Claude Tag
Security guidance for Claude Tag, including identity, deployment scope, data handling, integrations, user access, monitoring, and evidence collection.
In short: Claude Tag is Anthropic's Slack-native shared agent for Team and Enterprise. In channels it acts under organization-provisioned service accounts, not the identity of the person who mentioned it. Everyone in an authorized channel can invoke the same shared access, so channel membership becomes a security boundary.
What is Claude Tag?
Claude Tag lets Slack users mention Claude in channels or direct messages, run one-time and scheduled tasks, use channel memory, and connect the agent to repositories, data systems, and other services.
Channel and direct-message behavior differ:
In a channel, Claude acts under its own agent identity and shared service accounts.
In a direct message, the session uses the individual's Claude account and personal connectors. Actions are attributed to that user.
This distinction should be part of rollout training and incident response.
Where Claude Tag runs and what it can access
Each Slack thread runs in an Anthropic-hosted sandbox. The sandbox holds no long-lived credentials. Outbound HTTP or HTTPS requests pass through Anthropic's Agent Proxy, which checks the destination and injects a credential only at the boundary when a configured rule matches.
Access is assembled from:
Slack channels and channel membership.
Access bundles attached to a channel scope.
Dedicated service accounts and the Claude GitHub App.
Allowed websites and bundle domains.
The network-access setting of the Anthropic environment.
The user's personal connectors for direct messages only.
The default network posture blocks destinations that match no allow layer. New environments can still include Anthropic's Trusted set of package registries and developer hosts, so “default deny” does not necessarily mean no outbound access.
Claude Tag security boundary
Anyone in a channel covered by an Access bundle can ask Claude to use that bundle's credentials. The connected service account therefore needs permissions safe for the least-trusted member of every covered channel.
Claude Tag retains channel memory and session transcripts and is not available to organizations with Zero Data Retention enabled. Published artifacts remain available to members who can access the source Slack channel.
Scheduled routines can run without a fresh human prompt. Treat them as persistent automation with their own owner, scope, credential, and review requirements.
How to configure Claude Tag securely
Restrict who and where
Enable the restriction that limits invocation to approved Claude organization members. On Enterprise, grant the Claude Tag capability only through approved roles.
Review Slack workspace membership, guests, shared channels, and channel privacy before attaching access.
Scope Access bundles to the smallest set of channels.
Disable direct messages organization-wide if personal connectors and user-attributed actions are outside policy.
Do not use a broad public channel for access to sensitive systems.
Provision agent identity safely
Create a dedicated service account for each connected service.
Never connect an administrator's personal account.
Grant the service account only the minimum read or write permissions required.
Restrict credentials to named hosts, path prefixes, and read-only methods where possible.
Keep production write access in a separate bundle and channel from general read access.
Use the connected system's audit logs to monitor actions attributed to the agent account.
Control network and automation
Set the execution environment to the narrowest network level that supports the workflow.
Review Anthropic's Trusted default and remove destinations that are not required.
Avoid the allow-all wildcard.
Review every scheduled or recurring task, owner, trigger, destination, and credential.
Use the Claude Tag Audit view to inspect scheduled and one-time tasks and Agent Identity network calls.
Retain Slack and connected-system logs according to the organization's investigation requirements.
Claude Tag security review checklist
The Slack app was approved by the Slack administrator and installed in the intended workspace.
Invocation is restricted to managed users where required.
Channel membership is reviewed before any Access bundle is attached.
Each connection uses a dedicated, least-privilege service account.
DM behavior and personal connectors match policy.
Network access is narrower than the default Trusted environment where possible.
Scheduled tasks have owners, expiration dates, and periodic reviews.
The organization accepts transcript and memory retention and the lack of ZDR.
Audit records from Claude Tag, Slack, and connected services can be correlated.
Claude Tag provider documentation
Last reviewed: August 18, 2026
Applicable handbook articles
These handbook articles cover the controls most directly relevant to this product.
1. Identity & access
1.2 RBAC across AI platforms 1.3 Tenant restrictions: blocking personal accounts 1.5 Agent and non-human identity 1.6 API keys and service accounts governance 1.7 Human-in-the-loop and approval policies
Channel work uses shared agent identities and service accounts, while direct messages use individual identities and connectors.
2. Connectors, extensions & supply chain
2.1 Connectors and apps: the integration backbone 2.3 MCP gateways and allowlisting 2.4 Analyzing skills for risk 2.5 Plugins and marketplaces 2.7 The supply-chain review workflow 2.9 SaaS agent-building supply-chain
Access bundles, Agent Proxy rules, skills, plugins, instructions, repositories, and services must be reviewed as one release.
3. Runtime, sandboxing & autonomy
3.1 Sandbox and isolation models 3.2 Approval policies and least-privilege autonomy 3.3 Network egress control 3.4 Internet access and browser automation 3.6 Scheduled and background tasks 3.8 File and filesystem access controls 3.9 Central hosted-agent runtime hardening
Each thread runs in a hosted sandbox, egress crosses Agent Proxy, and scheduled routines can act without a fresh prompt.
4. Data protection
4.1 DLP for GenAI 4.2 Data classification for AI prompts and outputs 4.4 Retention and Zero Data Retention 4.5 Training opt-out and data usage 4.6 Cross-app data flow and live artifacts 4.7 Secrets and credential hygiene in prompts and tools
Slack scope, memory, transcripts, service credentials, repositories, outbound services, and published artifacts form the data boundary.
5. Threats & adversarial testing
5.1 Prompt injection: the connective risk 5.2 Data exfiltration via tools and connectors 5.3 Supply chain attacks and notable CVEs 5.4 Agent-specific threats: tool poisoning and confused deputy 5.5 Red-teaming AI systems 5.6 Incident response for AI systems 5.7 Threat modeling AI systems
Shared channel authority, extensions, and unattended routines expose the full injection, exfiltration, supply-chain, agent, testing, response, and modeling set.
6. Observability, audit & evidence
6.1 The audit gap: what you can and can't see 6.2 OpenTelemetry for AI runtime 6.3 Compliance APIs by platform 6.4 Analytics and usage APIs 6.5 Routing AI telemetry to your SIEM 6.6 Evidence by surface and investigation paths 6.7 Continuous review cadence
Evidence is split across Slack, Tag's audit view and network export, service-account logs, connected systems, and usage controls.
7. Rollout & operations
7.1 Roll out by risk: the phased plan 7.2 Pilot design and success metrics 7.3 The security team checklist 7.4 The vendor-neutral control matrix
Shared agents, access bundles, routines, and Slack deployment need separate pilot gates, evidence checks, and baseline controls.
Applicable Harmonic guide
Related handbook guidance
Was this helpful?