v0.1.0 AI Drafted
Home / Guides / Claude Tag

Claude Tag Hardening Guide

AI/ML Platform Last updated: 2026-11-11

Harden Claude Tag’s Slack audiences, agent identity, connectors, federation, egress, runtime, retention and audit boundaries.

Product Docs API Docs
Tag security and data handlingFederated agent identity verification
Code Packs: API Scripts CLI Scripts SDK
View:

Overview

Claude Tag is Anthropic’s Slack-native team agent, currently in public beta, not a synonym for Claude Code or an API resource tag. This product guide extends the Anthropic Common Controls and Claude Enterprise guide. Apply those identity, organization and integration controls alongside this guide.

Channel work normally uses the agent’s service identity. Member-linked one-to-one DMs, personal connectors in channels, group DMs and unlinked-user DMs have different identity, audience and billing boundaries. An employee’s ability to invoke Tag is not proof that Tag acts with that employee’s upstream permissions. Nor does an Enterprise IP allowlist or tenant restriction cover messages sent through Slack.

Scope and validation boundary

This guide covers the documented commercial Team/Enterprise Tag surfaces as checked 2026-11-11, including current federated agent access. Recommendations are HTH’s risk-based baseline, not a claim to reproduce Anthropic Security Center’s exact checklist. See the source-coverage ledger. The Scheduled tasks capability under Remote sessions is a documented prerequisite; disabling it prevents Tag work rather than making Tag local-only. No live tenant was configured or validated; public documentation and offline pack tests retain ai-drafted maturity. Version, plan and staged-UI differences require verification in your tenant. Government/FedRAMP guidance does not make commercial Tag authorized for government workloads.

Intended Audience

Enterprise security administrators, Slack administrators, platform engineers and owners of services delegated to agents.

How to Use This Guide

  • L1 (Crawl): establish the minimum identity, audience, data and response boundaries.
  • L2 (Walk): constrain sensitive workloads and test every independent authorization layer.
  • The Tag Admin API (and these API/CLI/SDK packs) requires an Enterprise organization; Team deployments use the documented console controls. Use synthetic data in pilots and negative tests. Apply mode changes organizational configuration only when an operator explicitly approves its exact plan; no pack provisions credentials or performs underlying business tasks.

Table of Contents

  1. Governance and Containment
  2. Credentials, Egress and Federation
  3. Slack Audience and Disclosure
  4. Runtime and Persistent Work
  5. Data Lifecycle and Operations

1. Governance and Containment

1.1 Inventory Effective Access Before Enabling Tools

Profile Level: L1 (Crawl)

Description

Inventory paired workspaces, channels, scope settings, bundles and delegated administration before connecting privileged systems. Treat the API inventory as partial, not a full effective-permission calculation.

Rationale

Why This Matters:

  • Channel service identities can exceed the requesting employee’s own access.
  • API-visible scope records do not establish the contents or effective inheritance of every bundle.

Attack Prevented: Unnoticed broad grants and false compliance conclusions.

Prerequisites

An authorized Owner or appropriately delegated administrator; approved test channels and non-sensitive fixtures. Plan-specific capabilities are called out below.

ClickOps Implementation

Open Organization settings → Claude Tag → Claude’s access. Review Channels, Connectors, bundles and the inheritance shown for each pilot channel. Include Enterprise Grid workspace IDs, channel-name rules, repository grants and each credential’s upstream permissions. Assign a named owner to every access grant. Compare the read-only pack output with this console evidence; resolve unknowns before approval.

