The picker shows the models your organization allows for Claude Code, leaving out any that Claude Tag doesn't support, so it can be missing models you see in Claude Code itself. See [Choose the model for a scope](/docs/claude-tag/admins/customize.md#choose-the-model-for-a-scope).
28* **Auto mode allow rules**: plain sentences that pre-approve actions Claude's permission checker would otherwise flag or stop in a scope's sessions. See [Auto mode allow rules](/docs/claude-tag/admins/customize.md#auto-mode-allow-rules).
29* **Workspace pairing and restrictions**: which Slack workspaces are paired, whether DMs are allowed, guest-channel behavior, which channels Claude can search, who can invoke Claude, and which generation of the app answers in each scope (some Team plan organizations have a [single on-or-off switch](/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-on-the-team-plan) in place of the per-scope setting). See [Restrict where Claude Tag operates](/docs/claude-tag/admins/restrict-access.md).
30* **Channel name rules**: channel-name patterns that keep Claude out of matching channels, join it automatically to new public ones, or attach a bundle to every matching channel. See [Block or auto-join channels by name](/docs/claude-tag/admins/restrict-access.md#block-or-auto-join-channels-by-name).
31* **Personal connectors**: on the Enterprise plan, whether Claude holds every result of a member's connector task for that member's review before posting it, and the topics an Owner adds to the sensitive-content check. These settings apply to the whole organization rather than per scope, and you reach them with **Edit** on the **Personal connectors** row of the main Claude Tag page. See [Admin controls for personal connectors](/docs/claude-tag/concepts/personal-connectors.md#admin-controls-for-personal-connectors).
25* **Bundles**: the connectors, domains, repositories, plugins, and instructions Claude uses in the workspaces and channels a bundle applies to. The **Connectors** and **Skills and plugins** tabs add a new connector, plugin, or skill. See [Give Claude access](https://claude.com/docs/claude-tag/admins/add-connections.md).
26* **Custom instructions**: standing guidance Claude reads in every session on a scope. See [Add custom instructions](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#add-custom-instructions).
27* **Model**: the model new sessions in a scope start on, set in the **Model** row on the main Claude Tag page for the whole organization and on each workspace's and channel's page. The picker shows the models your organization allows for Claude Code, leaving out any that Claude Tag doesn't support, so it can be missing models you see in Claude Code itself. See [Choose the model for a scope](https://claude.com/docs/claude-tag/admins/customize.md#choose-the-model-for-a-scope).
28* **Auto mode allow rules**: plain sentences that pre-approve actions Claude's permission checker would otherwise flag or stop in a scope's sessions. See [Auto mode allow rules](https://claude.com/docs/claude-tag/admins/customize.md#auto-mode-allow-rules).
29* **Workspace pairing and restrictions**: which Slack workspaces are paired, whether DMs are allowed, guest-channel behavior, which channels Claude can search, who can invoke Claude, and which generation of the app answers in each scope (some Team plan organizations have a [single on-or-off switch](https://claude.com/docs/claude-tag/admins/workspaces.md#turn-claude-tag-on-or-off-on-the-team-plan) in place of the per-scope setting). See [Restrict where Claude Tag operates](https://claude.com/docs/claude-tag/admins/restrict-access.md).
30* **Channel name rules**: channel-name patterns that keep Claude out of matching channels, join it automatically to new public ones, or attach a bundle to every matching channel. See [Block or auto-join channels by name](https://claude.com/docs/claude-tag/admins/restrict-access.md#block-or-auto-join-channels-by-name).
31* **Personal connectors**: on the Enterprise plan, whether Claude holds every result of a member's connector task for that member's review before posting it, and the topics an Owner adds to the sensitive-content check. These settings apply to the whole organization rather than per scope, and you reach them with **Edit** on the **Personal connectors** row of the main Claude Tag page. See [Admin controls for personal connectors](https://claude.com/docs/claude-tag/concepts/personal-connectors.md#admin-controls-for-personal-connectors).
