Claude Tag

Source: raw/reddit-1udn7zy.md (@ClaudeOfficial launch post, claude.com/product/tag) · raw/x-account-claudeai-2069468693017268244.md (@claudeai) · raw/x-account-bcherny-2069474689819480394.md (Boris Cherny — sandboxing detail) · raw/anthropic-watch-claude-code-tag-v2-1-187.md + v2.1.186 (release notes) · ai-research/agent-identity-access-model-blog-2026-07-03.md (Noah Zweben, Anthropic — agent identity & access model) Type: Product Feature (beta) · Product: Claude Code · Announced: 2026-06-23 · Plans: Claude Enterprise + Team

Claude Tag is a proactive, team-oriented evolution of Claude Code that lets a whole team delegate work to Claude by @-tagging it in Slack, where it joins as a persistent team member with access to the channels and tools you grant it. Announced June 23, 2026 in beta for Enterprise and Team plans (starting in Slack, more surfaces planned), it is the successor to the earlier “Claude in Slack” reach-out — tagging Claude is now described as one of the main ways Anthropic itself ships, with 65% of its product team’s code coming from the internal version.

What it does

• Tag to delegate. @-tag Claude with a request in a channel and it decomposes the task into stages, uses the tools it’s been granted, works in-thread, and delivers outputs — writing or merging pull requests, running data analysis, or helping resolve an incident.
• Builds shared context over time. One Claude follows a channel and accumulates understanding of the work, so teammates don’t re-explain from scratch and can pick up a thread seamlessly. With permission it can also learn from other Slack channels and connected data sources.
• Optional ambient behavior. Turned on, Claude takes initiative without being prompted — flagging a thread that went quiet, or surfacing what’s relevant across the channels and tools it’s connected to.
• Artifacts as output. Beyond text it can produce live, interactive outputs (e.g. PR walkthroughs, dashboards) derived from full session context. ^[inferred] (the artifacts-in-Slack framing comes from the launch thread synthesis, not the official post verbatim — verify against claude.com/product/tag).

How it runs (per-thread sandbox)

Boris Cherny (Claude Code creator) described the mechanics: tagging Claude spins up a per-thread sandboxed instance with isolated memory and permissions. It clones the repo, writes/tests/compiles code, and returns the result in the thread. One instance per thread; the sandbox is discarded after the task completes. At launch he framed it as “proactive, multiplayer, with its own identity and memory — not just a bot in Slack.”

The June 2026 Claude Code releases ship the controls that back this isolation:

• sandbox.credentials setting (v2.1.187) — blocks sandboxed commands from reading credential files and secret environment variables, so a tagged-in agent operating in a shared channel can’t exfiltrate secrets through its sandbox.
• Org-configured model restrictions (v2.1.187) — admins can restrict which models the picker / --model / ANTHROPIC_MODEL may select, surfaced as a “restricted by your organization’s settings” message.
• claude mcp login/logout (v2.1.186) — CLI-level MCP auth (with --no-browser SSH support), part of granting a team agent scoped access to connected tools.

This is the architectural complement to the marketing framing: Claude Tag is Claude Code made multiplayer, with the isolation/permission surface hardened for a shared workspace.

How it compares to the other reach-outs

Surface	What it is
Claude Tag	Persistent team member in Slack; @-tag to delegate multi-stage work; per-thread sandbox; optional proactive/ambient behavior
Claude in Slack (predecessor)	One-off @Claude mention spawns a web session from conversation context
[[claude-ai/channels	Channels]]
[[claude-ai/managed-agents	Managed Agents]]
[[claude-ai/claude-cowork	Cowork]]

Agent identity & access model

Official Anthropic explainer (Noah Zweben, Claude Code team, June 24 2026): agent identity and access model. This resolves the “its own identity and memory” claim from Boris Cherny’s launch framing above into concrete mechanics — and, per direct research (2026-07-03), this post is specifically about Claude Tag, not the separate Channels feature that earlier cited the same source (see the correction note on that article).

