One read of Claude Documentationclaude-docs-20261024T023705Z
4 pages moved out of 280 read.
Pages moved
4
significant first
Pages read
280
in this capture
Captured
02:37 UTC
Corpus hash
257eea1ed6da
corpus-hash
What this read moved
1-4 of 4claude-tag/concepts/agent-identity Changed · +6 / -4 lines
from line 26
2626
2727The diagram below traces one request through this process.
2828
29
29
3030
3131**1. Tag Claude in a channel**
3232
from line 38
3838
3939**3. The request crosses Agent Proxy**
4040
41When the work needs something outside the sandbox, like calling the GitHub API or querying a warehouse, the request crosses Agent Proxy, the network boundary between the sandbox and everything else. Agent Proxy checks it against the rules an admin configured, and decides whether it proceeds and what credential, if any, travels with it.
41When the work needs something outside the sandbox, like querying a warehouse, the request crosses Agent Proxy, the network boundary between the sandbox and everything else. Agent Proxy checks it against the rules an admin configured, and decides whether it proceeds and what credential, if any, travels with it.
4242
4343**4. Agent Proxy attaches a credential**
4444
from line 46
4646
4747**5. The result posts back, as Claude**
4848
49The credentialed request reaches your system, like GitHub or the warehouse, and the result returns to the thread.
49The credentialed request reaches your system, like the warehouse, and the result returns to the thread.
5050
5151### Agent Proxy
5252
53For each outbound request from the sandbox, Agent Proxy checks the destination against three allow layers. A request goes through if any one of them allows it; a host that none of them allows is blocked.
53For each outbound request from the sandbox, other than a GitHub API request or a git operation, Agent Proxy checks the destination against three allow layers. A request goes through if any one of them allows it; a host that none of them allows is blocked.
5454
5555| When the destination | Result |
5656| :- | :- |
from line 70
7070### How a host gets allowed
7171
7272A host that none of the three layers above allows is blocked, and Claude names the blocked host in the thread so an admin can add it; see [Give Claude access to your tools](https://claude.com/docs/claude-tag/admins/add-connections.md).
73
74A GitHub API request or a git operation doesn't go through those layers. It goes through a separate GitHub proxy. See [Network egress](https://claude.com/docs/claude-tag/concepts/security-and-data.md#network-egress) for what governs those requests instead.
7375
7476### Web search vs. network requests
7577
claude-tag/concepts/security-and-data Changed · +8 / -6 lines
from line 8
88
99In channels, Claude acts under its own service accounts. By default it can read and post in Slack channels it's been added to and search public channels by keyword; it has no access to your external systems until an Owner or a [Claude Tag admin](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) adds Claude Tag connectors. An admin chooses where each connector applies, from every channel down to one, and the actions Claude takes in connected tools are attributable to its own service accounts.
1010
11Every channel request, whether a person typed it or a schedule triggered it, follows the same path: it runs in an isolated sandbox, and the credentials you provision aren't placed in that sandbox. In an Anthropic-hosted environment, requests leave that sandbox only through Agent Proxy and reach your systems under the agent's own accounts. Sessions in a [self-hosted environment](https://code.claude.com/docs/en/self-hosted-environments) run on runners inside your network, and Claude can't use the connectors an admin adds in those sessions.
11Every channel request, whether a person typed it or a schedule triggered it, follows the same path: it runs in an isolated sandbox, and the credentials you provision aren't placed in that sandbox. In an Anthropic-hosted environment, requests leave that sandbox through Agent Proxy, or through a separate GitHub proxy for [GitHub API requests and git operations](#network-egress), and reach your systems under the agent's own accounts. Sessions in a [self-hosted environment](https://code.claude.com/docs/en/self-hosted-environments) run on runners inside your network, and Claude can't use the connectors an admin adds in those sessions.
1212
1313One-to-one DMs from members who have connected a Claude account run on the member's own claude.ai account instead and are covered separately on [How agent identity works](https://claude.com/docs/claude-tag/concepts/agent-identity.md#direct-message-channels). For DMs from members who haven't, see [Direct messages from members without a Claude account](https://claude.com/docs/claude-tag/admins/restrict-access.md#access-in-a-direct-message-from-a-member-without-a-claude-account).
