Security and data handling changedclaude-tag/concepts/security-and-data
Nearest release: v2.1.290, published under an hour before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 5 Oct 2026 18:54 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 5 Oct 2026 19:07 UTC.
Upstream edited
Recorded here
Lines+35added
Lines−26removed
From line
6
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits27to this page, all time
The whole hunk
from line 6, old and new numbered
/
from line 6
66
77<BetaNote />
88
9In channels, Claude acts under its own service accounts that an Owner provisions. By default it can read and post in Slack channels it's been added to and search public channels by keyword; it has no access to your external systems until an Owner or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access#delegate-claude-tag-administration) adds connections. Each connection is scoped to specific channels and workspaces, and the actions Claude takes in connected tools are attributable to its own service accounts.
9In channels, Claude acts under its own service accounts. By default it can read and post in Slack channels it's been added to and search public channels by keyword; it has no access to your external systems until an Owner or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access#delegate-claude-tag-administration) adds Claude Tag connectors. An admin chooses where each connector applies, from every channel down to one, and the actions Claude takes in connected tools are attributable to its own service accounts.
1010
11Every channel request, whether a person typed it or a schedule triggered it, follows the same path: it runs in an isolated sandbox, and the credentials you provision aren't placed in that sandbox. In an Anthropic-hosted environment, requests leave that sandbox only through Agent Proxy and reach your systems under the agent's own accounts. Sessions in a [self-hosted environment](https://code.claude.com/docs/en/self-hosted-environments) run on runners inside your network, and Claude can't use Access bundles in those sessions yet.
11Every channel request, whether a person typed it or a schedule triggered it, follows the same path: it runs in an isolated sandbox, and the credentials you provision aren't placed in that sandbox. In an Anthropic-hosted environment, requests leave that sandbox only through Agent Proxy and reach your systems under the agent's own accounts. Sessions in a [self-hosted environment](https://code.claude.com/docs/en/self-hosted-environments) run on runners inside your network, and Claude can't use the connectors an admin adds in those sessions.
1212
1313One-to-one DMs from members who have connected a Claude account run on the member's own claude.ai account instead and are covered separately on [How agent identity works](/docs/claude-tag/concepts/agent-identity#direct-message-channels). For DMs from members who haven't, see [Direct messages from members without a Claude account](/docs/claude-tag/admins/restrict-access#access-in-a-direct-message-from-a-member-without-a-claude-account).
1414
from line 23
2323| Checkpoint | The guarantee |
2424| :- | :- |
2525| The sandbox | Holds none of the credentials you provision |
26| Agent Proxy | Injects credentials from the credential store at request time, and blocks a request that no [connection](/docs/claude-tag/admins/add-connections#set-allowed-websites), [**Domains** entry](/docs/claude-tag/admins/add-connections#allow-a-host-without-a-credential), or [environment network access level](/docs/claude-tag/admins/add-connections#broad-web-access-through-the-environment) allows |
26| Agent Proxy | Injects credentials from the credential store at request time, and blocks a request that no [credential's allowed websites](/docs/claude-tag/admins/add-connections#set-allowed-websites), [allowed domain](/docs/claude-tag/admins/add-connections#allow-a-host-without-a-credential), or [environment network access level](/docs/claude-tag/admins/add-connections#broad-web-access-through-the-environment) allows |
2727| Your systems | See the agent's own accounts, so its actions there are attributable |
2828
2929### Compute and the sandbox
from line 44
4444This means:
4545
4646* **A saved credential is not displayed again.** The setup screens are write-only.
47* **The credential travels only to the hosts you named** when you added the connection.
48* **You can narrow the credential further**, to one host, one path prefix, or read-only methods, in [Add connections](/docs/claude-tag/admins/add-connections).
47* **The credential travels only to the hosts you named** when you added it.
48* **You can narrow the credential further**, to one host, one path prefix, or read-only methods; see [Restrict by path or method](/docs/claude-tag/admins/add-connections#restrict-by-path-or-method).
