Claude Tag gives Claude its own Slack identity and channel credentials

Shared Slack channels broke the old rule: "the agent acts as whoever tagged it."

On June 2026, Anthropic launched Claude Tag for Enterprise and Team plans: Claude as a persistent teammate in Slack with agent identity, its own accounts in GitHub, data warehouses, and SaaS tools. Posts come from the Claude app. Pull requests show the Claude GitHub App. Queries run under claude@yourcompany.com style service accounts admins provision.

This is not the same release as scheduled Claude agents and vaults. Managed Agents target cron and API fleets. Claude Tag targets multiplayer Slack where three engineers and a PM debug together and nobody's personal OAuth should become the team backdoor.

Agent identity vs impersonation

Classic integrations impersonate the user who installed the bot. Tag someone in Slack, the bot uses your GitHub token. That fails in production:

• PM tags Claude in #platform-eng and accidentally grants repo write via your admin token
• Audit logs show your name on agent-generated PRs
• Offboarding a human breaks the bot

Anthropic's fix: agent identity. Admins define what Claude can reach at workspace level, then override per channel with access bundles.

Credentials map to channel scope, injected at the network boundary on outbound requests. Traffic to hosts admins did not allowlist is blocked. Audit logs capture routines, memory writes, and network calls under agent credentials.

Setup flow admins actually run

Setup overview walks Owners through:

1. Pair Slack workspace to Claude organization (billing rolls to org)
2. Pick tools Claude will use (GitHub, warehouse, etc.)
3. Create claude@yourdomain.com (or tool-native service accounts)
4. Connect each tool with that login, not a personal admin
5. Attach access bundles to channels (engineering gets GitHub + warehouse, general gets read-only)

Skip tool connection at setup and Claude still answers in Slack with web search defaults. It cannot act in unconnected systems until creds land.

Enterprise RBAC can restrict which members may invoke Claude at all, so channel membership alone does not grant agent access.

Ambient mode and institutional memory

Claude Tag replaces the October 2025 Claude in Slack app. December 2025 added Claude Code in threads (tag Claude, get a PR back). Tag adds ambient behavior: optional monitoring without explicit tags, flagging threads that stalled, following quiet conversations.

The New Stack framed it as institutional knowledge accumulation in the channel where work already happens. That is the enterprise pitch: less context export into a separate agent UI.

Tradeoff: ambient agents need tight bundle scoping. An over-permissioned ambient Claude in #general is a governance incident waiting for a bored Friday thread.

How this pairs with vault thinking

Vault env vars in Managed Agents keep API keys out of prompts. Claude Tag extends the same boundary to multi-user Slack:

• No human OAuth piggybacking
• Per-channel least privilege
• Dual audit trail (Claude platform + each connected SaaS)

If you deploy Anthropic managed agents with webhooks for cron workloads and Claude Tag for human collaboration, identity policy should be one spreadsheet: which service account owns which surface.

Tenable's security write-up stressed the IAM shift: traditional app IAM is per-user. Agent identity is per-channel bundle plus optional user RBAC before anyone can steer.

What I would configure on day one

Finance channel: read-only warehouse, no GitHub write, no Google Drive beyond finance folders.

Platform eng: GitHub app installation scoped to platform repos, not every monorepo.

DM policy: document that DMs run on personal claude.ai connectors so engineers know sensitive queries in DM are their audit trail.

Offboarding: service accounts survive employee turnover. That is the point.

Limits

Beta feature set may move (public beta disclaimer on docs).

Claude Tag is Slack-first. Teams on Teams or Discord still need other gateways.

Ambient mode is powerful and easy to mis-scope. Start tagged-only, expand after bundle review.

Bottom line

Claude Tag is Anthropic productizing agent IAM for multiplayer chat. Shared channels get shared agent credentials, not borrowed human keys. For ops teams already nervous about solo agents at enterprise scale, this is the access model sketch worth copying even if you are not on Slack.

Designing agent governance for your org? Book a free discovery call.