Code Implementation

Code Pack: API Script
hth-claude-tag-1.01-audit.sh View source on GitHub ↗ 
set +x
set -euo pipefail
source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/common.sh"
for id in ${HTH_GRID_IDS:-}; do [[ "$id" =~ ^E[A-Z0-9]{1,31}$ ]] || exit 2; done
for id in ${HTH_APPROVED_CHANNEL_IDS:-}; do [[ "$id" =~ ^slch_[A-Za-z0-9]+$ ]] || exit 2; done
workspaces=$(anthropic_page_token_all "$TAG_ROOT/slack_workspaces?include_inherited=true&limit=100")
printf '%s' "$workspaces" | jq -e 'all(.[]; .type=="slack_workspace" and (.id|test("^slws_[A-Za-z0-9]+$")) and (.slack.workspace_id|test("^T[A-Z0-9]{1,31}$")) and (.settings.enabled|type)=="boolean" and (.settings.guest_policy.type|type)=="string")' >/dev/null
channels='[]'
workspace_ids=$(printf '%s' "$workspaces" | jq -r '.[].slack.workspace_id')
for id in $workspace_ids ${HTH_GRID_IDS:-}; do
  rows=$(anthropic_page_token_all "$TAG_ROOT/slack_channels?include_inherited=true&limit=100&slack_workspace_id=$id")
  printf '%s' "$rows" | jq -e 'all(.[]; .type=="slack_channel" and (.id|test("^slch_[A-Za-z0-9]+$")) and (.settings.enabled|type)=="boolean" and (.settings.guest_policy.type|type)=="string")' >/dev/null
  channels=$(printf '%s\n%s' "$channels" "$rows" | jq -cs 'add|unique_by(.id)')
done
bundles=$(anthropic_page_token_all "$TAG_ROOT/bundles?limit=100")
printf '%s' "$bundles" | jq -e 'all(.[]; .type=="bundle" and (.id|test("^capp_[A-Za-z0-9]+$")))' >/dev/null
targets='[]'
for id in $(printf '%s' "$bundles" | jq -r '.[].id'); do
  rows=$(anthropic_page_token_all "$TAG_ROOT/bundles/$id/targets?limit=100")
  rows=$(printf '%s' "$rows" | jq -ce --arg bundle "$id" 'map(if (.id|type)=="string" and (.type|type)=="string" then {bundle_id:$bundle,id,type,slack_channel_id,slack_workspace_id} else error("invalid target") end)')
  targets=$(printf '%s\n%s' "$targets" "$rows" | jq -cs 'add')
done
# Emit nothing until every requested page succeeds. This is NOT full Slack inventory.
jq -n --argjson workspaces "$workspaces" --argjson channels "$channels" --argjson targets "$targets" --arg approved "${HTH_APPROVED_CHANNEL_IDS:-}" --arg grids "${HTH_GRID_IDS:-}" '
  def minimal: {id,slack,settings:(.settings|del(.instructions)),sources:(.sources|del(.instructions))};
  ($approved|split(" ")|map(select(length>0))) as $allow |
  {scope:"configured Claude Tag resources only", supplied_grid_ids:$grids,
   limitations:["Grid IDs must be supplied separately; omitted Grids are not inventoried", "Not all Slack channels are configured", "Bundle contents, Default Slack access and rule-derived grants require claude.ai review", "No atomic inventory snapshot; reconcile changes during audit"],
   workspaces:($workspaces|map(minimal)), channels:($channels|map(minimal)), explicit_bundle_targets:$targets,
   findings:[$channels[] | . as $c | if (.settings.enabled and ($allow|index($c.id)|not)) then {id,reason:"enabled without supplied approval"} else empty end,
      if .settings.guest_policy.type=="allow" then {id,reason:"guest full access"} elif (.settings.guest_policy.type!="restrict" and .settings.guest_policy.type!="channel_only") then {id,reason:"unknown guest policy; review"} else empty end]}'
Code Pack: CLI Script
hth-claude-tag-1.01-effective-channel.sh View source on GitHub ↗ 
set +x
set -euo pipefail
umask 077
[[ "${HTH_CHANNEL_ID:-}" =~ ^slch_[A-Za-z0-9]+$ ]] || { echo 'Supply HTH_CHANNEL_ID.' >&2; exit 2; }
[[ -n "${ANTHROPIC_API_KEY:-}" && "$ANTHROPIC_API_KEY" != *[[:space:]]* ]] || exit 2
# Do not combine org Admin API credentials with ambient bearer tokens or profiles.
[[ -z "${ANTHROPIC_AUTH_TOKEN+x}" && -z "${ANTHROPIC_PROFILE+x}" ]] || { echo 'Unset bearer token and named profile for this scoped-key check.' >&2; exit 2; }
command -v ant >/dev/null; command -v jq >/dev/null
# Builtin printf feeds the key through stdin, never argv. Never enable --debug.
# Pin origin regardless of ambient base URL; CLI supplies beta/version headers.
if ! response=$(printf '%s' "$ANTHROPIC_API_KEY" | ant beta:organization:claude-tag:slack-channels retrieve \
    --id "$HTH_CHANNEL_ID" --include-inherited --api-key-stdin \
    --base-url https://api.anthropic.com --format json 2>/dev/null); then
  echo 'Read failed; verify CLI version, scoped key, API availability and target. No evidence emitted.' >&2
  exit 1
fi
printf '%s' "$response" | jq -cse --arg id "$HTH_CHANNEL_ID" '
  if length==1 and .[0].id==$id and .[0].type=="slack_channel" and
    (.[0].settings.enabled|type)=="boolean" and (.[0].settings.guest_policy.type|type)=="string"
  then .[0] | {id,slack,settings:(.settings|del(.instructions)),sources:(.sources|del(.instructions)),
    scope:"one configured channel; not Bundle contents or complete Slack inventory"}
  else error("Unexpected response; no verified effective policy") end'

Validation & Testing

Run the inventory with a read-only key where supported. Verify that a known broad grant and a Grid workspace are represented. Missing resources, pagination failures and opaque bundle contents must remain UNKNOWN, never PASS.

