## Configure the environment for a scope ### Decide what goes in the environment ### Create the environment and choose it on a scope ### Which environment a channel's sessions use ## Where to change a scope's environment
The whole hunk
from line 21, old and new numbered
/
lines
from line 21
2121
2222Access and organization-wide behavior are set at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), per scope (a scope is a channel, a workspace, or your whole organization), so the same agent can work differently in different channels. Most controls below are Owner-only.
2323
24| Setting | What it does | More |
25| :-------------------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------- |
26| Custom instructions | Standing guidance read in every session on a scope, like team conventions. Outranks channel memory. | [Add custom instructions](/docs/claude-tag/admins/attach-to-scope#add-custom-instructions) |
27| Respond automatically | Whether Claude replies to a channel's messages without an @-mention. Channel members can change it too, from Slack or the channel's Configure page. | [Turn automatic replies on or off](/docs/claude-tag/users/when-claude-responds#turn-automatic-replies-on-or-off) |
28| Plugins | Bundles of skills that teach Claude how to use a specific tool | [Attach plugins](/docs/claude-tag/admins/add-connections#attach-plugins) |
29| Connections | Which systems it can reach from each channel | [Add connections](/docs/claude-tag/admins/add-connections) |
30| Default model | Which Claude model handles sessions in a scope | [Choose the model for a scope](#choose-the-model-for-a-scope) |
31| Auto mode allow rules | Actions pre-approved in a scope's sessions that Claude's permission checker would otherwise flag or stop | [Auto mode allow rules](#auto-mode-allow-rules) |
32| Environment | Which cloud environment a scope's sessions run in. The picker shows [organization-shared cloud environments](https://code.claude.com/docs/en/cloud-environments#organization-shared-environments), plus runner pools for organizations that use [self-hosted environments](https://code.claude.com/docs/en/self-hosted-environments-quickstart). Environments on an individual account never appear, because Claude runs channel sessions with no user account attached. | [Channel environment troubleshooting](/docs/claude-tag/admins/troubleshooting#channel-sessions-use-the-wrong-environment-or-can%E2%80%99t-find-one) |
33| Claude Tag version | Which generation answers (New, Legacy, or Off) in a scope | [Migrate from the earlier Claude in Slack](/docs/claude-tag/admins/workspaces#set-the-version-for-a-scope) |
24| Setting | What it does | More |
25| :-------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------- | :---------------------------------------------------------------------------------------------------------- |
26| Custom instructions | Standing guidance read in every session on a scope, like team conventions. Outranks channel memory. | [Add custom instructions](/docs/claude-tag/admins/attach-to-scope#add-custom-instructions) |
27| Respond automatically | Whether Claude replies to a channel's messages without an @-mention. Channel members can change it too, from Slack or the channel's Configure page. | [Turn automatic replies on or off](/docs/claude-tag/users/when-claude-responds#turn-automatic-replies-on-or-off) |
28| Plugins | Bundles of skills that teach Claude how to use a specific tool | [Attach plugins](/docs/claude-tag/admins/add-connections#attach-plugins) |
29| Connections | Which systems it can reach from each channel | [Add connections](/docs/claude-tag/admins/add-connections) |
30| Default model | Which Claude model handles sessions in a scope | [Choose the model for a scope](#choose-the-model-for-a-scope) |
31| Auto mode allow rules | Actions pre-approved in a scope's sessions that Claude's permission checker would otherwise flag or stop | [Auto mode allow rules](#auto-mode-allow-rules) |
32| Environment | Which cloud environment a scope's sessions run in | [Configure the environment for a scope](#configure-the-environment-for-a-scope) |
33| Claude Tag version | Which generation answers (New, Legacy, or Off) in a scope | [Migrate from the earlier Claude in Slack](/docs/claude-tag/admins/workspaces#set-the-version-for-a-scope) |
3434
3535### Channel connections are separate from personal connectors
3636
from line 77
7777
7878A change to the allowed list applies to new sessions, like a change to the **Default model**; a thread already underway keeps its model until someone in it asks Claude to switch.
7979
80## Where to change a scope's environment
80## Configure the environment for a scope
8181
82The environment is the sandboxed compute configuration a scope's sessions run in. You create environments in one place and pin one per scope in another. An Owner or admin creates environments on the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings), as [organization-shared environments](https://code.claude.com/docs/en/cloud-environments#organization-shared-environments). You then pin one per scope, in the **Environment** picker in the scope's **Advanced** section on [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), for **Default Slack access**, a workspace, or a channel. A channel with no pin of its own inherits the nearest pin above it; with nothing pinned anywhere, sessions use the **Organization default**.