4949
5050### Network egress
5151
52In an Anthropic-hosted environment, outbound traffic from a channel session's sandbox is default-deny. Requests go only to hosts an allow layer covers, and the layers are a [connection's Allowed websites](/docs/claude-tag/admins/connections/custom#fill-out-the-custom-tool-form), the [bundle's Domains tab](/docs/claude-tag/admins/add-connections#allow-a-host-without-a-credential), and the network access setting of the [environment](/docs/claude-tag/concepts/glossary#environment) the scope's sessions run on. A new environment's default level, Trusted access, already covers a [documented set of package registries and developer hosts](https://code.claude.com/docs/en/cloud-environments#default-allowed-domains). See [Agent Proxy](/docs/claude-tag/concepts/agent-identity#agent-proxy) for what happens to a request under each layer.
52In an Anthropic-hosted environment, outbound traffic from a channel session's sandbox is default-deny. Requests go only to hosts an allow layer covers, and the layers are a [credential's allowed websites](/docs/claude-tag/admins/connections/custom#fill-out-the-custom-tool-form), the [allowed domains](/docs/claude-tag/admins/add-connections#allow-a-host-without-a-credential) that apply to the channel, and the network access setting of the [environment](/docs/claude-tag/concepts/glossary#environment) the scope's sessions run on. A new environment's default level, Trusted access, already covers a [documented set of package registries and developer hosts](https://code.claude.com/docs/en/cloud-environments#default-allowed-domains). See [Agent Proxy](/docs/claude-tag/concepts/agent-identity#agent-proxy) for what happens to a request under each layer.
5353
54<img className="block dark:hidden" src="https://mintcdn.com/claude-ai/lijct3C2aoA3LHFn/images/claude-tag/diagrams/proxy-decision.svg?fit=max&auto=format&n=lijct3C2aoA3LHFn&q=85&s=31de5c6d6a10b635374d9fa4861a111f" alt="Flow diagram across two zones, labeled Anthropic's infrastructure and your systems. In the first zone, a session sandbox that holds no stored credentials sends every outbound request to Agent Proxy, which matches it against admin rules. Three outcomes branch toward your systems: on a rule match, the credential is attached at the boundary and the request proceeds; on an allowlist-only match, from the bundle's Domains list or the environment's network access setting, the request is sent without credentials; on no match, the request is blocked entirely (the default-deny outcome) and the host is unreachable." width="1000" height="400" data-path="images/claude-tag/diagrams/proxy-decision.svg" />
54<img className="block dark:hidden" src="https://mintcdn.com/claude-ai/f29MqpCRlPctgTn5/images/claude-tag/diagrams/proxy-decision.svg?fit=max&auto=format&n=f29MqpCRlPctgTn5&q=85&s=f87bc9ca2d2de09e4feda0a60695e9bd" alt="Flow diagram across two zones, labeled Anthropic's infrastructure and your systems. In the first zone, a session sandbox that holds no stored credentials sends every outbound request to Agent Proxy, which matches it against admin rules. Three outcomes branch toward your systems: on a rule match, the credential is attached at the boundary and the request proceeds; on an allowlist-only match, from an allowed domain or the environment's network access setting, the request is sent without credentials; on no match, the request is blocked entirely (the default-deny outcome) and the host is unreachable." width="1000" height="400" data-path="images/claude-tag/diagrams/proxy-decision.svg" />
5555
56<img className="hidden dark:block" src="https://mintcdn.com/claude-ai/lijct3C2aoA3LHFn/images/claude-tag/diagrams/proxy-decision-dark.svg?fit=max&auto=format&n=lijct3C2aoA3LHFn&q=85&s=b67da069feb4070186d4eca67eb40878" alt="Flow diagram across two zones, labeled Anthropic's infrastructure and your systems. In the first zone, a session sandbox that holds no stored credentials sends every outbound request to Agent Proxy, which matches it against admin rules. Three outcomes branch toward your systems: on a rule match, the credential is attached at the boundary and the request proceeds; on an allowlist-only match, from the bundle's Domains list or the environment's network access setting, the request is sent without credentials; on no match, the request is blocked entirely (the default-deny outcome) and the host is unreachable." width="1000" height="400" data-path="images/claude-tag/diagrams/proxy-decision-dark.svg" />