Expected result: Approved operations succeed, disallowed operations fail, and untested or inaccessible surfaces remain explicitly unknown.

References

1.2 Constrain Invocation and Provide a Tested Stop Control

Profile Level: L1 (Crawl)

Description

Limit who can invoke Tag and where it runs. Disable an unapproved channel explicitly rather than assuming a parent toggle is an unconditional deny.

Rationale

Why This Matters:

  • An installed Slack app can expose agent authority to users without a Claude seat.
  • Scoped overrides and inherited settings differ from a global kill switch.

Attack Prevented: Unauthorized invocation and ineffective incident containment.

Prerequisites

An authorized Owner or appropriately delegated administrator; approved test channels and non-sensitive fixtures. Plan-specific capabilities are called out below.

ClickOps Implementation

On Claude’s access → Channels → Slack → Advanced → Access, enable the Enterprise role restriction (or Team organization restriction). On Enterprise, assign custom roles deliberately: built-in roles grant Tag and any granting role wins. On General, disable broad channel response and enable only approved channels where per-scope switches exist. Reset pre-existing workspace/channel enable overrides before relying on a default-off rollout. Review DMs separately. Enterprise Grid channels shared across workspaces paired to the same Claude organization use only the Slack-root settings/access, not channel/workspace bundles; they cannot be individually enabled as exceptions to root default-off. Shared channels spanning different Claude organizations do not respond. Test these Grid cases separately. Disable DMs when unapproved; group DMs lack individual channel-style scoping and can inherit root/workspace access. Review verified-domain account linking when your Enterprise organization exposes that control. Use blocked name patterns to exclude sensitive channels and audit auto-join rules; never assume an auto-join rule alone enables a disabled channel. Use the pack only for an existing exact channel you intend to disable; it also restricts guests. Review the before/after plan before explicit apply.

Code Implementation

Code Pack: API Script
hth-claude-tag-1.02-lockdown-channel.sh View source on GitHub ↗ 
set +x
set -euo pipefail
source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/common.sh"
id=${HTH_CHANNEL_ID:-}
[[ "$id" =~ ^slch_[A-Za-z0-9]+$ && "${HTH_SLACK_WORKSPACE_ID:-}" =~ ^[TE][A-Z0-9]{1,31}$ && "${HTH_SLACK_CHANNEL_ID:-}" =~ ^[CG][A-Z0-9]{1,31}$ ]] || { echo 'Supply exact API channel ID and Slack workspace/channel IDs.' >&2; exit 2; }
[[ "${HTH_APPLY:-0}" == 0 || ( "${HTH_APPLY}" == 1 && "${HTH_CONFIRM_CHANNEL_ID:-}" == "$id" ) ]] || exit 2
before=$(anthropic_get "$TAG_ROOT/slack_channels/$id")
printf '%s' "$before" | tag_channel_valid "$id"
printf '%s' "$before" | jq -e --arg w "$HTH_SLACK_WORKSPACE_ID" --arg c "$HTH_SLACK_CHANNEL_ID" '.slack.workspace_id==$w and .slack.channel_id==$c' >/dev/null
body='{"settings":{"enabled":false,"guest_policy":{"type":"restrict"}}}'
if [[ "${HTH_APPLY:-0}" != 1 ]]; then
  jq -n --arg id "$id" --argjson body "$body" '{mode:"preview; no writes",id,proposed: $body}'
  exit 0
fi
# Private snapshot for operator review, not automatic replay (which could restore unsafe access).
evidence=$(anthropic_evidence_dir)
printf '%s\n' "$before" > "$evidence/before.json"
printf 'Private before snapshot: %s\n' "$evidence/before.json" >&2
# Minimal partial update leaves instructions/model/environment untouched, including runner pools.
if ! anthropic_post "$TAG_ROOT/slack_channels/$id" "$body" >/dev/null; then
  echo 'Write outcome unresolved. Read current settings before any retry; do not assume failure means no write.' >&2; exit 1
fi
after=$(anthropic_get "$TAG_ROOT/slack_channels/$id")
printf '%s' "$after" > "$evidence/after.json"
printf '%s' "$after" | tag_channel_valid "$id"
printf '%s\n%s' "$before" "$after" | jq -se '.[1].settings.enabled==false and .[1].settings.guest_policy.type=="restrict" and .[0].slack==.[1].slack and (.[0].settings|del(.enabled,.guest_policy))==(.[1].settings|del(.enabled,.guest_policy))' >/dev/null || { echo 'Read-back mismatch or concurrent edit; inspect snapshots, do not automatically overwrite.' >&2; exit 1; }
effective=$(anthropic_get "$TAG_ROOT/slack_channels/$id?include_inherited=true")
printf '%s' "$effective" | tag_channel_valid "$id"
printf '%s' "$effective" | jq -e '.settings.enabled==false and .settings.guest_policy.type=="restrict"' >/dev/null
jq -n --arg id "$id" '{id,status:"stored and effective lockdown verified",limits:"Not confirmation that running sessions terminated; other channels and direct messages unchanged"}'

