Follow Discord
Sweep 23 Oct 2026 · 21:48Z Build v2.1.310 529 read Stable v2.1.308 Latest v2.1.310 Next v2.1.310 Feeds RSS JSON llms.txt llms-full.txt Unofficial
HomeDocsClaude Documentation 24 Oct 2026
One change · claude-docs

How agent identity works changedclaude-tag/concepts/agent-identity

Nearest release: v2.1.310, published 4 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.

Upstream edited this page at 24 Oct 2026 02:17 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 24 Oct 2026 02:37 UTC.

Upstream edited
Recorded here
Lines+6added
Lines−4removed
From line 26 where the diff opens
First seen 14 Aug 2026 this site's first read of the page
Recorded edits21to this page, all time

The whole hunk

from line 26, old and new numbered
/
lines
from line 26
2626 
2727The diagram below traces one request through this process.
2828 
29![Diagram showing the request path across three zones, labeled your Slack workspace, Anthropic's infrastructure, and your systems. A task mentioned in the Slack workspace runs in a session sandbox in the middle zone, one sandbox per thread, holding no stored credentials. Outbound requests pass to Agent Proxy, which injects the credential drawn from the credential store; a request that no rule, domain entry, or environment network access setting allows is blocked. Credentialed requests reach your systems, like GitHub, a data warehouse, monitoring, or any HTTP API. A dashed return path shows results posting back in the thread, as Claude.](https://mintcdn.com/claude-ai/lijct3C2aoA3LHFn/images/claude-tag/diagrams/request-path.svg?fit=max\&auto=format\&n=lijct3C2aoA3LHFn\&q=85\&s=10d796e77738a52a505dcab2c9950cda)
29![Diagram showing the request path across three zones, labeled your Slack workspace, Anthropic's infrastructure, and your systems. A task mentioned in the Slack workspace runs in a session sandbox in the middle zone, one sandbox per thread, holding no stored credentials. Outbound requests pass to Agent Proxy, which injects the credential drawn from the credential store; a request that no rule, domain entry, or environment network access setting allows is blocked. Credentialed requests reach your systems, like an issue tracker, a data warehouse, monitoring, or any HTTP API. A dashed return path shows results posting back in the thread, as Claude.](https://mintcdn.com/claude-ai/y3Hxae32FdEU67_n/images/claude-tag/diagrams/request-path.svg?fit=max\&auto=format\&n=y3Hxae32FdEU67_n\&q=85\&s=0cf396f807a5bc0ed4aec73a9feb5d06)
3030 
3131**1. Tag Claude in a channel**
3232 
from line 38
3838 
3939**3. The request crosses Agent Proxy**
4040 
41When the work needs something outside the sandbox, like calling the GitHub API or querying a warehouse, the request crosses Agent Proxy, the network boundary between the sandbox and everything else. Agent Proxy checks it against the rules an admin configured, and decides whether it proceeds and what credential, if any, travels with it.
41When the work needs something outside the sandbox, like querying a warehouse, the request crosses Agent Proxy, the network boundary between the sandbox and everything else. Agent Proxy checks it against the rules an admin configured, and decides whether it proceeds and what credential, if any, travels with it.
4242 
4343**4. Agent Proxy attaches a credential**
4444 
from line 46
4646 
4747**5. The result posts back, as Claude**
4848 
49The credentialed request reaches your system, like GitHub or the warehouse, and the result returns to the thread.
49The credentialed request reaches your system, like the warehouse, and the result returns to the thread.
5050 
5151### Agent Proxy
5252 
53For each outbound request from the sandbox, Agent Proxy checks the destination against three allow layers. A request goes through if any one of them allows it; a host that none of them allows is blocked.
53For each outbound request from the sandbox, other than a GitHub API request or a git operation, Agent Proxy checks the destination against three allow layers. A request goes through if any one of them allows it; a host that none of them allows is blocked.
5454 
5555| When the destination | Result |
5656| :- | :- |
from line 70
7070### How a host gets allowed
7171 
7272A host that none of the three layers above allows is blocked, and Claude names the blocked host in the thread so an admin can add it; see [Give Claude access to your tools](https://claude.com/docs/claude-tag/admins/add-connections.md).
73 
74A GitHub API request or a git operation doesn't go through those layers. It goes through a separate GitHub proxy. See [Network egress](https://claude.com/docs/claude-tag/concepts/security-and-data.md#network-egress) for what governs those requests instead.
7375 
7476### Web search vs. network requests
7577 
Feedback