Why “act as the user” breaks down for Claude Tag:

• Agent autonomy is rising — the task length an agent can reliably complete has been doubling roughly every four months (citing Anthropic’s recursive self-improvement research), so agents now act long after the requesting user has logged off.
• Multiplayer teams — when several people steer one channel, no single person’s permissions are the “right” ones to borrow at all times.

Claude acts as itself, not the user. In an active channel, Claude posts to Slack as the Claude app, opens PRs as the Claude GitHub App, and queries a data warehouse under an admin-provisioned service account — never a person’s credentials. Because no personal credentials are in play, a shared channel can never become a side door into someone’s private documents.

Inheritance model. Admins define a baseline identity — connections + skills — at the workspace level; every channel inherits it by default, with per-channel overrides (e.g. the engineering channel gets GitHub + warehouse access; a CRM connector stays confined to one private channel). Four things admins configure per identity:

1. Repository access — which repos Claude can read/write.
2. Connectors — tools and API keys; the same service can be wired at different permission levels per channel (read-only warehouse access in a general channel, write access in the data team’s private one).
3. Skills and plugins — dynamically loaded instruction/script/resource folders.
4. Standing instructions — custom per-channel context.

Revoking the identity kills access everywhere it was used, at once — far less effort than auditing individual agent actions across dozens of user accounts.

The reframed access-control paradigm. Agent identity replaces “what can this user do?” with “what can this agent do in this compartment?” — a real departure from per-user ACLs. Concretely: a channel member without direct repo access can still ask Claude to read that repo, if the channel’s profile grants Claude that permission.

Identity boundary granularity. Claude Tag creates a distinct identity per private channel; public channels share one workspace-level identity. Boundaries apply to both tool access and memory — what Claude learns in a private channel never surfaces elsewhere in the workspace. This resolves the “no cross-channel recall” report in the Open Questions history below: a DM runs under the user’s own separate identity entirely (next point), so a channel’s memory was never going to carry over there — by design, not a bug.

DMs stay on the user’s own identity. Direct messages run on the user’s own claude.ai account — connectors, credentials, and name on the result — reserved for things that shouldn’t live in a shared channel (drafting an email, using individually-licensed software).

Enterprise RBAC. On Enterprise plans, admins can additionally control who can invoke Claude at all — a channel governs both what the agent can reach and who can ask. Admins can disable Claude Tag per channel entirely.

Security and audit. Per-channel credentials are stored independently and injected at the network boundary at request time; outbound traffic to any unallowlisted host is blocked outright (egress enforcement, not just after-the-fact logging). Every routine, memory write, and network call made with agent credentials is recorded — and because Claude acts under its own service accounts, those actions also land in each connected system’s own native logs (dual-logging).

Operating advice (Anthropic’s own dogfooding finding). Value compounds with tool/context access — combining Slack + Drive + tracker + warehouse in one answer beats any single tool. Recommended rollout: start with a baseline profile in a few channels, read the audit trail, then extend access one deliberate grant at a time.

Roadmap (announced, not yet shipped): just-in-time credential grants (approve one sensitive action in the moment without permanently widening scope) and an identity-aware permission overlay (adds user-level checks on top of the agent’s channel scope, so Claude acts only when both the channel profile and the requesting user’s own permissions allow it).

Framing and operator patterns

Creator coverage (Ron’s “5 Ways…”, the AI Daily Brief) relays the wider reception:

• Andrej Karpathy framed Claude Tag as the “third major redesign of LLM UI/UX” ^[inferred] — (1) a website you go to, (2) an app you download, (3) a self-contained, persistent, asynchronous entity with org-wide tools working alongside humans. He clarified it’s “an org-level harness,” not a Slackbot or a Claude.ai clone.
• Setup patterns from the Claude Code team (Tariq): introduce Claude to a channel with a pinned instruction message that behaves like a channel-level CLAUDE.md (it enters memory); keep a personal channel (e.g. yourname-claude) for your own forwarded work; have Claude maintain a pinned status message with emoji workstream states.
• Reported field behavior: beyond PRs/analysis/incidents it has handled bug triage, dependent/blocked work, and background metric monitoring; one operator (Chris Taylor, Fractional) reports it self-fixed a misfiring scheduled task and built its own bug tracker.
• Critiques worth holding: accumulating company context inside one vendor is lock-in (“looks like convenience until you try to cancel”); dropping an always-watching agent into a shared channel raises a team-trust / “surveillance” dynamic; and a DIY alternative (a self-hosted Slack agent via Claude Code headless mode, or any model) avoids lock-in and the beta waitlist at the cost of the integration work. Prior art includes Perplexity’s Comet co-worker and ChatGPT workspace agents in Slack.

Key Takeaways

• Claude Tag = Claude Code, made proactive and multiplayer. @-tag it in Slack; it joins a channel as a persistent member, decomposes tasks, uses granted tools, and ships PRs / analysis / incident help in-thread.
• Beta on Enterprise + Team plans (June 23, 2026), Slack first, more surfaces to come. Canonical page: claude.com/product/tag.
• Per-thread sandbox with isolated memory + permissions, discarded after the task (Boris Cherny) — hardened by the sandbox.credentials setting (v2.1.187) that blocks reading secrets.
• Shared, accumulating context means teammates don’t re-explain; ambient behavior lets it take initiative on quiet threads and surface cross-channel info.
• Dogfooding signal: ~65% of Anthropic’s product-team code now comes from the internal version — the strongest adoption data point in the announcement.

Related

• Building Effective Human-Agent Teams — the organizational-lessons companion to this article’s technical mechanism: four lessons (work in public, defined roles, a north star, trust over time) for the “multiplayer agent” model Claude Tag implements.
• Claude Code Channels — the push-based reach-out and the “Claude in Slack” predecessor Claude Tag evolves.
• Claude Managed Agents — the unattended-cloud sibling; Claude Tag is the in-team, conversational counterpart.
• Scaling Managed Agents (architecture) — the sandbox/identity/permission model Claude Tag instantiates per thread.
• Claude Code Agent Teams — multi-agent orchestration; Claude Tag brings the same idea into a Slack channel.
• Cowork — the other team-facing surface; Cowork is chat-first, Claude Tag is channel-native.
• Scheduled Tasks / Hooks — timer- and lifecycle-driven automation; ambient behavior is the proactive leg.
• Measuring AI Agent Autonomy — Anthropic’s framing for how much initiative to grant an agent.

Try It

1. Check eligibility: Claude Tag is beta on Enterprise/Team plans. An admin enables it and connects Slack; see claude.com/product/tag.
2. Start scoped: add Claude to one channel with a narrow tool set (e.g. a repo + CI). Tag it on a small, well-specified PR before widening access.
3. Gate credentials: confirm sandbox.credentials is set so sandboxed commands can’t read secrets — essential in a shared channel where anyone can tag Claude.
4. Turn on ambient behavior deliberately once you trust the scope — it lets Claude act without a prompt, so the permission surface matters more, not less.

Open Questions

• Reported memory-scoping limitation — resolved 2026-07-03. The “Agent identity & access model” section above explains this: a DM runs under the user’s own identity, entirely separate from any channel’s provisioned identity, and private-channel memory is isolated by design. The original report (memory saved in one channel not surfacing when asked from a DM) is expected behavior, not a bug or a gap. (raw/reddit-1uhvayq.md)
• Exact relationship between Claude Tag’s in-Slack Artifacts and the standalone “Artifacts in Claude Code / Cowork” feature (shipped ~June 18) — same engine, different surface? Confirm against the official pages.
• Pricing/metering for tagged sessions on Team vs Enterprise, and rate limits per channel.
• Rollout timeline for surfaces beyond Slack.