How agent identity works changedclaude-tag/concepts/agent-identity
Nearest release: v2.1.290, published an hour before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 5 Oct 2026 19:41 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 22 Oct 2026 18:07 UTC.
Upstream edited
Recorded here
Lines+17added
Lines−17removed
From line
10
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits19to this page, all time
The whole hunk
from line 10, old and new numbered
/
from line 10
1010
1111In Slack channels, and in [group DMs](#group-dms) that include Claude, Claude acts with its own service accounts, rather than as a specific user. An organization Owner [provisions this identity](/docs/claude-tag/admins/setup-overview#give-claude-access-to-your-tools), so Claude has its own account in each system it works in: the Claude app in Slack, the Claude GitHub App on GitHub, and a service account in every other connected tool. Actions it takes are attributed to those accounts; for example, posts come from the Claude app and pull requests show the Claude GitHub App as the author. Claude can also use your own claude.ai connectors for a task you hand it in a channel, after you allow it. See [Personal connectors in a channel](#personal-connectors-in-a-channel).
1212
13In one-to-one direct messages (DMs) between `@Claude` and a user who has connected a Claude account, the session runs on [the individual's own claude.ai account](#direct-message-channels), with their personal connectors. A pull request opened from a DM is authored by the Claude GitHub App, the same as in channels, though the session can only work with repositories connected on that user's own account. An Owner can turn off DMs for the whole organization; see [Allow or disable direct messages](/docs/claude-tag/admins/restrict-access#allow-or-disable-direct-messages). For DMs from users who haven't connected a Claude account, see [Direct messages from members without a Claude account](/docs/claude-tag/admins/restrict-access#direct-messages-from-members-without-a-claude-account).
13In one-to-one direct messages (DMs) between `@Claude` and a user who has connected a Claude account, the session runs on [the individual's own claude.ai account](#direct-message-channels), with their personal connectors. A pull request opened from a DM is authored by the Claude GitHub App, the same as in channels, though the session can only work with repositories connected on that user's own account. An Owner can turn off DMs for the whole organization; see [Allow or disable direct messages](/docs/claude-tag/admins/restrict-access.md#allow-or-disable-direct-messages). For DMs from users who haven't connected a Claude account, see [Direct messages from members without a Claude account](/docs/claude-tag/admins/restrict-access.md#direct-messages-from-members-without-a-claude-account).
1414
1515> [!NOTE]
1616>
17> How Claude behaves in channels (its standing instructions, plugins, and channel memory) is configured separately from its identity; see [custom instructions](/docs/claude-tag/admins/attach-to-scope#add-custom-instructions), [plugins](/docs/claude-tag/admins/add-connections#attach-plugins), and [memory](/docs/claude-tag/users/memory) for more information.
17> How Claude behaves in channels (its standing instructions, plugins, and channel memory) is configured separately from its identity; see [custom instructions](/docs/claude-tag/admins/attach-to-scope.md#add-custom-instructions), [plugins](/docs/claude-tag/admins/add-connections.md#attach-plugins), and [memory](/docs/claude-tag/users/memory.md) for more information.
1818
1919## Channel sessions
2020
from line 42
4242
4343**4. Agent Proxy attaches a credential**
4444
45A matching credential comes from the credential store, which keeps the credentials of the [connectors](/docs/claude-tag/admins/add-connections) an admin added. Once saved, a credential is never displayed again; Agent Proxy retrieves it only at the moment of injection and attaches it to the request at the boundary, so the model and the sandbox itself are not given the key.
45A matching credential comes from the credential store, which keeps the credentials of the [connectors](/docs/claude-tag/admins/add-connections.md) an admin added. Once saved, a credential is never displayed again; Agent Proxy retrieves it only at the moment of injection and attaches it to the request at the boundary, so the model and the sandbox itself are not given the key.