Validation & Testing

Test an authorized and unauthorized member and an explicitly disabled channel. Confirm no new task starts there, while approved channels remain unchanged. Emergency response also revokes upstream credentials; disabling responses does not erase stored data.

Expected result: Approved operations succeed, disallowed operations fail, and untested or inaccessible surfaces remain explicitly unknown.

References

1.3 Cross-check Explicit Bundle Targets with the SDK

Profile Level: L1 (Crawl)

Description

Use the official SDK’s paginated target inventory as a second evidence route. A target list is not the contents of a bundle or a complete effective policy.

Rationale

Why This Matters:

  • Explicit workspace targets can grant far more than a single channel.
  • Default and rule-derived access is not represented by explicit target rows.

Attack Prevented: Undetected broad bundle assignment and misleading “no targets means no access” findings.

ClickOps Implementation

Open each bundle in Claude’s access and compare Where it applies with the inventory. Reconcile channel-name rules, defaults and contents separately; do not delete or detach anything based on an incomplete list.

Code Implementation

Code Pack: SDK Script
hth-claude-tag-1.03-bundle-target-inventory.py View source on GitHub ↗ 
import json
import os
import sys


def inventory(tag):
    rows = []
    # Official iterators exhaust pages, including empty pages with next_page.
    for bundle in tag.bundles.list():
        for target in tag.bundles.targets.list(bundle.id):
            rows.append({
                'bundle_id': bundle.id, 'target_id': target.id,
                'target_type': target.type,
                'slack_channel_id': getattr(target, 'slack_channel_id', None),
                'slack_workspace_id': getattr(target, 'slack_workspace_id', None),
            })
    return {
        'explicit_targets': rows,
        'limitations': [
            'Bundle contents are not exposed: inspect them in claude.ai.',
            'Default Slack access and rule-derived Bundle access are not targets.',
            'Workspace targets grant access across that workspace, not one channel.',
            'This is not a complete effective-permission assessment.',
        ],
    }


def main():
    # Prevent ambient SDK base URL overrides from routing the scoped key elsewhere.
    if os.getenv('ANTHROPIC_BASE_URL', 'https://api.anthropic.com') != 'https://api.anthropic.com':
        raise ValueError('Only the official API origin is supported')
    key = os.environ['ANTHROPIC_API_KEY']
    if not key or any(c.isspace() for c in key):
        raise ValueError('A scoped key is required')
    import anthropic
    import httpx
    client = anthropic.Anthropic(api_key=key, base_url='https://api.anthropic.com',
                                 max_retries=0, timeout=30.0,
                                 http_client=httpx.Client(follow_redirects=False))
    # No partial stdout if a later page fails. SDK supplies beta/version headers.
    print(json.dumps(inventory(client.beta.organization.claude_tag), indent=2))


if __name__ == '__main__':
    try:
        main()
    except Exception:
        # SDK errors may contain request/response details; do not log secrets/content.
        print('Inventory failed; check SDK version, scoped key, API access and connectivity. No complete evidence emitted.', file=sys.stderr)
        sys.exit(1)

Validation & Testing

Use an organization-scoped read:claude_tag key and a current SDK exposing the documented namespace. Confirm all pages are traversed. A failed page or unsupported SDK is an error, not an empty inventory. Review the private report against the console.

