How agent identity works changedclaude-tag/concepts/agent-identity
Nearest release: v2.1.290, published under an hour before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 5 Oct 2026 18:54 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 5 Oct 2026 19:07 UTC.
Upstream edited
Recorded here
Lines+13added
Lines−11removed
From line
10
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits18to this page, all time
The whole hunk
from line 10, old and new numbered
/
from line 10
1010
1111In Slack channels, and in [group DMs](#group-dms) that include Claude, Claude acts with its own service accounts, rather than as a specific user. An organization Owner [provisions this identity](/docs/claude-tag/admins/setup-overview#give-claude-access-to-your-tools), so Claude has its own account in each system it works in: the Claude app in Slack, the Claude GitHub App on GitHub, and a service account in every other connected tool. Actions it takes are attributed to those accounts; for example, posts come from the Claude app and pull requests show the Claude GitHub App as the author. Claude can also use your own claude.ai connectors for a task you hand it in a channel, after you allow it. See [Personal connectors in a channel](#personal-connectors-in-a-channel).
1212
13In one-to-one direct messages (DMs) between `@Claude` and a user who has connected a Claude account, the provisioned identity does not apply. A DM session runs on [the individual's own claude.ai account](#direct-message-channels) instead, with their personal connectors. A pull request opened from a DM is authored by the Claude GitHub App, the same as in channels, though the session can only work with repositories connected on that user's own account. Owners can disable DMs organization-wide; see [Allow or disable direct messages](/docs/claude-tag/admins/restrict-access#allow-or-disable-direct-messages). For DMs from users who haven't connected a Claude account, see [Direct messages from members without a Claude account](/docs/claude-tag/admins/restrict-access#direct-messages-from-members-without-a-claude-account).
13In one-to-one direct messages (DMs) between `@Claude` and a user who has connected a Claude account, the provisioned identity does not apply. A DM session runs on [the individual's own claude.ai account](#direct-message-channels) instead, with their personal connectors. A pull request opened from a DM is authored by the Claude GitHub App, the same as in channels, though the session can only work with repositories connected on that user's own account. An Owner can turn off DMs for the whole organization; see [Allow or disable direct messages](/docs/claude-tag/admins/restrict-access#allow-or-disable-direct-messages). For DMs from users who haven't connected a Claude account, see [Direct messages from members without a Claude account](/docs/claude-tag/admins/restrict-access#direct-messages-from-members-without-a-claude-account).
1414
1515<Note>
1616 How Claude behaves in channels (its standing instructions, plugins, and channel memory) is configured separately from its identity; see [custom instructions](/docs/claude-tag/admins/attach-to-scope#add-custom-instructions), [plugins](/docs/claude-tag/admins/add-connections#attach-plugins), and [memory](/docs/claude-tag/users/memory) for more information.
from line 22
2222
2323* The ask happens in your Slack workspace, when a user tags Claude to do something or a scheduled task starts.
2424* The work Claude does runs in a sandbox, an isolated working environment built for the thread.
25* The agent's credentials for any additional connections, such as GitHub or a data warehouse, reach those systems to pull the required information. An organization Owner sets up those credentials as part of [provisioning the identity](/docs/claude-tag/admins/setup-overview#create-accounts-for-claude%E2%80%99s-other-tools).
25* The agent's credentials for any additional Claude Tag connectors, such as GitHub or a data warehouse, reach those systems to pull the required information. An organization Owner sets up those credentials as part of [provisioning the identity](/docs/claude-tag/admins/setup-overview#create-accounts-for-claude%E2%80%99s-other-tools).
2626
2727The diagram below traces one request through this process.
2828
from line 44
4444 </Step>
4545
4646 <Step title="Agent Proxy attaches a credential">
47 A matching credential comes from the credential store, where an admin's [connections](/docs/claude-tag/admins/add-connections) are kept. Once saved, a credential is never displayed again; Agent Proxy retrieves it only at the moment of injection and attaches it to the request at the boundary, so the model and the sandbox itself are not given the key.
47 A matching credential comes from the credential store, which keeps the credentials of the [connectors](/docs/claude-tag/admins/add-connections) an admin added. Once saved, a credential is never displayed again; Agent Proxy retrieves it only at the moment of injection and attaches it to the request at the boundary, so the model and the sandbox itself are not given the key.
4848 </Step>
4949
5050 <Step title="The result posts back, as Claude">
from line 58
5858
5959| When the destination | Result |
6060| :- | :- |
61| Matches a connection's rule, its [allowed websites](/docs/claude-tag/admins/add-connections#set-allowed-websites) | The proxy attaches that connection's credential and forwards the request. The credential stays at the proxy; the model and sandbox are not given it. |
62| Is on the [bundle](/docs/claude-tag/concepts/glossary#access-bundle)'s [Domains list](/docs/claude-tag/admins/add-connections#allow-a-host-without-a-credential) but matches no connection | The proxy forwards the request without a credential. |
61| Matches a credential's rule, its [allowed websites](/docs/claude-tag/admins/add-connections#set-allowed-websites) | The proxy attaches that credential and forwards the request. The credential stays at the proxy; the model and sandbox are not given it. |
62| Is an [allowed domain](/docs/claude-tag/admins/add-connections#allow-a-host-without-a-credential) that applies to the channel, but matches no credential | The proxy forwards the request without a credential. |
6363| Is allowed by the network access setting of the [environment](/docs/claude-tag/concepts/glossary#environment) the [scope](/docs/claude-tag/concepts/glossary#scope)'s sessions run on | The proxy forwards the request without a credential. |
6464| Matches none of these | The proxy blocks the request. |
6565
from line 75
7575
7676A host that none of the three layers above allows is blocked, and Claude names the blocked host in the thread so an admin can add it; see [Give Claude access to your tools](/docs/claude-tag/admins/add-connections).