3232
3333## Spend limits and usage
3434
35Spend limits live on the usage page at [`claude.ai/admin-settings/usage/claude-tag`](https://claude.ai/admin-settings/usage/claude-tag), separate from Claude Tag admin settings. The usage page holds the organization-wide spend limit, the default spend limit for channels, per-channel limits, and each channel's spend against its limit. If your organization bills through a reseller, this page is not available. See [Set a spend limit](/docs/claude-tag/admins/set-spend-limit.md) for funding the usage balance and what users see when a limit is reached.
35Spend limits live on the usage page at [`claude.ai/admin-settings/usage/claude-tag`](https://claude.ai/admin-settings/usage/claude-tag), separate from Claude Tag admin settings. The usage page holds the organization-wide spend limit, the default spend limit for channels, per-channel limits, and each channel's spend against its limit. If your organization bills through a reseller, this page is not available. See [Set a spend limit](https://claude.com/docs/claude-tag/admins/set-spend-limit.md) for funding the usage balance and what users see when a limit is reached.
3636
3737Usage covered by a promotional credit isn't counted on the usage page and shows as \$0.00 there. To see each channel's list-price spend for the current month including covered usage, use the **List price** column of the **Spend by channel** table at [`claude.ai/analytics/claude-tag`](https://claude.ai/analytics/claude-tag).
3838
39Spend trends live at [`claude.ai/analytics/claude-tag`](https://claude.ai/analytics/claude-tag), the Claude Tag section of the Analytics dashboard. It shows total and projected spend, spend by channel, and [spend by kind of work](/docs/claude-tag/admins/set-spend-limit.md#see-spend-by-kind-of-work) for the period you pick, and anyone with permission to view the Analytics dashboard can open it. It has no controls; see [Usage analytics](/docs/claude-tag/admins/restrict-access.md#usage-analytics).
39Spend trends live at [`claude.ai/analytics/claude-tag`](https://claude.ai/analytics/claude-tag), the Claude Tag section of the Analytics dashboard. It shows total and projected spend, spend by channel, and [spend by kind of work](https://claude.com/docs/claude-tag/admins/set-spend-limit.md#see-spend-by-kind-of-work) for the period you pick, and anyone with permission to view the Analytics dashboard can open it. It has no controls; see [Usage analytics](https://claude.com/docs/claude-tag/admins/restrict-access.md#usage-analytics).
4040
4141## The Configure page
4242
43Every Claude reply in a channel ends with a footer, and its **Configure** link opens a claude.ai page for that channel; replies in DMs have no Configure link. You can also send [`@Claude !configure`](/docs/claude-tag/users/commands#get-the-link-to-configure-a-channel) in the channel, and Claude replies with a link to the same page.
43Every Claude reply in a channel ends with a footer, and its **Configure** link opens a claude.ai page for that channel; replies in DMs have no Configure link. You can also send [`@Claude !configure`](https://claude.com/docs/claude-tag/users/commands#get-the-link-to-configure-a-channel) in the channel, and Claude replies with a link to the same page.
4444
45Anyone in the channel who is also a member of your Claude organization can edit the **Channel instructions** field on that page, unless an admin has [restricted editing to admins](/docs/claude-tag/admins/attach-to-scope.md#restrict-who-can-set-channel-instructions). The page's **Respond automatically** toggle controls whether Claude replies in the channel without an @-mention; see [Turn automatic replies on or off](/docs/claude-tag/users/when-claude-responds.md#turn-automatic-replies-on-or-off).
45Anyone in the channel who is also a member of your Claude organization can edit the **Channel instructions** field on that page, unless an admin has [restricted editing to admins](https://claude.com/docs/claude-tag/admins/attach-to-scope.md#restrict-who-can-set-channel-instructions). The page's **Respond automatically** toggle controls whether Claude replies in the channel without an @-mention; see [Turn automatic replies on or off](https://claude.com/docs/claude-tag/users/when-claude-responds.md#turn-automatic-replies-on-or-off).