56<img className="hidden dark:block" src="https://mintcdn.com/claude-ai/f29MqpCRlPctgTn5/images/claude-tag/diagrams/proxy-decision-dark.svg?fit=max&auto=format&n=f29MqpCRlPctgTn5&q=85&s=ccbd8f7c4ba256a77cf85358880179b7" alt="Flow diagram across two zones, labeled Anthropic's infrastructure and your systems. In the first zone, a session sandbox that holds no stored credentials sends every outbound request to Agent Proxy, which matches it against admin rules. Three outcomes branch toward your systems: on a rule match, the credential is attached at the boundary and the request proceeds; on an allowlist-only match, from an allowed domain or the environment's network access setting, the request is sent without credentials; on no match, the request is blocked entirely (the default-deny outcome) and the host is unreachable." width="1000" height="400" data-path="images/claude-tag/diagrams/proxy-decision-dark.svg" />
5757
58Because requests to any other host are blocked, data can only leave the sandbox to hosts an allow layer covers. An admin sets the Allowed websites list on each connection and the Domains tab on each bundle. An admin sets the environment's network access level, which defaults to Trusted access, from the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings). See [Set allowed websites](/docs/claude-tag/admins/add-connections#set-allowed-websites) and [Allow a host without a credential](/docs/claude-tag/admins/add-connections#allow-a-host-without-a-credential).
58Because requests to any other host are blocked, data can only leave the sandbox to hosts an allow layer covers. An admin sets the allowed websites on each credential and the allowed domains. An admin sets the environment's network access level, which defaults to Trusted access, from the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings). See [Set allowed websites](/docs/claude-tag/admins/add-connections#set-allowed-websites) and [Allow a host without a credential](/docs/claude-tag/admins/add-connections#allow-a-host-without-a-credential).
5959
60Allow-all egress is a `*` entry on a bundle's Domains tab. The entry admits requests to any host on the ports it lists, still without credentials. Private and internal network addresses and cloud metadata endpoints remain blocked. See [Allow all hosts](/docs/claude-tag/admins/add-connections#allow-all-hosts).
60Allow-all egress is a `*` domain. The entry admits requests to any host on the ports it lists, still without credentials. Private and internal network addresses and cloud metadata endpoints remain blocked. See [Allow all hosts](/docs/claude-tag/admins/add-connections#allow-all-hosts).
6161
6262### Service accounts
6363
64In channels, Claude acts under service credentials of its own, not under the account of the person who tagged it. The Slack surface is the Claude app, code work goes through the Claude GitHub App, and every other connected tool uses a service account an Owner provisions in an Access bundle. See [How agent identity works](/docs/claude-tag/concepts/agent-identity) for the full model.
64In channels, Claude acts under service credentials of its own, not under the account of the person who tagged it. The Slack surface is the Claude app, code work goes through the Claude GitHub App, and every other connected tool uses a service account whose credential a [connector](/docs/claude-tag/concepts/glossary#connection) holds. See [How agent identity works](/docs/claude-tag/concepts/agent-identity) for the full model.
6565
66A connection belongs to that agent identity and is shared by everyone the bundle's scope covers. Anyone in a channel under that scope can ask Claude to act with the credential, so whatever the connected account can read or write is available to every member of those channels. Connect a dedicated identity you control for each service, such as a `[email protected]` seat or a native service account, rather than a personal login. A dedicated account keeps the agent's actions separately auditable in each tool's logs and lets you revoke its access without affecting a person; see [Create a dedicated account per service](/docs/claude-tag/admins/add-connections#create-a-dedicated-account-per-service).
66A connector's credential belongs to that agent identity and is shared by everyone in the channels where it applies. Anyone in one of those channels can ask Claude to act with the credential, so whatever the connected account can read or write is available to every member of those channels. Connect a dedicated identity you control for each service, such as a `[email protected]` seat or a native service account, rather than a personal login. A dedicated account keeps the agent's actions separately auditable in each tool's logs and lets you revoke its access without affecting a person; see [Create a dedicated account per service](/docs/claude-tag/admins/add-connections#create-a-dedicated-account-per-service).
