Home Docs Claude Documentation 22 Aug 2026

One change · claude-docs

Restrict where Claude Tag operates changedclaude-tag/admins/restrict-access

Nearest release: v2.1.240, published 3 hours before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.

Recorded here 22 Aug 2026 16:07 UTC

Lines+20added

Lines−20removed

From line 8 where the diff opens

First seen 14 Aug 2026 this site's first read of the page

Recorded edits50to this page, all time

The whole hunk

from line 8, old and new numbered

lines

from line 8

99In channels, Claude Tag responds only where it's been added and addressed, and the controls on this page narrow that further. DMs are a separate surface that runs on the user's own account; see [how DMs differ from channels](/docs/claude-tag/concepts/agent-identity#direct-message-channels).

1010

11<Note>Most controls on this page require the Owner role in your Claude organization; the [permissions table](#permissions-by-role) below lists which actions an Admin or a channel member can take.</Note>

11<Note>Most controls on this page require the Owner role in your Claude organization; the [permissions table](#permissions-by-role) below lists which actions a channel manager or a channel member can take.</Note>

1212

1313## Control who can invoke Claude Tag

1414

from line 121

121121| **Channel only** | Replies, but while a guest is present it runs with channel-only access. Bundles, connectors, and instructions from the workspace or from **Default Slack access** don't reach the channel, and neither do repositories, memory, or skills. The channel's own instructions and any access bundle attached directly to the channel still apply. |

122122| **Allow** | Replies with the full access the scope gives it, as in any other channel. |

123123

124A channel without its own value shows **Inherit** and takes the value from its workspace, or from **Default Slack access**. An Admin can set a scope to **Restrict** or **Channel only**. Changing it to **Allow** or back to **Inherit** requires an organization owner, because either can widen what guests see. The setting applies to every guest channel the scope covers; to open one channel rather than a whole workspace, set it on the channel's own scope.

124A channel without its own value shows **Inherit** and takes the value from its workspace, or from **Default Slack access**. Changing this setting requires an organization owner. The setting applies to every guest channel the scope covers; to open one channel rather than a whole workspace, set it on the channel's own scope.

125125

126126Under every value, guests in the channel can read what Claude posts there. In any channel that includes a guest, even under **Allow**, Claude won't search the workspace, look up people or channels, or read channels other than the one it's in, because the results could include content the guests can't see in Slack. That is the same reason Claude doesn't search private channels. To do any of that, ask from a channel without guests.

127127

from line 166

166166

167167The **Allow direct messages** toggle controls whether members can message Claude directly. When it's off, Claude is reachable only in channels. The default is on, and you must be an Owner of your Claude organization to change it.

168168

169On [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), the toggle appears in one of two places: directly on the Claude Tag settings page, or in the **Manage** dialog on the Slack entry under **Where Claude Tag works**, where the toggle is labeled **Allow direct messages with Claude**. It's the same setting in both places, so change it wherever it appears for your organization.

169On [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), the toggle appears in one of two places: directly on the Claude Tag settings page, or in the **Manage** dialog on the Slack entry under **Where Claude Tag works**. It's the same setting in both places, so change it wherever it appears for your organization.

170170

171171### Set spend limits

172172

from line 189

189189

190190A channel manager is a member of your Claude organization who can set up Claude in specific channels without the Owner role. Channel managers are available on the Enterprise plan, and you must be an Owner to add or remove them.

191191

192You name channel managers one channel at a time. For that channel, a channel manager adds repositories and credentials, sets the default model, and edits channel instructions. Every other setting at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag) stays with Owners and Admins.

193193

194194### What a channel manager can do on the Configure page

195195

from line 229

229229 </Step>

230230</Steps>

231231

232Owners and Admins can already configure every channel, so you see them as **Already has full access** and can't add them.

232Owners can already configure every channel, so you see them as **Already has full access** and can't add them.

233233

234234Leave the role as it was created: assigned to its channel, with **Claude Tag channel setup** as its only permission. If the role's permissions are changed on the Roles page, the channel's **Channel managers** section stops recognizing the role, shows no managers, and refuses to add or remove any, with an error that points you to the Roles page. To recover, set the role's permissions back to exactly **Claude Tag channel setup**; the group and its members are kept. To give channel managers any other permission, create a separate role for it.

235235

from line 253

253253

254254## Permissions by role

255255

256Creating bundles, binding them to scopes, and pairing workspaces need an Owner; an Admin can edit a bundle's Credentials and Domains tabs but not its other tabs. A [channel manager](#delegate-channel-setup-to-channel-managers) configures only the channels assigned to them. Everything else happens inside the channel and is open to its members. The table lists each action and who can take it.

256Creating bundles, binding them to scopes, and pairing workspaces need an Owner. A [channel manager](#delegate-channel-setup-to-channel-managers) configures only the channels assigned to them. Everything else happens inside the channel and is open to its members. The table lists each action and who can take it.

