Claude Tag turns Slack into a team-scoped agent workspace

Slack is already where many enterprise decisions get made in fragments: incident threads, launch checklists, customer escalations, open questions, and half-finished handoffs. Claude Tag is Anthropic's attempt to place Claude inside that stream as a shared actor rather than a private assistant. The launch matters because it changes the default unit of work from a user session to a channel-scoped agent identity.

Anthropic introduced Claude Tag on June 23, 2026 as a beta for Claude Enterprise and Team customers in Slack. The product lets teams grant Claude access to selected channels, tools, data, and codebases, then invoke it by tagging @Claude in a channel or thread. Anthropic says Claude can remember relevant channel information, work asynchronously, schedule future tasks, and proactively flag relevant information when ambient behavior is enabled. It also says the feature replaces the existing Claude in Slack app, with administrators able to opt in during a 30-day migration window. 1

The product headline is easy to summarize: Claude can now live in Slack. The more consequential design choice sits underneath that headline: Claude Tag makes the agent's access, memory, billing, and audit trail belong to the team space where work is happening, not to whichever employee happened to ask first.

Claude already had several enterprise work surfaces before this launch. Claude Code runs in a terminal, IDE, web session, or Slack-routed coding flow. Cowork and Claude chat are closer to personal or small-group workspaces. The Claude Tag docs draw a sharper boundary: team work belongs in Claude Tag, while personal work belongs in Cowork or Claude Code. In Claude Tag, Slack channels are the work surface, the channel's connections determine what the agent can reach, and everyone in the channel can see or steer the work. 2

The session model is designed for multiplayer delegation. A Slack message that includes @Claude starts a working session for that thread. Claude acknowledges the task, updates a checklist while it works, and posts the result back into the thread. Anyone in the channel can reply in that same thread to steer the running session, even if they did not start it. 2

That matters because enterprise agent work often fails at the handoff layer. A private chat can produce a useful answer, but the answer has to be copied back into the team record, reviewed by people who did not see the prompt, and repeated when the next teammate needs context. Claude Tag puts the task, progress surface, corrections, and result in the same place as the original discussion. The artifact is not only the answer. It is the thread history around the answer.

The docs also show why the feature is more than a Slack bot. Each thread gets an isolated sandbox on Anthropic's infrastructure. The thread persists, but the sandbox is released when the session goes quiet and rebuilt when someone replies. Durable outputs have to be posted into Slack, pushed to a branch, opened as a pull request, or saved in an external system; files that only existed inside the sandbox do not persist. 2

That sandbox lifecycle is a useful constraint. It nudges teams to make Claude put intermediate work somewhere reviewable instead of letting an invisible scratchpad become the hidden source of truth.

The most important sentence in the documentation is not about Slack. It is about identity: in channels, Claude acts under its own service accounts that an organization Owner provisions, rather than acting as the human who tagged it. Posts come from the Claude app, GitHub work can appear under the Claude GitHub App, and other tools use service accounts configured by an admin. Direct messages work differently: they run on the individual user's claude.ai account with that user's personal connectors. 4

That split solves a practical permissions problem. In a shared channel, multiple people can steer the same task. If Claude used the requester's personal permissions, every task would inherit a moving and sometimes inappropriate access boundary. With agent identity, the question becomes: what may this channel's Claude do?

Anthropic is explicit about the consequence. A channel member without direct access to a repository can ask Claude to read that repository if the channel profile grants Claude that permission. The permission follows the channel profile, not the person. 5 That is powerful, and it will make security teams look closely at channel membership, channel purpose, and how broadly access bundles are granted.

The governance model has three layers. Organization-wide credentials and repositories can apply everywhere Claude Tag is installed. Workspace-level access applies to public channels in a Slack workspace. Private channels can receive extra credentials or repositories while keeping their tools and memory separate from other channels. 6

Claude Tag launches with controls that look built for security review rather than only for user adoption. The docs say Claude starts with no access to external systems until an Owner adds connections. Every channel request runs in a sandbox hosted by Anthropic, and outbound calls leave the sandbox through Agent Proxy. Credentials are stored separately, injected at request time, and not placed into the model or sandbox. 8

The network model is default-deny. If an outbound request matches a configured credential rule, Agent Proxy attaches the credential. If the request matches only an allowed host, it goes out without credentials. If it matches neither, the host is blocked. 8

The Help Center adds operational controls. Owners can set organization-wide and per-channel Claude Tag spend limits, receive threshold alerts at 75% and 95%, and see per-channel usage analytics. Work that would exceed a limit is declined rather than silently cut short. 6 Admins can also review an audit view that lists scheduled and one-time tasks plus network calls made through Agent Identity. 6

The launch promo reinforces the expected usage pattern. Anthropic is issuing a one-time Claude Tag usage credit of $25,000 for eligible Claude Enterprise organizations and $2,500 for Claude Team organizations with at least 10 paid seats. The credit applies only to Claude Tag usage in Slack channels, not direct messages, Claude Code, Cowork, Claude chat, or the API. 9 That is a strong hint that Anthropic wants companies to test shared-channel delegation at organizational scale, not treat the launch as another personal assistant surface.

Anthropic frames Claude Tag as an evolution of Claude Code. The launch post says tagging @Claude is one of the main ways Anthropic gets work done internally and claims that 65% of its product team's code is created by its internal version of Claude Tag. 1 That figure should be read as an internal adoption claim, not as proof that Claude Tag will transfer unchanged into every engineering organization. The mechanism behind it is still instructive: if code work begins in team discussions, an agent that can read the discussion, use the team's tools, and report back in the same thread removes a lot of coordination overhead.

The same pattern extends beyond engineering. The launch post names product metrics, support tickets, and root-cause debugging as examples of work Anthropic is delegating by tagging Claude. 1 The product page lists examples such as catching up on a long thread, pulling account spend numbers, turning a bug report into a draft pull request, preparing for a customer call, and watching a backlog channel. 3

A TechCrunch launch piece captured the strategic angle well: persistent company context is becoming a contested layer in enterprise AI, with Microsoft, Snowflake, Databricks, Glean, and Anthropic all trying to sit close to organizational knowledge. 10 Claude Tag's distinctive bet is that the context layer should not only be retrieved into a chat window. It should be accumulated in the same shared channels where teams decide, correct, and assign work.

Three questions will decide whether Claude Tag becomes durable enterprise infrastructure or stays a high-potential Slack beta.

First, can teams keep access bundles aligned with real work boundaries? Agent identity is cleaner than borrowed user credentials, but it also means the channel profile can grant power that individual members do not personally hold.

Second, can memory stay useful without becoming stale institutional residue? The tutorial encourages teams to correct Claude in-thread because those corrections stick for the channel. 11 That creates compounding value if teams review memory. It creates drift if they do not.

Third, will ambient behavior earn trust? Anthropic says Claude can proactively follow up on quiet threads, flag relevant information, and schedule work over hours or days. 1 The same behavior that makes an agent feel useful can also make it feel noisy, expensive, or over-permissioned.

Claude Tag is therefore less a Slack integration than a test of a new enterprise agent contract: give the agent its own identity, bind it to team spaces, make its work public by default, and force its access through admin-owned boundaries. If that contract holds, Slack becomes more than the place where humans discuss work. It becomes the place where a governed agent can take custody of work and hand it back with a trail.