4646
4747The page's **Tools and access** tab shows the channel's resolved connections and any allowed domains. Members can see those lists but not change them there. The same tab's **Plugins** card lists the channel's plugins, and members can add plugins there unless an admin has restricted editing to admins. A **Routines** tab lists the channel's routines with each one's schedule, status, and last run.
4848
49The Configure page and the **Channel instructions** field on the channel's page in admin settings write the same instructions, so a change from either place is visible in the other. See [Configure Claude for a channel](/docs/claude-tag/users/good-habits.md#configure-claude-for-a-channel).
49The Configure page and the **Channel instructions** field on the channel's page in admin settings write the same instructions, so a change from either place is visible in the other. See [Configure Claude for a channel](https://claude.com/docs/claude-tag/users/good-habits.md#configure-claude-for-a-channel).
5050
51On the Enterprise plan, an Owner can name [channel managers](/docs/claude-tag/admins/restrict-access.md#delegate-channel-setup-to-channel-managers) for a channel, and so can a [Claude Tag admin](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) whose role also sets **Identity & Access** to **Can manage**. For channel managers, the same page adds editable cards: the channel's default model on the **General** tab, and **GitHub repositories** and **Access bundles** on the **Tools and access** tab.
51On the Enterprise plan, an Owner can name [channel managers](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-channel-setup-to-channel-managers) for a channel, and so can a [Claude Tag admin](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) whose role also sets **Identity & Access** to **Can manage**. For channel managers, the same page adds editable cards: the channel's default model on the **General** tab, and **GitHub repositories** and **Access bundles** on the **Tools and access** tab.
5252
5353## Personal connectors on claude.ai
5454
55Connectors you add to your own claude.ai account, under **Customize > Connectors**, apply in one-to-one DMs with Claude, because [a DM runs on your own account](/docs/claude-tag/concepts/agent-identity.md#direct-message-channels). A channel session uses the connections an admin attached to it. Claude can also [use your personal connectors there](/docs/claude-tag/concepts/personal-connectors.md) for your own tasks, after you allow it. Slack has no connector settings of its own.
55Connectors you add to your own claude.ai account, under **Customize > Connectors**, apply in one-to-one DMs with Claude, because [a DM runs on your own account](https://claude.com/docs/claude-tag/concepts/agent-identity.md#direct-message-channels). A channel session uses the connections an admin attached to it. Claude can also [use your personal connectors there](https://claude.com/docs/claude-tag/concepts/personal-connectors.md) for your own tasks, after you allow it. Slack has no connector settings of its own.
5656
57See [connectors on claude.ai](/docs/connectors/getting-started.md) for setting one up, and [the troubleshooting entry](/docs/claude-tag/users/troubleshooting.md#a-connector-works-on-claude-ai-but-not-in-slack) if a connector you use on claude.ai is missing in Slack.
57See [connectors on claude.ai](https://claude.com/docs/connectors/getting-started.md) for setting one up, and [the troubleshooting entry](https://claude.com/docs/claude-tag/users/troubleshooting.md#a-connector-works-on-claude-ai-but-not-in-slack) if a connector you use on claude.ai is missing in Slack.
5858
5959## Claude Tag versus Claude Managed Agents
6060
from line 64
6464
6565## Related resources
6666
67* [Customize Claude Tag](/docs/claude-tag/admins/customize.md): the layers that shape Claude's behavior in a channel and who sets each one
68* [How agent identity works](/docs/claude-tag/concepts/agent-identity.md): why channels and DMs use different access
69* [Set up Claude Tag](/docs/claude-tag/admins/setup-overview): pair a workspace, launch, and give Claude access
67* [Customize Claude Tag](https://claude.com/docs/claude-tag/admins/customize.md): the layers that shape Claude's behavior in a channel and who sets each one
68* [How agent identity works](https://claude.com/docs/claude-tag/concepts/agent-identity.md): why channels and DMs use different access
69* [Set up Claude Tag](https://claude.com/docs/claude-tag/admins/setup-overview): pair a workspace, launch, and give Claude access
7070