Restrict where Claude Tag operates

 # Restrict where Claude Tag operates
 
-> Claude Tag responds only where it has been added and addressed. See who can invoke it, guest and externally shared channel limits, the per-scope version setting, how to limit it to chosen channels, and how to quiet or remove it.
+> Claude Tag responds only where it has been added and addressed. See who can invoke it, guest and externally shared channel limits, the per-scope version setting, how to limit it to chosen channels, how to delegate a channel's setup, and how to quiet or remove it.
 
 export const BetaNote = () => <Info>Claude Tag is in public beta. Features and behavior described here may change before general availability.</Info>;
 

 
 Work that would exceed a limit is declined rather than silently truncated. A user blocked by a limit can request more usage from their admin in Slack, and the admin notification names whether the usage balance or the limit caused the block.
 
+## Delegate channel setup to channel managers
+
+A channel manager is a member of your Claude organization who can set up Claude in specific channels without the Owner role. Channel managers are available on the Enterprise plan, and you must be an Owner to add or remove them.
+
+You name channel managers one channel at a time. For that channel, a channel manager adds repositories and credentials, sets the default model, and edits channel instructions. Every other setting at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag) stays with Owners and Admins.
+
+### What a channel manager can do on the Configure page
+
+A channel manager has to be a member of the channel in Slack. In a channel you assigned to them, they see a **Channel manager settings** section on the channel's [Configure page](/docs/claude-tag/users/good-habits#configure-claude-for-a-channel), reached from the **Configure** link in any Claude reply. Other members see the same values read-only.
+
+| Setting            | What a channel manager can do                                                                                                                                                                                                                                   |
+| :----------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **Default model**  | Choose the model new threads in the channel start on, from the models your organization allows. **Inherit** keeps the workspace or organization default                                                                                                         |
+| **Repositories**   | Add repositories beyond the ones your bundles already grant the channel. They can add only repositories their own GitHub account can write to                                                                                                                   |
+| **Access bundles** | Add, rotate, test, and remove credentials in the bundle Claude created for the channel and in any bundle they created for it. If the channel has no bundle yet, they can create one. They can't edit a bundle you created or a bundle that other channels share |
+
+When a channel manager adds a credential, Claude also allows the host that credential uses. Channel managers can't change the bundle's domains or rules in any other way. Credentials that use Claude's own identity (mutual TLS, AWS or GCP service identity, and IAP) stay Owner-only: a channel manager can't add, change, or rotate one, but can delete one from the channel's bundle, including one an Owner added. If that happens, Claude loses access to that service until an Owner adds the credential back.
+
+If you detach the channel's own bundle from the channel, its channel managers can't save settings for the channel; they see an error saying the channel's configuration was suspended by an administrator. They don't get a new bundle. Attach the bundle again to restore their access.
+
+A channel manager can edit channel instructions even when the scope's [Channel member edits](/docs/claude-tag/admins/attach-to-scope#restrict-who-can-set-channel-instructions) setting is **Block**.
+
+Channel managers see their assigned channels at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag); organization and workspace settings are read-only for them. Tell them when you add them.
+
+### Add a channel manager
+
+Channel managers are built on [custom roles](https://claude.ai/admin-settings/roles). When you add the first manager to a channel, you create a custom role for it, named **Channel managers** plus the channel's name and ID, with the **Claude Tag channel setup** permission. A custom role works only for members on the **Custom roles** access level, so the last step below checks each manager's level.
+
+<Steps>
+  <Step title="Open the channel's panel">
+    At [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), select the channel's row on the **Slack** tab under **Claude Tag's access**. The channel must be a public or private channel. If it isn't listed, [add Claude to the channel](/docs/claude-tag/users/getting-started#add-claude-to-a-channel) in Slack first.
+  </Step>
+
+  <Step title="Add people or a group">
+    In the **Channel managers** section, select **Add channel managers who can add connections and repos to this channel**. Select **Add users** to add people, which also creates a group named after the channel, or **Add groups** to add a group from [`claude.ai/admin-settings/groups`](https://claude.ai/admin-settings/groups). The same group can manage several channels.
+  </Step>
+
+  <Step title="Check each manager's access level">
+    When you add a member on the User or Claude Code user level, you move them to the **Custom roles** level in the same step; if they already hold other custom roles, you confirm the move first. For a member on any other level, you see **Not in effect** until you change their level on the Members page. Adding a group changes nobody's level; group members who aren't on the **Custom roles** level show **Not in effect** too.
+
+    If your identity provider manages access levels, you can't change a level on the Members page, and the move doesn't happen. Put the channel managers in an identity provider group and map that group to the **Custom roles** level instead. If you turn on identity provider management after adding channel managers, the next sync sets every member's level from your group mappings, so managers you moved by hand show **Not in effect** until a mapped group covers them. The role and its group are kept; you don't need to add the managers again.
+  </Step>
+</Steps>
+
+Owners and Admins can already configure every channel, so you see them as **Already has full access** and can't add them.
+
+Leave the role as it was created: assigned to its channel, with **Claude Tag channel setup** as its only permission. If the role's permissions are changed on the Roles page, the channel's **Channel managers** section stops recognizing the role, shows no managers, and refuses to add or remove any, with an error that points you to the Roles page. To recover, set the role's permissions back to exactly **Claude Tag channel setup**; the group and its members are kept. To give channel managers any other permission, create a separate role for it.
+
+### Remove a channel manager
+
+To remove a channel manager, open the same **Channel managers** section on the channel's panel. Remove a member you added directly, or detach a group you added. The member keeps their access level and any other custom roles. In the channel, they go back to seeing the Configure page's values read-only, like any other member.
+
+### Verify a channel manager's access
+
+The **Channel managers** section on the channel's panel shows each manager's status. A member whose access level doesn't support the role appears as **Not in effect**; the role works only on the **Custom roles** access level, so change the member's level on the Members page to put it into effect. An active manager sees the **Channel manager settings** section on the channel's [Configure page](/docs/claude-tag/users/good-habits#configure-claude-for-a-channel), so asking them to open that page confirms the setup.
+
+### Audit channel manager activity
+
+Channel manager activity is recorded in your organization's audit log, which you read through the [Compliance API](https://platform.claude.com/docs/en/api/compliance). The log records:
+
+* **Role channel assignments.** When a channel is assigned to a channel manager role or removed from it, with the role and the number of channels before and after.
+* **Credential changes.** Each credential a channel manager creates, updates, rotates, or deletes, with the Slack workspace and channel it was for and the roles that granted the permission, so you can tell a channel manager's change from an Owner's. Secrets are never included.
+* **Configure page changes.** Which settings a channel manager saved from the Configure page, such as the default model, repositories, or channel instructions. The log records which fields changed, not the values entered.
+
+The [Audit page](/docs/claude-tag/admins/audit) at [`claude.ai/admin-settings/claude-tag/audit`](https://claude.ai/admin-settings/claude-tag/audit) doesn't list these events; it covers scheduled work, memory, and network events.
+
 ## Permissions by role
 