References

2. Credentials, Egress and Federation

2.1 Keep Service Credentials Narrowly Scoped from Creation

Profile Level: L1 (Crawl)

Description

Use dedicated service identities and introduce sensitive credentials at the channel or an initially unassigned bundle, not through an organization-wide default.

Rationale

Why This Matters:

  • Every member in an authorized channel can benefit from the service identity’s permissions.
  • The first credential created for a service on the Connectors tab applies across Slack immediately.

Attack Prevented: Privilege amplification and transient organization-wide credential exposure.

Prerequisites

An authorized Owner or appropriately delegated administrator; approved test channels and non-sensitive fixtures. Plan-specific capabilities are called out below.

ClickOps Implementation

Create a dedicated upstream identity with only necessary projects, folders and operations. In Claude’s access → Channels, open the intended private channel and add a Connector there, or use a new bundle and assign only approved channels. Inspect Where it applies and inherited access at root, workspace, channel and name-rule scopes. Remove broad grants at their source: a narrow bundle does not subtract inherited privileges. Recheck when channels are renamed or shared.

Automation: The inventory pack in 1.1 supplies partial evidence only. The current Tag API covers only five scope settings plus explicit bundle attachments, not these connector, identity, retention or other console/upstream-service controls. Use their documented console/service configuration and verify effective inheritance separately. See the automation-surface census in the research ledger; this is a pack coverage boundary, not a claim that vendor APIs do not exist.

Validation & Testing

Use harmless fixtures to prove access in the approved channel and denial in an unrelated channel. Test the union of overlapping bundles and rules, not only the newly added grant.

Expected result: Approved operations succeed, disallowed operations fail, and untested or inaccessible surfaces remain explicitly unknown.

References

2.2 Constrain Credential Injection and All Egress Layers

Profile Level: L2 (Walk)

Description

Restrict credential destinations, paths and methods, and audit every independent outbound allowance. Secret isolation alone does not prevent misuse of the authenticated API.

Rationale

Why This Matters:

  • Proxy-injected secrets are outside the sandbox, but the agent can still exercise their granted authority.
  • Domain entries and environment network policy can allow uncredentialed exfiltration independently.

Attack Prevented: Credential forwarding, excessive API operations and outbound data exfiltration.

Prerequisites

An authorized Owner or appropriately delegated administrator; approved test channels and non-sensitive fixtures. Plan-specific capabilities are called out below.

ClickOps Implementation

In each connector’s advanced settings, replace broad or incorrect regional Allowed websites with approved hosts; use documented path-prefix and HTTP-method restrictions where supported. Review domain entries at every scope and avoid the allow-all * entry. Review the selected cloud environment’s network policy: Limited access already permits developer/package hosts. Prefer the smallest required network set. Review GitHub separately because its proxy is not governed by these ordinary egress layers. Server-side web search is another distinct path: sandbox domain/network rules do not govern it and no Tag channel web-search-off switch is documented. Shared egress IPs identify vendor infrastructure, not your tenant; authenticate every exposed service. Do not put secrets in instructions, setup scripts, repository files or environment variables merely to bypass connector constraints.

Automation: The inventory pack in 1.1 supplies partial evidence only. The current Tag API covers only five scope settings plus explicit bundle attachments, not these connector, identity, retention or other console/upstream-service controls. Use their documented console/service configuration and verify effective inheritance separately. See the automation-surface census in the research ledger; this is a pack coverage boundary, not a claim that vendor APIs do not exist.

Validation & Testing

Test approved and rejected hosts, methods and paths with non-sensitive requests; also test uncredentialed egress and GitHub. Inspect upstream audit records to confirm the dedicated identity. Revalidate redirects and subdomain matching before allowing a new endpoint.

Expected result: Approved operations succeed, disallowed operations fail, and untested or inaccessible surfaces remain explicitly unknown.

References

2.3 Prefer Federated Agent Identity with Exact Subject Authorization

Profile Level: L2 (Walk)

Description

Where supported, replace stored keys with Tag’s documented gateway, AWS role, Google Cloud workload identity or OAuth authorization-server federation. This authenticates the channel agent, not the employee.

Rationale

Why This Matters:

  • The token issuer and some audiences are shared across customers.
  • A valid signature alone does not authorize this organization’s agent.

Attack Prevented: Cross-tenant confused-deputy access and stolen long-lived credentials.

Prerequisites

An authorized Owner or appropriately delegated administrator; approved test channels and non-sensitive fixtures. Plan-specific capabilities are called out below.