6767
68One-to-one DMs with `@Claude` from a member who has connected a Claude account run on that member's own claude.ai account instead, with that member's personal connectors, and work there is attributed to them, except pull requests, which the Claude GitHub App authors from DMs as well. For DMs from members who haven't, see [Direct messages from members without a Claude account](/docs/claude-tag/admins/restrict-access#access-in-a-direct-message-from-a-member-without-a-claude-account). Owners can disable DMs organization-wide; see [Allow or disable direct messages](/docs/claude-tag/admins/restrict-access#allow-or-disable-direct-messages).
68One-to-one DMs with `@Claude` from a member who has connected a Claude account run on that member's own claude.ai account instead, with that member's personal connectors, and work there is attributed to them, except pull requests, which the Claude GitHub App authors from DMs as well. For DMs from members who haven't, see [Direct messages from members without a Claude account](/docs/claude-tag/admins/restrict-access#access-in-a-direct-message-from-a-member-without-a-claude-account). An Owner can turn off DMs for the whole organization; see [Allow or disable direct messages](/docs/claude-tag/admins/restrict-access#allow-or-disable-direct-messages).
6969
7070Claude uses a user's [personal connectors in a channel](/docs/claude-tag/concepts/personal-connectors) only for that user's own tasks, after the user allows it. The work runs with that user's permissions and is recorded under their name. Requests other people make to Claude in the task's thread run with the channel's own access, not with that user's connectors. Claude is designed to take direction from the connector's owner, treating what other people post in the thread as information for the task rather than as instructions, and the owner can tell Claude in the task's thread to stop. On the Enterprise plan, an admin can require [the user's review of every result](/docs/claude-tag/concepts/personal-connectors#admin-controls-for-personal-connectors) before it posts. See [Personal connectors in channels](/docs/claude-tag/concepts/personal-connectors).
7171
7272### Isolate credentials between channels
7373
74A channel session can use only the [Access bundles](/docs/claude-tag/admins/add-connections) attached in one of three places:
74A channel session can use only the access an admin applied in one of these places:
7575
76* **The channel itself.** A bundle you attach here applies in that channel only.
77* **The channel's workspace.** A bundle you attach here applies in every channel of that workspace.
78* **[Default Slack access](/docs/claude-tag/admins/attach-to-scope#how-scopes-inherit).** The organization-wide root; a bundle you attach here applies in every channel of every paired workspace.
76* **The channel itself.** Access added on the channel's page, or a bundle applied to the channel, reaches that channel only.
77* **The channel's workspace.** Access added on the workspace's page, or a bundle applied to the workspace, reaches every channel of that workspace.
78* **All of Slack.** Access added on the **Slack** page, or a bundle applied there, reaches every channel of every paired workspace. The first credential you add for a service on the **Connectors** tab is on here as soon as you save it. See [how scopes inherit](/docs/claude-tag/admins/attach-to-scope#how-scopes-inherit).
79* **A channel rule.** A bundle an Owner applies to a channel name pattern reaches every matching channel in all of Slack or in one workspace, including channels created or renamed later.
7980
80A bundle attached anywhere else in your organization is invisible to the session, and no request from the session's sandbox can carry a credential from a bundle outside those three scopes.
81Access applied anywhere else in your organization is invisible to the session, and no request from the session's sandbox can carry a credential that doesn't apply to its channel.
8182
82For example, if you attach a bundle holding finance credentials to one private channel, sessions in every other channel run as if that credential doesn't exist. If you attach the same bundle to a workspace or to Default Slack access instead, every channel beneath it gets that access, so isolation comes from where you attach the bundle, not from the bundle itself.
83For example, if a bundle holding finance credentials applies only to one private channel, sessions in every other channel run as if that credential doesn't exist. If the same bundle applies to a workspace or to all of Slack instead, every channel beneath it gets that access, so isolation comes from where the access applies, not from the bundle itself.
8384
84Confine a credential to one channel in three steps:
85To confine a credential to one channel:
8586
861. Attach its bundle to that channel and nowhere broader.
872. Keep the channel private. A bundle on a public channel [grants its access to anyone who joins](/docs/claude-tag/admins/attach-to-scope#attach-to-a-channel).