4646
4747**5. The result posts back, as Claude**
4848
from line 54
5454
5555| When the destination | Result |
5656| :- | :- |
57| Matches a credential's rule, its [allowed websites](/docs/claude-tag/admins/add-connections#set-allowed-websites) | The proxy attaches that credential and forwards the request. The credential stays at the proxy; the model and sandbox are not given it. |
58| Is an [allowed domain](/docs/claude-tag/admins/add-connections#allow-a-host-without-a-credential) that applies to the channel, but matches no credential | The proxy forwards the request without a credential. |
59| Is allowed by the network access setting of the [environment](/docs/claude-tag/concepts/glossary#environment) the [scope](/docs/claude-tag/concepts/glossary#scope)'s sessions run on | The proxy forwards the request without a credential. |
57| Matches a credential's rule, its [allowed websites](/docs/claude-tag/admins/add-connections.md#set-allowed-websites) | The proxy attaches that credential and forwards the request. The credential stays at the proxy; the model and sandbox are not given it. |
58| Is an [allowed domain](/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential) that applies to the channel, but matches no credential | The proxy forwards the request without a credential. |
59| Is allowed by the network access setting of the [environment](/docs/claude-tag/concepts/glossary.md#environment) the [scope](/docs/claude-tag/concepts/glossary.md#scope)'s sessions run on | The proxy forwards the request without a credential. |
6060| Matches none of these | The proxy blocks the request. |
6161
6262A new environment's network access level defaults to Trusted access, so a fresh setup can reach a documented set of package registries and developer hosts before an admin has configured anything. The [cloud environments documentation](https://code.claude.com/docs/en/cloud-environments#default-allowed-domains) lists the covered hosts. To narrow that default, pin an environment with a stricter level, such as No access.
from line 65
6565
6666Agent Proxy carries HTTP and HTTPS only. A protocol that isn't HTTP, such as SSH or a database's native wire protocol, can't cross the proxy even to an allowed host.
6767
68For the endpoints and addresses your network team may need to allowlist, see [Network requirements](/docs/claude-tag/admins/network-requirements).
68For the endpoints and addresses your network team may need to allowlist, see [Network requirements](/docs/claude-tag/admins/network-requirements.md).
6969
7070### How a host gets allowed
7171
72A host that none of the three layers above allows is blocked, and Claude names the blocked host in the thread so an admin can add it; see [Give Claude access to your tools](/docs/claude-tag/admins/add-connections).
72A host that none of the three layers above allows is blocked, and Claude names the blocked host in the thread so an admin can add it; see [Give Claude access to your tools](/docs/claude-tag/admins/add-connections.md).
7373
7474### Web search vs. network requests
7575
from line 79
7979
8080Searching and opening a page are different actions. A search returns content from the pages it matches, which Claude reads and cites, so it can answer from a page that search surfaced. Opening a URL, whether one you pasted or one a search returned, is a fetch from the sandbox, and the host needs an allow layer. That is why Claude can quote a page it found through search and still report that it can't open the same link.
8181
82The web search capability setting in your organization's claude.ai admin settings governs claude.ai chat; it doesn't govern Claude Tag sessions, in channels or DMs. If Claude reports that it can't reach a host from a channel, the fix is a [domain entry](/docs/claude-tag/admins/add-connections#add-a-domain) or the scope's [environment](/docs/claude-tag/concepts/glossary#environment), not that setting.
82The web search capability setting in your organization's claude.ai admin settings governs claude.ai chat; it doesn't govern Claude Tag sessions, in channels or DMs. If Claude reports that it can't reach a host from a channel, the fix is a [domain entry](/docs/claude-tag/admins/add-connections.md#add-a-domain) or the scope's [environment](/docs/claude-tag/concepts/glossary.md#environment), not that setting.
8383
8484### Agent access
8585
86What Claude can reach in a channel comes from the [connectors, repositories, and plugins](/docs/claude-tag/admins/add-connections) an admin applies to that channel, to its workspace, or to all of Slack, either directly or through a bundle. Anyone in the channel gets the same capability, and the same request can do more in `#platform-eng` than in a general channel.
86What Claude can reach in a channel comes from the [connectors, repositories, and plugins](/docs/claude-tag/admins/add-connections.md) an admin applies to that channel, to its workspace, or to all of Slack, either directly or through a bundle. Anyone in the channel gets the same capability, and the same request can do more in `#platform-eng` than in a general channel.