-Creating bundles, binding them to scopes, and pairing workspaces need an Owner; an Admin can edit a bundle's Credentials and Domains tabs but not its other tabs. Everything else happens inside the channel and is open to its members. The table lists each action and who can take it.
+Creating bundles, binding them to scopes, and pairing workspaces need an Owner; an Admin can edit a bundle's Credentials and Domains tabs but not its other tabs. A [channel manager](#delegate-channel-setup-to-channel-managers) configures only the channels assigned to them. Everything else happens inside the channel and is open to its members. The table lists each action and who can take it.
 
-| Action                                                     | Owner               | Admin               | Channel member                                                                                                                                 |
-| :--------------------------------------------------------- | :------------------ | :------------------ | :--------------------------------------------------------------------------------------------------------------------------------------------- |
-| Pair a workspace                                           | Yes                 | No                  | No                                                                                                                                             |
-| Create, rename, delete, or bind an Access bundle           | Yes                 | No (view only)      | No                                                                                                                                             |
-| Edit a bundle's Repositories, Plugins, or Instructions tab | Yes                 | No (view only)      | No                                                                                                                                             |
-| Edit a bundle's Credentials or Domains tab                 | Yes                 | Yes                 | No                                                                                                                                             |
-| Write channel memory                                       | Yes, in the channel | Yes, in the channel | Yes                                                                                                                                            |
-| Set channel instructions from the Configure link           | Yes                 | Yes                 | Yes, unless the scope's [Channel member edits](/docs/claude-tag/admins/attach-to-scope#restrict-who-can-set-channel-instructions) setting blocks it |
-| Create, list, or disable a scheduled job in the channel    | Yes, in the channel | Yes, in the channel | Yes                                                                                                                                            |
-| Remove Claude from a channel                               | Yes                 | Yes                 | Yes, with `/remove`, unless your Slack admin restricts it                                                                                      |
+| Action                                                                | Owner               | Admin               | Channel manager                                                   | Channel member                                                                                                                                 |
+| :-------------------------------------------------------------------- | :------------------ | :------------------ | :---------------------------------------------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------- |
+| Pair a workspace                                                      | Yes                 | No                  | No                                                                | No                                                                                                                                             |
+| Create, rename, delete, or bind an Access bundle                      | Yes                 | No (view only)      | Only to create a bundle for an assigned channel                   | No                                                                                                                                             |
+| Edit a bundle's Repositories, Plugins, or Instructions tab            | Yes                 | No (view only)      | No                                                                | No                                                                                                                                             |
+| Edit a bundle's Credentials or Domains tab                            | Yes                 | Yes                 | Credentials tab only, in a bundle created for an assigned channel | No                                                                                                                                             |
+| Add a channel manager                                                 | Yes                 | No                  | No                                                                | No                                                                                                                                             |
+| Set a channel's default model or repositories from the Configure page | Yes                 | Yes                 | Yes, in assigned channels                                         | No                                                                                                                                             |
+| Write channel memory                                                  | Yes, in the channel | Yes, in the channel | Yes, in the channel                                               | Yes                                                                                                                                            |
+| Set channel instructions from the Configure link                      | Yes                 | Yes                 | Yes, in assigned channels                                         | Yes, unless the scope's [Channel member edits](/docs/claude-tag/admins/attach-to-scope#restrict-who-can-set-channel-instructions) setting blocks it |
+| Create, list, or disable a scheduled job in the channel               | Yes, in the channel | Yes, in the channel | Yes, in the channel                                               | Yes                                                                                                                                            |
+| Remove Claude from a channel                                          | Yes                 | Yes                 | Yes, with `/remove`, unless your Slack admin restricts it         | Yes, with `/remove`, unless your Slack admin restricts it                                                                                      |
 
 Scheduled jobs run with the channel's credentials, so a member creating one can't reach anything the channel itself can't.