883. Check the channel's **Connectors**, **Repositories**, and **Plugins** sections on the [Slack tab in admin settings](/docs/claude-tag/admins/attach-to-scope). They list the access the channel gets, including rows inherited from the workspace or from Default Slack access, each with an origin line naming where it comes from.
871. Apply it to that channel and nowhere broader. The first credential you add for a service on the **Connectors** tab applies in all of Slack as soon as you save it. To keep the credential out of other channels from the start, add it in one of these ways instead:
88 * In a bundle whose **Where it applies** list holds only that channel.
89 * From the channel's page. Under **Claude's access**, click **Add** and select **Connector**. On the dialog's **Connectors** tab, select the service under **Connect new** and click **Continue**. The credential you enter in the connect form applies in that channel only.
90 * On the page of a connector already on the **Connectors** tab, select **Add credential** from the **⋮** menu at the top of the page. The new credential is off everywhere until you pick it in the channel's row under **Assign access**, selecting **Add place** if the channel isn't listed.
912. Keep the channel private. Access on a public channel [reaches anyone who joins](/docs/claude-tag/admins/attach-to-scope#attach-to-a-channel).
923. Open the channel from the **Channels** tab under **Claude's access** at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag) and check its **Claude's access** table. It lists the access that reaches the channel, and an item a bundle brings is listed under that bundle's row. The **Inheritance** column shows whether each bundle, and each item outside a bundle, was added on the channel's page or inherited from the workspace or from **Slack**.
8993
90Claude doesn't work in a channel shared with another company through [Slack Connect](/docs/claude-tag/admins/restrict-access#slack-connect-channels), so no access bundle's credentials reach one.
94Claude doesn't work in a channel shared with another company through [Slack Connect](/docs/claude-tag/admins/restrict-access#slack-connect-channels), so no connector's credentials reach one.
9195
92When you ask Claude in one channel to post into another, Claude works with the access bundles and instructions of the channel you asked in, not the target channel's. From a private channel, Claude doesn't post anywhere else, and nothing asked elsewhere makes Claude post into a private channel. [What Claude can do in other channels](/docs/claude-tag/concepts/how-it-works#what-claude-can-do-in-other-channels) covers where Claude can post from each place you ask.
96When you ask Claude in one channel to post into another, Claude works with the access and instructions of the channel you asked in, not the target channel's. From a private channel, Claude doesn't post anywhere else, and nothing asked elsewhere makes Claude post into a private channel. [What Claude can do in other channels](/docs/claude-tag/concepts/how-it-works#what-claude-can-do-in-other-channels) covers where Claude can post from each place you ask.
9397
9498Isolating a credential doesn't isolate what Claude knows. The [workspace notes](/docs/claude-tag/users/memory) it saves from a public channel are read by sessions in every channel of the workspace, and it can [search public channels by keyword](/docs/claude-tag/admins/restrict-access#controls-that-aren%E2%80%99t-available) without being added to them, the same way any workspace member can.
9599
from line 107
103107
104108## Member access
105109
106By default, anyone in a connected Slack workspace can invoke Claude in channels, with or without a Claude account. An Owner can turn on a restriction toggle to narrow that: on Team plans it limits Claude to people with a Claude account in your organization, and on Enterprise plans it limits Claude to members whose role grants the **Claude Tag in Slack** capability. See [Restrict who can use Claude](/docs/claude-tag/admins/restrict-access#restrict-who-can-use-claude). The toggle governs DMs as well as channels.
110By default, anyone in a connected Slack workspace can invoke Claude in channels, with or without a Claude account. An Owner can narrow that on the **Advanced** tab of the **Slack** page, which the **Slack** row on the **Channels** tab under **Claude's access** opens:
111
112* **Team plans**: **Restrict to your organization** limits Claude to people with a Claude account in your organization
113* **Enterprise plans**: **Restrict to roles with Claude Tag access** limits Claude to members whose role grants the **Claude Tag in Slack** capability
114
115See [Restrict who can use Claude](/docs/claude-tag/admins/restrict-access#restrict-who-can-use-claude). The restriction governs DMs as well as channels.
107116
108117## Related resources
109118
No line in this hunk matches that.