7777
78<a id="web-search-vs-network-requests" />
79
7880### Web search vs. network requests
7981
8082Claude can search the web from a channel without any Domains entry. Web search is [Anthropic's built-in web search tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-search-tool), which runs on Anthropic's servers, not code running in the channel's sandbox.
from line 89
8789
8890### Agent access
8991
90What Claude can reach in a channel comes from the [Access bundles](/docs/claude-tag/admins/add-connections) an admin attached to that channel's scope. Anyone in the channel gets the same capability, and the same request can do more in `#platform-eng` than in a general channel.
92What Claude can reach in a channel comes from the [connectors, repositories, and plugins](/docs/claude-tag/admins/add-connections) an admin applies to that channel, to its workspace, or to all of Slack, either directly or through a bundle. Anyone in the channel gets the same capability, and the same request can do more in `#platform-eng` than in a general channel.
9193
9294This design has four consequences.
9395
9496* **Configure once.** Everyone in the scope can use it immediately.
9597* **Predictability.** What Claude can do never changes based on who asked.
96* **Personal connectors are separate.** A shared channel session uses only the service-account connections an admin attached. Claude [uses the connectors on your own claude.ai account](#personal-connectors-in-a-channel) only for your own tasks, after you allow it.
98* **Personal connectors are separate.** A shared channel session uses only the Claude Tag connectors an admin applied, which hold service-account credentials. Claude [uses the connectors on your own claude.ai account](#personal-connectors-in-a-channel) only for your own tasks, after you allow it.
9799* **Clean audit.** Actions the channel session takes in connected tools show up under a service account your security team already knows how to reason about.
98100
99101That service-account identity is also how Claude appears wherever it acts. In Slack, it posts as the Claude app. On GitHub, commits and pull requests show the Claude GitHub App, and pull requests link back to the Slack thread they came from. In every other connected service, actions appear under the service account an admin provisioned, in that service's audit log.
from line 102
100102
101103### Personal connectors in a channel
102104
103A channel session works with the channel's Access bundles, so the [connectors on your own claude.ai account](/docs/connectors/getting-started) are not part of it. When a task you hand Claude needs something only your connectors can reach, Claude can use your connector for that part of the work, and it asks you before it starts. The work runs with your permissions and is recorded under your name. Requests other people make to Claude in the task's thread run with the channel's own access, not with your connectors. Claude is designed to take direction from you, treating what other people post in the thread as information for the task rather than as instructions.
105A channel session works with the access an admin applied to the channel, so the [connectors on your own claude.ai account](/docs/connectors/getting-started) are not part of it. When a task you hand Claude needs something only your connectors can reach, Claude can use your connector for that part of the work, and it asks you before it starts. The work runs with your permissions and is recorded under your name. Requests other people make to Claude in the task's thread run with the channel's own access, not with your connectors. Claude is designed to take direction from you, treating what other people post in the thread as information for the task rather than as instructions.
104106
105107[Personal connectors in channels](/docs/claude-tag/concepts/personal-connectors) covers how you approve connector use, when Claude holds a result for your review before posting, what other people in the channel see, and how to stop a task.
106108
from line 119
117119| | In a channel | In a one-to-one DM |
118120| :- | :- | :- |
119121| Acts as | Its own service accounts | You |
120| Access | The channel's Access bundles | Your personal connectors |
122| Access | The access an admin applied to the channel | Your personal connectors |
121123| Attribution | The agent's accounts, in each tool's audit log | Your name, except pull requests, which the Claude GitHub App authors |
122124| Billing | The organization | Your seat |
123125
from line 127
125127
126128* **Connectors.** The [connectors on your account](/docs/connectors/getting-started) are available, including MCP servers you've added.
127129* **Billing.** Usage bills to your seat rather than the organization's service key.
128* **Channel-side configuration.** It doesn't follow you in; the agent's connections and repository grants don't apply in one-to-one DMs.
130* **Channel-side configuration.** It doesn't follow you in; the agent's connectors and repository grants don't apply in one-to-one DMs.
129131
130132DM work runs under your credentials, so most of it is attributed to you and can reach only what your own accounts can. Pull requests are the exception: Claude authors them as the Claude GitHub App from DMs too, so a repository's history shows the same author either way, while the repositories it can reach are still only the ones connected on your own account.
131133
from line 141
139141| :- | :- | :- |
140142| **Runs under** | The agent identity an admin provisioned | Your own Claude account, linked in the Claude app |
141143| **GitHub** | The Claude GitHub App; pull requests belong to the app | Your GitHub connection on claude.ai/code; pull requests open under your account |
142| **Access** | The Access bundles an admin attached to the channel | Your personal connectors |
144| **Access** | The access an admin applied to the channel | Your personal connectors |
143145| **Billing** | The organization | Your seat |
144146
145147If `@Claude` in your workspace opens pull requests as you, you're seeing Claude Code in Slack, not a Claude Tag session.
No line in this hunk matches that.