8787
8888This design has four consequences.
8989
from line 96
9696
9797### Personal connectors in a channel
9898
99A channel session works with the access an admin applied to the channel, so the [connectors on your own claude.ai account](/docs/connectors/getting-started) are not part of it. When a task you hand Claude needs something only your connectors can reach, Claude can use your connector for that part of the work, and it asks you before it starts. The work runs with your permissions and is recorded under your name. Requests other people make to Claude in the task's thread run with the channel's own access, not with your connectors. Claude is designed to take direction from you, treating what other people post in the thread as information for the task rather than as instructions.
99A channel session works with the access an admin applied to the channel, so the [connectors on your own claude.ai account](/docs/connectors/getting-started.md) are not part of it. When a task you hand Claude needs something only your connectors can reach, Claude can use your connector for that part of the work, and it asks you before it starts. The work runs with your permissions and is recorded under your name. Requests other people make to Claude in the task's thread run with the channel's own access, not with your connectors. Claude is designed to take direction from you, treating what other people post in the thread as information for the task rather than as instructions.
100100
101[Personal connectors in channels](/docs/claude-tag/concepts/personal-connectors) covers how you approve connector use, when Claude holds a result for your review before posting, what other people in the channel see, and how to stop a task.
101[Personal connectors in channels](/docs/claude-tag/concepts/personal-connectors.md) covers how you approve connector use, when Claude holds a result for your review before posting, what other people in the channel see, and how to stop a task.
102102
103103## Direct message channels
104104
from line 117
117117
118118Two of those differences are worth spelling out.
119119
120* **Connectors.** The [connectors on your account](/docs/connectors/getting-started) are available, including MCP servers you've added.
120* **Connectors.** The [connectors on your account](/docs/connectors/getting-started.md) are available, including MCP servers you've added.
121121* **Billing.** Usage bills to your seat rather than the organization's service key.
122122
123123DM work runs under your credentials, so most of it is attributed to you and can reach only what your own accounts can. Pull requests are the exception: Claude authors them as the Claude GitHub App from DMs too, so a repository's history shows the same author either way, while the repositories it can reach are still only the ones connected on your own account.
from line 141
141141
142142In a group DM that includes Claude, Claude acts with its own service accounts, using the connections an admin set for the workspace and the organization. The work bills to the organization. Claude can also use the connectors on your claude.ai account for a task you ask for, after you allow it, as described in [Personal connectors in a channel](#personal-connectors-in-a-channel).
143143
144[Use Claude Tag in a group DM](/docs/claude-tag/users/group-dms) covers how to add Claude and what differs from a channel. If you're an admin, [Group DMs](/docs/claude-tag/admins/restrict-access#group-dms) covers how who is in a group DM can change whether Claude answers, and the settings that stop Claude from answering there.
144[Use Claude Tag in a group DM](/docs/claude-tag/users/group-dms.md) covers how to add Claude and what differs from a channel. If you're an admin, [Group DMs](/docs/claude-tag/admins/restrict-access.md#group-dms) covers how who is in a group DM can change whether Claude answers, and the settings that stop Claude from answering there.
145145
146146## Related resources
147147
148* [Security and data handling](/docs/claude-tag/concepts/security-and-data): where credentials are stored, what leaves your tenant, and what runs unattended
149* [Give Claude access](/docs/claude-tag/admins/add-connections): provision the access this page describes
150* [Restrict where Claude Tag operates](/docs/claude-tag/admins/restrict-access): narrow where this agent identity is allowed to act
148* [Security and data handling](/docs/claude-tag/concepts/security-and-data.md): where credentials are stored, what leaves your tenant, and what runs unattended
149* [Give Claude access](/docs/claude-tag/admins/add-connections.md): provision the access this page describes
150* [Restrict where Claude Tag operates](/docs/claude-tag/admins/restrict-access.md): narrow where this agent identity is allowed to act
151151
No line in this hunk matches that.