1414
1515## How a request travels
1616
17Each Slack thread runs in its own sandbox. In an Anthropic-hosted environment, every outbound call from that sandbox passes through the same checkpoints.
17Each Slack thread runs in its own sandbox. In an Anthropic-hosted environment, each outbound call from that sandbox, other than a [GitHub API request or a git operation](#network-egress), passes through the same checkpoints.
1818
19
19
2020
2121| Checkpoint | The guarantee |
2222| :- | :- |
2323| The sandbox | Holds none of the credentials you provision |
24| Agent Proxy | Injects credentials from the credential store at request time, and blocks a request that no [credential's allowed websites](https://claude.com/docs/claude-tag/admins/add-connections.md#set-allowed-websites), [allowed domain](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential), or [environment network access level](https://claude.com/docs/claude-tag/admins/add-connections.md#broad-web-access-through-the-environment) allows |
24| Agent Proxy | Injects credentials from the credential store at request time, and blocks a request that no [credential's allowed websites](https://claude.com/docs/claude-tag/admins/add-connections.md#set-allowed-websites), [allowed domain](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential), or [environment network access level](https://claude.com/docs/claude-tag/admins/add-connections.md#broad-web-access-through-the-environment) allows; GitHub API requests and git operations go through the separate [GitHub proxy](#network-egress) instead |
2525| Your systems | See the agent's own accounts, so its actions there are attributable |
2626
2727### Compute and the sandbox
from line 47
4747
4848### Network egress
4949
50In an Anthropic-hosted environment, outbound traffic from a channel session's sandbox is default-deny. Requests go only to hosts an allow layer covers, and the layers are a [credential's allowed websites](https://claude.com/docs/claude-tag/admins/connections/custom.md#fill-out-the-custom-tool-form), the [allowed domains](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential) that apply to the channel, and the network access setting of the [environment](https://claude.com/docs/claude-tag/concepts/glossary.md#environment) the scope's sessions run on. A new environment's default level, Trusted access, already covers a [documented set of package registries and developer hosts](https://code.claude.com/docs/en/cloud-environments#default-allowed-domains). See [Agent Proxy](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy) for what happens to a request under each layer.
50In an Anthropic-hosted environment, outbound traffic from a channel session's sandbox is default-deny, apart from its GitHub API requests and git operations. Requests go only to hosts an allow layer covers, and the layers are a [credential's allowed websites](https://claude.com/docs/claude-tag/admins/connections/custom.md#fill-out-the-custom-tool-form), the [allowed domains](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential) that apply to the channel, and the network access setting of the [environment](https://claude.com/docs/claude-tag/concepts/glossary.md#environment) the scope's sessions run on. A new environment's default level, Trusted access, already covers a [documented set of package registries and developer hosts](https://code.claude.com/docs/en/cloud-environments#default-allowed-domains). See [Agent Proxy](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy) for what happens to a request under each layer.
5151
5252
5353
54Because requests to any other host are blocked, data can only leave the sandbox to hosts an allow layer covers. An admin sets the allowed websites on each credential and the allowed domains. An admin sets the environment's network access level, which defaults to Trusted access, from the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings). See [Set allowed websites](https://claude.com/docs/claude-tag/admins/add-connections.md#set-allowed-websites) and [Allow a host without a credential](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential).
54Because requests to any other host are blocked, data leaves the sandbox only to hosts an allow layer covers and to GitHub through the GitHub proxy. An admin sets the allowed websites on each credential and the allowed domains. An admin sets the environment's network access level, which defaults to Trusted access, from the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings). See [Set allowed websites](https://claude.com/docs/claude-tag/admins/add-connections.md#set-allowed-websites) and [Allow a host without a credential](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential).
5555
5656Allow-all egress is a `*` domain. The entry admits requests to any host on the ports it lists, still without credentials. Private and internal network addresses and cloud metadata endpoints remain blocked. See [Allow all hosts](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-all-hosts).