ClickOps Implementation

Open the documented Federated agent access setup and create the least-privileged connection in an unassigned bundle before selecting channels. At your gateway or authorization server validate ES256 signature using rotating JWKS, issuer, exact audience, expiry and your exact agent subject; if deliberately using an organization prefix, include its complete agent boundary. Do not infer human roles or group membership from reserved/absent claims. Keep upstream resource authorization independent. A gateway’s control/test subject must receive only readiness responses, never backend-service rights; never forward the identity token to downstream services. These connections require Anthropic-hosted channel sessions, not self-hosted environments or personal one-to-one DMs.

Automation: The inventory pack in 1.1 supplies partial evidence only. The current Tag API covers only five scope settings plus explicit bundle attachments, not these connector, identity, retention or other console/upstream-service controls. Use their documented console/service configuration and verify effective inheritance separately. See the automation-surface census in the research ledger; this is a pack coverage boundary, not a claim that vendor APIs do not exist.

Validation & Testing

Accept the intended agent and reject another tenant, wrong audience, expired token and tampered signature. Exercise key rotation without pinning one signing key. A repeated token identifier is not automatically an attack: gateway tokens may be reused across requests. Test your own revocation response and upstream token expiry.

Expected result: Approved operations succeed, disallowed operations fail, and untested or inaccessible surfaces remain explicitly unknown.

References

2.4 Prevent Federated Cloud Credentials from Expanding Authority

Profile Level: L2 (Walk)

Description

Apply least-privilege cloud IAM and token-exchange restrictions as well as federation trust. Removing a connection does not instantly invalidate all previously issued credentials.

Rationale

Why This Matters:

  • A short-lived credential can still mint another credential or authorize a destructive action.
  • AWS sessions and downstream access tokens can outlast the Tag identity token.

Attack Prevented: Credential laundering, persistence and cloud privilege escalation.

Prerequisites

An authorized Owner or appropriately delegated administrator; approved test channels and non-sensitive fixtures. Plan-specific capabilities are called out below.

ClickOps Implementation

For AWS, condition role trust on both the intended subject and audience and restrict role resources/actions; the documented connection supports commercial-partition roles, not GovCloud/China. For Google Cloud, restrict provider attributes and IAM grants and retain Block requests that mint new credentials unless a reviewed exception requires otherwise. That block is best-effort, not a substitute for IAM; the OAuth scope is broad cloud-platform. For OAuth servers, authorize the subject, issue narrowly scoped short-lived tokens and constrain allowed API hosts/paths away from the token endpoint. Include upstream revocation in containment runbooks: Tag identity tokens last ten minutes and cannot be revoked; AWS sessions last one hour, and other issued tokens follow their issuer’s expiry.

Automation: The inventory pack in 1.1 supplies partial evidence only. The current Tag API covers only five scope settings plus explicit bundle attachments, not these connector, identity, retention or other console/upstream-service controls. Use their documented console/service configuration and verify effective inheritance separately. See the automation-surface census in the research ledger; this is a pack coverage boundary, not a claim that vendor APIs do not exist.

Validation & Testing

Exercise negative IAM tests, denied credential/signature creation and denied unauthorized resources. Record maximum residual access after removal. Verify actual cloud audit events; a successful console connection check alone does not validate every downstream authorization rule.

Expected result: Approved operations succeed, disallowed operations fail, and untested or inaccessible surfaces remain explicitly unknown.

References

3. Slack Audience and Disclosure

3.1 Default External Audiences to Restricted Access

Profile Level: L1 (Crawl)

Description

Keep guest and Slack Connect channels restricted unless their explicit channel grants are approved for the external audience.

Rationale

Why This Matters:

  • Guests can read posted results even when they cannot approve tools.
  • Channel-only mode preserves directly attached channel access and is not an empty-permission sandbox.

Attack Prevented: Disclosure to guests and cross-company Slack participants.

Prerequisites

An authorized Owner or appropriately delegated administrator; approved test channels and non-sensitive fixtures. Plan-specific capabilities are called out below.

ClickOps Implementation

On the relevant scope’s Advanced → Access, keep How should Claude work in channels with guests at Restrict. For an approved exception, use Channel only, review direct bundles/connectors and channel instructions, and test the actual Slack Connect audience. In channel-only guest mode the selected custom environment does not apply; do not rely on its setup or network policy. Re-review existing channels before sharing them externally and after a guest joins. In Slack Connect, even Full access is capped at channel-only access; directly attached eligible bundles can still serve external participants. Guest channels cannot search the workspace even under Full access. Use the organization/role invocation restriction as well, but remember that blocking invocation does not prevent an external participant from reading posted results.

