How agent identity works changedclaude-tag/concepts/agent-identity
Nearest release: v2.1.283, published 5 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 26 Sep 2026 00:17 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 28 Sep 2026 22:07 UTC.
Upstream edited
Recorded here
Lines+17added
Lines−17removed
From line
56
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits19to this page, all time
The whole hunk
from line 56, old and new numbered
/
from line 56
5656
5757For each outbound request from the sandbox, Agent Proxy checks the destination against three allow layers. A request goes through if any one of them allows it; a host that none of them allows is blocked.
5858
59| When the destination | Result |
60| :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------- |
61| Matches a connection's rule, its [allowed websites](/docs/claude-tag/admins/add-connections#set-allowed-websites) | The proxy attaches that connection's credential and forwards the request. The credential stays at the proxy; the model and sandbox are not given it. |
62| Is on the [bundle](/docs/claude-tag/concepts/glossary#access-bundle)'s [Domains list](/docs/claude-tag/admins/add-connections#allow-a-host-without-a-credential) but matches no connection | The proxy forwards the request without a credential. |
63| Is allowed by the network access setting of the [environment](/docs/claude-tag/concepts/glossary#environment) the [scope](/docs/claude-tag/concepts/glossary#scope)'s sessions run on | The proxy forwards the request without a credential. |
64| Matches none of these | The proxy blocks the request. |
59| When the destination | Result |
60| :- | :- |
61| Matches a connection's rule, its [allowed websites](/docs/claude-tag/admins/add-connections#set-allowed-websites) | The proxy attaches that connection's credential and forwards the request. The credential stays at the proxy; the model and sandbox are not given it. |
62| Is on the [bundle](/docs/claude-tag/concepts/glossary#access-bundle)'s [Domains list](/docs/claude-tag/admins/add-connections#allow-a-host-without-a-credential) but matches no connection | The proxy forwards the request without a credential. |
63| Is allowed by the network access setting of the [environment](/docs/claude-tag/concepts/glossary#environment) the [scope](/docs/claude-tag/concepts/glossary#scope)'s sessions run on | The proxy forwards the request without a credential. |
64| Matches none of these | The proxy blocks the request. |
6565
6666A new environment's network access level defaults to Trusted access, so a fresh setup can reach a documented set of package registries and developer hosts before an admin has configured anything. The [cloud environments documentation](https://code.claude.com/docs/en/cloud-environments#default-allowed-domains) lists the covered hosts. To narrow that default, pin an environment with a stricter level, such as No access.
6767
from line 114
114114
115115The table lines up the two paths on the four dimensions that differ.
116116
117| | In a channel | In a DM |
118| :---------- | :--------------------------------------------- | :------------------------------------------------------------------- |
119| Acts as | Its own service accounts | You |
120| Access | The channel's Access bundles | Your personal connectors |
117| | In a channel | In a DM |
118| :- | :- | :- |
119| Acts as | Its own service accounts | You |
120| Access | The channel's Access bundles | Your personal connectors |
121121| Attribution | The agent's accounts, in each tool's audit log | Your name, except pull requests, which the Claude GitHub App authors |
122| Billing | The organization | Your seat |
122| Billing | The organization | Your seat |
123123
124124Three of those differences are worth spelling out.
125125
from line 135
135135
136136A DM with Claude Tag runs under your own account, which is also how [Claude Code in Slack](https://code.claude.com/docs/en/slack) works, routing a coding @-mention to a Claude Code session on the web under the requester's own account. The two can look identical. The table shows how to tell them apart.
137137
138| | Claude Tag in a channel | Claude Code in Slack |
139| :------------- | :----------------------------------------------------- | :------------------------------------------------------------------------------ |
140| **Runs under** | The agent identity an admin provisioned | Your own Claude account, linked in the Claude app |
141| **GitHub** | The Claude GitHub App; pull requests belong to the app | Your GitHub connection on claude.ai/code; pull requests open under your account |
142| **Access** | The Access bundles an admin attached to the channel | Your personal connectors |
143| **Billing** | The organization | Your seat |
138| | Claude Tag in a channel | Claude Code in Slack |
139| :- | :- | :- |
140| **Runs under** | The agent identity an admin provisioned | Your own Claude account, linked in the Claude app |
141| **GitHub** | The Claude GitHub App; pull requests belong to the app | Your GitHub connection on claude.ai/code; pull requests open under your account |
142| **Access** | The Access bundles an admin attached to the channel | Your personal connectors |
143| **Billing** | The organization | Your seat |
144144
145145If `@Claude` in your workspace opens pull requests as you, you're seeing Claude Code in Slack, not a Claude Tag session.
146146
No line in this hunk matches that.