57
58In an Anthropic-hosted environment, a channel session's GitHub API requests and git operations go through a dedicated GitHub proxy, which keeps the GitHub credential outside the sandbox. A credential's allowed websites, an allowed domain, and the environment's network access setting don't govern them. Instead, GitHub API requests, source archive downloads, and anything in a private repository are limited to the repositories an admin granted to the channel. The GitHub proxy refuses them for a repository the session doesn't have. Git may still be able to clone public repositories that an admin didn't grant, with no credential. See [How granted repositories reach a session](https://claude.com/docs/claude-tag/admins/configure-github.md#how-granted-repositories-reach-a-session) for how a granted repository becomes one Claude can use, and [GitHub proxy](https://code.claude.com/docs/en/cloud-environments#github-proxy) in the Claude Code docs for the push and GraphQL restrictions it also applies.
5759
5860### Service accounts
5961
claude-tag/admins/add-connections Changed · +2 / -2 lines
from line 204
204204
205205To narrow a credential before any channel can use it, add the connector to a new [bundle](#create-a-bundle), select **Edit** from the menu on its row under **What's in it**, and add the bundle's places last.
206206
207Agent Proxy starts applying an edit to a credential or a domain entry within about a minute after you save it, in existing threads as well as new ones. It checks the channel's credentials and domain entries first, then the workspace's, then the organization's, and within each by priority. A request that matches no credential, no domain entry, and nothing in the environment's network access is blocked. Private IP ranges and cloud metadata endpoints stay blocked regardless.
207Agent Proxy starts applying an edit to a credential or a domain entry within about a minute after you save it, in existing threads as well as new ones. It checks the channel's credentials and domain entries first, then the workspace's, then the organization's, and within each by priority. A request that matches no credential, no domain entry, and nothing in the environment's network access is blocked, apart from [GitHub API requests and git operations](https://claude.com/docs/claude-tag/concepts/security-and-data.md#network-egress), which a separate GitHub proxy handles. Private IP ranges and cloud metadata endpoints stay blocked regardless.
208208
209209## Create a bundle
210210
from line 264
264264* **A [connector](#add-a-connector)**: a credential that applies to the channel. Requests matching its [allowed websites](#set-allowed-websites) pass with that credential attached.
265265* **The channel's [environment](https://claude.com/docs/claude-tag/concepts/glossary.md#environment)**: the compute configuration the channel's sessions run in, which carries its own network access setting, starting at the Trusted access level that covers common package registries. Requests to hosts it allows pass with no credential; see [Broad web access through the environment](#broad-web-access-through-the-environment).
266266
267A host that none of these allows stays unreachable, and when more than one bundle applies to a channel, the entries of all of them apply. Web search is governed by none of them, because searching happens on Anthropic's servers rather than in the sandbox; see [Web search vs. network requests](#web-search-vs-network-requests).
267A host that none of these allows stays unreachable, and when more than one bundle applies to a channel, the entries of all of them apply. Web search is governed by none of them, because searching happens on Anthropic's servers rather than in the sandbox; see [Web search vs. network requests](#web-search-vs-network-requests). Claude's GitHub API requests and git operations are governed by none of them either, because they go through a separate GitHub proxy. That proxy limits them to the repositories you [granted to the channel](https://claude.com/docs/claude-tag/admins/configure-github.md#grant-repository-access), except that git may still be able to clone public repositories you didn't grant.
268268
269269### Add a domain
270270
claude-tag/admins/network-requirements Changed · +1 / -1 lines
from line 18
1818
1919The authoritative list is [Anthropic's published IP addresses](https://platform.claude.com/docs/en/api/ip-addresses); check it when you create the rule.
2020
21The range is shared across Anthropic services, and dedicated per-organization egress addresses aren't available, so the allowlist entry admits Anthropic's infrastructure as a whole. Your credential's [allowed websites](https://claude.com/docs/claude-tag/admins/add-connections.md#set-allowed-websites) are what scope which of *your* systems Claude can call.
21The range is shared across Anthropic services, and dedicated per-organization egress addresses aren't available, so the allowlist entry admits Anthropic's infrastructure as a whole. Your credential's [allowed websites](https://claude.com/docs/claude-tag/admins/add-connections.md#set-allowed-websites) are what scope which of *your* systems Claude can call. For GitHub, the repositories you granted to the channel do that scoping instead, except that git may still be able to clone public repositories you didn't grant; see [Network egress](https://claude.com/docs/claude-tag/concepts/security-and-data.md#network-egress).
2222
2323> [!NOTE]
2424>