ClaudeSetup

Claude Tag: The Channel Is the Permission, Not the Person

Anthropic put Claude in Slack as a real teammate with its own service accounts. The sentence that should drive your decision is buried in the identity docs — access attaches to the channel, so every member of that channel inherits it. Here's the model, the four setup steps, and where they stall.

Jul 28, 20267 min read7 sources

#claude-tag
#slack
#agents
#permissions
#engineering-management

The sentence that should decide whether you put this in your team's Slack isn't on the product page. It's one line in the identity docs: what Claude can reach in a channel comes from the access an admin attached to that channel, and anyone in the channel gets the same capability. Anthropic even lists predictability as the point — what Claude can do never changes based on who asked.

Read that again with your Slack sidebar open. Your channel membership lists just became access-control lists.

Anthropic shipped this as Claude Tag on 23 June 2026, in beta for Team and Enterprise plans on its own first-party service — not on Free, Pro, or Max, and not on third-party deployments. In the same announcement they claim 65% of their product team's code now comes from their internal version of it. Treat that as a directional signal about how they work, not a promise about your repo.

What it actually looks like in a thread

The docs' own example is the honest version of the pitch. Someone in #platform-eng says checkout has felt slow all morning, a teammate tags @Claude and asks it to compare latency against this morning's deploy, and Claude posts a live checklist into the thread: pulled p99 latency from Datadog, diffed the deploy against main, reproduced the slow query locally, opening a pull request with the fix.

The shape matters more than the feature list. The work happens in the thread, in front of the whole channel, with a task list you can watch. The product page groups the shipped use cases as catch-up on a long thread, pulling numbers and charts, drafting PRs, call prep, and monitoring on a schedule. Slack only for now — Microsoft Teams is a waitlist.

The genuinely new part: it isn't a shared bot token

Almost every Slack bot you've installed acts either as the person who installed it or as one opaque app token. Claude Tag gets provisioned identities instead, and an Owner creates them during setup:

In Slack it posts as the Claude app.
On GitHub commits and pull requests are authored by the Claude GitHub App, and each PR links back to the Slack thread that produced it.
Everywhere else it uses a service account you created — the docs walk you through making an address like claude@yourcompany.com and inviting it to each tool as if it were a new hire.

Scope is where it gets interesting: each private channel gets an identity of its own, while all the public channels in a workspace share a single workspace-level one. Kill an identity and Claude's access ends in every system it was used in — one revoke instead of chasing accounts across seven tools.

Credentials also never reach the machine Claude runs on. Each session runs in an ephemeral sandbox on Anthropic's infrastructure, created when the conversation starts and thrown away when it goes idle. Outbound calls cross a component called Agent Proxy, which pulls the credential from a separate store and injects it at the network boundary — the model and the sandbox never hold the key. Any host that matches none of the allow layers is blocked outright, including a curl Claude writes itself.

Two consequences your platform team will hit in week one:

Agent Proxy carries HTTP and HTTPS only. SSH and a database's native wire protocol can't cross it. So "connect it to Postgres" in practice means an HTTP API in front of Postgres, not port 5432.
A fresh environment starts permissive-ish. New environments default to a Trusted network level that already reaches a documented set of package registries and developer hosts. If you want less than that, you pin a stricter level — you don't get it by leaving the page alone.

Channel vs DM: two products, one @mention

In a channel, Claude runs on the provisioned identity with the channel's access, and usage bills to the organization. In a DM, none of that applies — the session runs on your own claude.ai account with your personal connectors, and bills your seat. Pull requests are the one exception: the Claude GitHub App authors them either way.

Keep this diagnostic. If @Claude in your workspace opens pull requests under your GitHub account, you're looking at the older Claude Code in Slack, not Claude Tag. Same Slack app, different engine — Anthropic is replacing the former with the latter for Team and Enterprise workspaces, with nothing to reinstall.

Rolling it out — the four steps and where each one stalls

Installing the Slack app is the prerequisite, not the setup. Setup is provisioning the identity, at claude.ai/admin-settings/claude-tag, and you have to be an Owner in the Claude org. An Admin can open the page and cannot finish it.

Clear three blockers before you book the time. Team or Enterprise plan. Zero Data Retention orgs are excluded outright, because channel memory and session transcripts need retention. And Routines must be enabled for your org — until it is, Claude answers every single mention with "unavailable" and does nothing. That one quietly eats an afternoon.
Pair the workspace. Add the app from the Slack Marketplace, then have a Slack workspace admin send @Claude connect as its own message, no other text. Claude replies with a pairing code that expires in 15 minutes. So get that admin on a call with you — this is not an async-DM task.
Pick three tools and give Claude its own login in each. GitHub is preselected and counts as one of the three. For the others: create the claude@ address, invite it to the tool, then paste that account's credential into the setup page. Not yours. Once saved, the credential is never shown again.
Set a spend limit and launch. There's no per-seat charge; channel work draws down a usage balance. The picker offers $500, $1,000, $2,500 (the default), $5,000, Unlimited, or a custom amount up to $1,000,000 per billing period. DMs run on the sender's seat and don't count against it.

Then test with something that touches no credential at all: /invite @Claude in a pilot channel, then @Claude summarize this channel. A reply proves pairing works and separates a pairing problem from a credential problem — which is exactly the distinction you'll want when it fails.

The EM read

This is the first agent rollout I've seen where the hard part is org design, not tooling. Write access belongs in a private channel with six people, not in #engineering with two hundred. And your channel topology was built for conversation, never for authorization — so expect to split or archive channels as part of this, and expect that to be the actual work.

There's a second-order effect worth naming if you're a Brazilian dev on a distributed US or EU team. Until now, your AI leverage was invisible: it happened in a private window and nobody saw it. Move the agent into the shared channel and the leverage becomes public — the person who scopes the access well, writes the standing instructions, and reviews what the agent produced is now legible to people three time zones away. That visibility is worth more to your career than the tokens saved.

Today: if Claude Tag is already in your workspace, go to your noisiest channel and ask @Claude what can you access from this channel? — then decide whether every member of that channel should have it. If it isn't installed yet, spend ten minutes writing a two-column table for your five busiest channels: who's in it, and what an agent should be allowed to do there. That table is your first access bundle, and it's the artifact security will ask you for anyway.

Sources

More guides like this one.

ClaudeSetup6 min read

Your Agent's Memory Is an Index, Not a Diary

Claude Code writes its own notes to disk now — but only the first 200 lines of the index ever load, and the folder never leaves your laptop. Here is the file layout, the routing rule for what earns a memory, and the one setting that stops three weeks of learning from dying with a machine.

Jul 24, 20264 sources

ClaudeSetup5 min read

The settings.json That Stops the Permission Prompts

Permission rules are the one Claude Code setting that merges across files instead of overriding. Understand that and you can build an allowlist that actually holds — and stop approving the same command forty times a day.

Jun 19, 20262 sources