257257

259| :-------------------------------------------------------------------- | :------------------ | :------------------ | :---------------------------------------------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------- |

260| Pair a workspace | Yes | No | No | No |

261| Create, rename, delete, or bind an Access bundle | Yes | No (view only) | Only to create a bundle for an assigned channel | No |

262| Edit a bundle's Repositories, Plugins, or Instructions tab | Yes | No (view only) | No | No |

263| Edit a bundle's Credentials or Domains tab | Yes | Yes | Credentials tab only, in a bundle created for an assigned channel | No |

264| Add a channel manager | Yes | No | No | No |

265| Set a channel's default model or repositories from the Configure page | Yes | Yes | Yes, in assigned channels | No |

267| Set channel instructions from the Configure link | Yes | Yes | Yes, in assigned channels | Yes, unless the scope's [Channel member edits](/docs/claude-tag/admins/attach-to-scope#restrict-who-can-set-channel-instructions) setting blocks it |

269| Remove Claude from a channel | Yes | Yes | Yes, with `/remove`, unless your Slack admin restricts it | Yes, with `/remove`, unless your Slack admin restricts it |

259| :-------------------------------------------------------------------- | :------------------ | :---------------------------------------------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------- |

260| Pair a workspace | Yes | No | No |

261| Create, rename, delete, or bind an Access bundle | Yes | Only to create a bundle for an assigned channel | No |

262| Edit a bundle's Repositories, Plugins, or Instructions tab | Yes | No | No |

263| Edit a bundle's Credentials or Domains tab | Yes | Credentials tab only, in a bundle created for an assigned channel | No |

264| Add a channel manager | Yes | No | No |

265| Set a channel's default model or repositories from the Configure page | Yes | Yes, in assigned channels | No |

267| Set channel instructions from the Configure link | Yes | Yes, in assigned channels | Yes, unless the scope's [Channel member edits](/docs/claude-tag/admins/attach-to-scope#restrict-who-can-set-channel-instructions) setting blocks it |

270270

271271Scheduled jobs run with the channel's credentials, so a member creating one can't reach anything the channel itself can't.

272272

from line 278

278278* **Renaming or rebranding the app.** The Claude app's name, @-handle, and avatar in Slack are fixed; there is no per-workspace rename setting.

279279* **Per-user spend caps on channel work.** Spend limits apply at the organization and channel level. There's no way to cap what one member can spend in channels; DM usage bills to that member's own seat and follows the seat's usual limits.

280280* **Per-channel responder allowlist.** The restriction toggle governs who can invoke Claude across the workspace; you can't narrow it to a list of people for one channel only.

281* **An open-internet switch in Claude Tag settings.** A channel sandbox reaches only allowed hosts. To let Claude reach a public site or API, an Owner or Admin adds that hostname on a [bundle's Domains tab](/docs/claude-tag/admins/add-connections#allow-a-host-without-a-credential); for broad web access, they pin an [environment](/docs/claude-tag/concepts/glossary#environment) whose network access level is Full access on the scope. [Allow-all egress](/docs/claude-tag/admins/add-connections#allow-all-hosts), a `*` entry on the Domains tab, is off by default and enabled per organization by Anthropic.

281* **An open-internet switch in Claude Tag settings.** A channel sandbox reaches only allowed hosts. To let Claude reach a public site or API, an Owner adds that hostname on a [bundle's Domains tab](/docs/claude-tag/admins/add-connections#allow-a-host-without-a-credential); for broad web access, they pin an [environment](/docs/claude-tag/concepts/glossary#environment) whose network access level is Full access on the scope. [Allow-all egress](/docs/claude-tag/admins/add-connections#allow-all-hosts), a `*` entry on the Domains tab, is off by default and enabled per organization by Anthropic.

282282* **A web search toggle for channels.** No setting turns web search off for channel sessions; the web search capability setting in claude.ai admin settings governs claude.ai chat, not channels. Web search runs on Anthropic's servers rather than from the channel sandbox, so Domains entries and egress settings don't govern it, and a search opens no new path out of the sandbox; search requests travel to Anthropic the same way the session's model traffic already does. See [Web search vs. network requests](/docs/claude-tag/concepts/agent-identity#web-search-vs-network-requests).

283283* **Read-scope confinement.** Claude can search public channels by keyword the same way any Slack user can; it can't read a channel's full history unless it's been added there. There's no setting to disable workspace search, and no setting to enable it in [channels that include guests](#restrict-guest-channels), where search is unavailable.

284284* **Session length enforcement.** Your organization's Slack session-length policy is not enforced on this surface.

This page’s history 50 edits

16 Oct 2026 +66 −68
16 Oct 2026 +1 −0
13 Oct 2026 +42 −29
13 Oct 2026 +4 −2
9 Oct 2026 +42 −9
8 Oct 2026 +2 −2

The page’s own history →

Where it came from

The captureclaude-docs
Upstream pageclaude.com

Around it

Every changethe ledger
That day22 Aug 2026