Automation: The inventory pack in 1.1 supplies partial evidence only. The current Tag API covers only five scope settings plus explicit bundle attachments, not these connector, identity, retention or other console/upstream-service controls. Use their documented console/service configuration and verify effective inheritance separately. See the automation-surface census in the research ledger; this is a pack coverage boundary, not a claim that vendor APIs do not exist.

Validation & Testing

Test a guest join and an external-company member with harmless data. Confirm inherited private grants are unavailable and directly attached grants expose only approved material. Test a fresh thread and the documented transition of an existing conversation.

Expected result: Approved operations succeed, disallowed operations fail, and untested or inaccessible surfaces remain explicitly unknown.

References

3.2 Limit Search and Personal-Connector Disclosure

Profile Level: L2 (Walk)

Description

Constrain workspace search and require review before personal-connector results reach shared channels. Treat result screening as advisory detection, not recipient authorization.

Rationale

Why This Matters:

  • Default public-channel search includes channels the app has not joined.
  • The requester’s personal access does not prove that every recipient may see the result.

Attack Prevented: Cross-channel disclosure and private-to-shared data leakage.

Prerequisites

An authorized Owner or appropriately delegated administrator; approved test channels and non-sensitive fixtures. Plan-specific capabilities are called out below.

ClickOps Implementation

For sensitive deployments set Channels Claude can search to Only channels Claude is in and inspect more-specific overrides. In Claude Tag → Personal connectors → Edit, Enterprise admins should enable Require human review of every message. Keep Claude Opus 5, required by the current sensitive-content checks, available and review underlying connector enablement. Team has no equivalent mandatory-review switch; document the gap or avoid sensitive personal connectors. Do not describe disabling a dedicated Tag personal-connector toggle as available when it is not.

Automation: The inventory pack in 1.1 supplies partial evidence only. The current Tag API covers only five scope settings plus explicit bundle attachments, not these connector, identity, retention or other console/upstream-service controls. Use their documented console/service configuration and verify effective inheritance separately. See the automation-surface census in the research ledger; this is a pack coverage boundary, not a claim that vendor APIs do not exist.

Validation & Testing

From a pilot channel, verify excluded public-channel content is not returned. With synthetic private data, verify the requester reviews every personal-connector result before posting. Review final recipients manually; screening does not check their source-system ACLs.

Expected result: Approved operations succeed, disallowed operations fail, and untested or inaccessible surfaces remain explicitly unknown.

References

4. Runtime and Persistent Work

4.1 Select the Runtime and Repository Boundary Deliberately

Profile Level: L2 (Walk)

Description

Distinguish Anthropic-hosted sandboxes from self-hosted runners and restrict repositories independently of ordinary network policy.

Rationale

Why This Matters:

  • Changing runtime changes connector availability and the trust boundary.
  • The GitHub proxy is a distinct authorization plane.

Attack Prevented: Unexpected code access and credential leakage through repository workflows.

Prerequisites

An authorized Owner or appropriately delegated administrator; approved test channels and non-sensitive fixtures. Plan-specific capabilities are called out below.

ClickOps Implementation

Review the environment selected on each scope and apply the appropriate Claude Code hardening guide to its runtime. In Tag’s GitHub configuration grant only required repositories and keep human review and protected branches at GitHub. Tag-managed connectors are unavailable in self-hosted sessions; do not work around this by copying personal PATs into runners. Review the GitHub App’s access separately from domain allowlists; public unauthenticated clones may still be possible. Its fixed Actions authority includes re-running/cancelling/dispatching workflows, deleting runs/logs/artifacts, enabling/disabling workflows and proposing workflow-file changes. It cannot approve held runs/deployments or send repository_dispatch; a custom GitHub token does not replace this App identity. Require two approving reviews when a person other than the requester must review bot-authored PRs, and dismiss stale approvals after new pushes. One required review alone lets the requester approve and merge the agent’s PR.

Automation: The inventory pack in 1.1 supplies partial evidence only. The current Tag API covers only five scope settings plus explicit bundle attachments, not these connector, identity, retention or other console/upstream-service controls. Use their documented console/service configuration and verify effective inheritance separately. See the automation-surface census in the research ledger; this is a pack coverage boundary, not a claim that vendor APIs do not exist.

Validation & Testing

Attempt authorized and unauthorized private-repository operations and confirm branch protections remain effective. Validate the selected runtime in a fresh thread and ensure no workflow depends on an unavailable hosted connector.