82Claude runs every channel session in a sandbox that starts with a standard set of tools. When a channel's work needs something that sandbox doesn't have, such as a language runtime, a database client, a set of environment variables, or broader web access, give the channel an environment. An environment is an [organization-shared cloud environment](https://code.claude.com/docs/en/cloud-environments#organization-shared-environments): you create it once, then choose it on a scope, meaning a channel, a workspace, or **Default Slack access**. Both steps take an Owner; a [channel manager](/docs/claude-tag/admins/restrict-access#delegate-channel-setup-to-channel-managers) can't change a channel's environment.
8383
84A change applies to new sessions; after you pin an environment, start a fresh thread to pick it up. To give a channel broader network access through its environment, see [broad web access through the environment](/docs/claude-tag/admins/add-connections#broad-web-access-through-the-environment). If sessions don't pick up the environment you pinned, see [channel sessions use the wrong environment](/docs/claude-tag/admins/troubleshooting#channel-sessions-use-the-wrong-environment-or-can%E2%80%99t-find-one).
84### Decide what goes in the environment
85
86An environment carries a setup script, environment variables, and a network access level. Not everything a channel needs belongs there, so match each need to its place before you create one:
87
88| What the channel needs | Where to put it |
89| :------------------------------------------------------------------------------ | :------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
90| A tool installed before Claude starts, such as a runtime or a database client | The environment's setup script, a Bash script whose installs are on disk before Claude starts work |
91| A value every session should see, such as a deployment target or a feature flag | The environment's environment variables, as `KEY=value` pairs, one per line |
92| Web access without a credential | The environment's network access level; see [broad web access through the environment](/docs/claude-tag/admins/add-connections#broad-web-access-through-the-environment) |
93| An API key, token, or other credential | A [connection](/docs/claude-tag/admins/add-connections), never an environment variable |
94| Setup for one repository, such as installing its dependencies | That repository's `CLAUDE.md`; see [install project dependencies](/docs/claude-tag/admins/configure-github#install-project-dependencies) |
95
96Keep credentials out of environment variables because every session on the environment reads them and Claude can print them. There is no separate secrets store. A connection stores the credential outside the sandbox and attaches it to matching requests at the network layer, so Claude uses the service without holding the raw value. [Agent Proxy](/docs/claude-tag/concepts/agent-identity#agent-proxy) describes how. A connection also travels with the access bundle, so you choose channel by channel which sessions can use it. Repository-specific setup goes in `CLAUDE.md` so the people who maintain the repository keep it current. Claude reads it when it starts work in that repository.
97
98### Create the environment and choose it on a scope
99
100Creating the environment and choosing it on a scope happen on two different admin pages. Choose it on a channel to change only that channel's sessions, on a workspace to cover every channel in the workspace where you haven't chosen one, or on **Default Slack access** to cover every workspace.
101
102<Steps>
103 <Step title="Create the environment">
104 From the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings), add an [organization-shared environment](https://code.claude.com/docs/en/cloud-environments#organization-shared-environments) and fill in its setup script, environment variables, and network access level.
105 </Step>
106
107 <Step title="Choose it on the scope">
108 Open [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), select the **Slack** tab under **Claude Tag's access**, and select the scope's row: the **Slack** row for **Default Slack access**, or the workspace or channel. Expand **Advanced** and pick the environment in the **Environment** picker.
109 </Step>
110
111 <Step title="Check it in a new thread">
112 Start a fresh thread in the channel and ask Claude to use what you added, such as running the tool your setup script installed. Threads already underway keep the environment they started on, so an existing thread won't show the change.
113 </Step>
114</Steps>
115
116### Which environment a channel's sessions use
117
118When a session starts, Claude uses the first environment it finds, in this order:
119
1201. The channel's **Environment** setting
1212. The workspace's **Environment** setting
1223. The **Environment** setting on **Default Slack access**
1234. The [organization's default environment](https://code.claude.com/docs/en/cloud-environments#the-default-environment), which an Owner chooses under **Cloud sessions** at [`claude.ai/admin-settings/claude-code`](https://claude.ai/admin-settings/claude-code)
124
125If you haven't chosen an environment on a scope, its picker shows **Organization default**, but sessions there may still run on an environment you chose on the workspace or on **Default Slack access**. In a channel where Claude runs with [channel-only access](/docs/claude-tag/admins/restrict-access#how-channel-only-works) because a guest is present, sessions run on the standard environment regardless of these settings. If a channel's sessions aren't on the environment you expect, see [channel sessions use the wrong environment](/docs/claude-tag/admins/troubleshooting#channel-sessions-use-the-wrong-environment-or-can%E2%80%99t-find-one).
85126
86127## Auto mode allow rules
87128