Expected result: Approved operations succeed, disallowed operations fail, and untested or inaccessible surfaces remain explicitly unknown.

References

4.2 Protect Skills, Instructions and Scheduled Work

Profile Level: L2 (Walk)

Description

Treat skills repositories, plugins, setup scripts and channel memory as executable or persistent inputs. Restrict their writers and review standing work.

Rationale

Why This Matters:

  • A channel task can persist through a schedule or stored instruction after its original request.
  • Prompt instructions do not enforce backend permissions.

Attack Prevented: Persistent prompt injection and unauthorized recurring actions.

Prerequisites

An authorized Owner or appropriately delegated administrator; approved test channels and non-sensitive fixtures. Plan-specific capabilities are called out below.

ClickOps Implementation

Review Claude’s access scope customization and delegated channel managers. Under Advanced → Sessions → Auto mode allow rules, remove broad pre-approvals and limit any exception to the exact tool, action and environment in the narrowest scope. These additive rules bypass the permission checker for named actions; retain service-side authorization. Govern permitted models with Enterprise Models → Model access, not merely Claude Code’s server-managed model allowlist: channel sessions do not receive those managed settings, and their conversational allowlist check is not consistently enforced. Verify the actual model in a new reply’s footer and inspect fallback behavior. Keep Claude Sonnet 5 available for the documented channel-session permission checker rather than bypassing it to repair model restrictions. Protect a skills repository with pull-request review and branch protection; do not let the agent approve its own changes. Review Activity → Scheduled work and Memory, pause unapproved routines, and keep high-impact actions behind service-side approval. Disable automatic responses for sensitive pilot channels when unprompted activity is not wanted. Rebuild test threads after changing startup-loaded skills/instructions; access/connection checks have different refresh semantics.

Automation: The inventory pack in 1.1 supplies partial evidence only. The current Tag API covers only five scope settings plus explicit bundle attachments, not these connector, identity, retention or other console/upstream-service controls. Use their documented console/service configuration and verify effective inheritance separately. See the automation-surface census in the research ledger; this is a pack coverage boundary, not a claim that vendor APIs do not exist.

Validation & Testing

Seed a harmless instruction-like document and confirm it cannot expand service permissions. Verify only approved skills revisions load in new sessions. Test routine pause and confirm the next scheduled run does not execute.

Expected result: Approved operations succeed, disallowed operations fail, and untested or inaccessible surfaces remain explicitly unknown.

References

5. Data Lifecycle and Operations

5.1 Approve the Actual Retention and Regulated-Data Boundary

Profile Level: L1 (Crawl)

Description

Approve Tag’s own data lifecycle before admitting regulated or retention-limited material. Do not infer retention from ordinary Claude chat policies or Slack deletion.

Rationale

Why This Matters:

  • During beta, session transcripts and memory have no automatic retention cutoff and do not inherit custom chat retention.
  • Removing Slack content does not necessarily remove its transcript copies.

Attack Prevented: Unapproved long-term retention and mistaken deletion/compliance assurances.

Prerequisites

An authorized Owner or appropriately delegated administrator; approved test channels and non-sensitive fixtures. Plan-specific capabilities are called out below.

ClickOps Implementation

Read the current Data lifecycle and healthcare documentation with the data owner. Keep PHI out: Tag is not covered by Anthropic’s BAA. Tag is unavailable with ZDR, CMEK or the specified local Code/Cowork HIPAA configuration. Document separate lifecycles for transcripts, memory, artifacts, published code and downstream records. Treat public-channel workspace memory as shared context: credential isolation is not knowledge isolation. Artifacts follow their source Slack channel audience, not an independent private share boundary. Define authorized scope/workspace deletion procedures and preserve required evidence first; turning Tag off is not deletion, and exports/Compliance API are not complete deletion tools.

Automation: The inventory pack in 1.1 supplies partial evidence only. The current Tag API covers only five scope settings plus explicit bundle attachments, not these connector, identity, retention or other console/upstream-service controls. Use their documented console/service configuration and verify effective inheritance separately. See the automation-surface census in the research ledger; this is a pack coverage boundary, not a claim that vendor APIs do not exist.

Validation & Testing

Use synthetic data to verify the planned deletion workflow and its scope. Confirm downstream copies separately. If required retention/deletion cannot be enforced, do not admit that data class or enable Tag for that workflow.

Expected result: Approved operations succeed, disallowed operations fail, and untested or inaccessible surfaces remain explicitly unknown.

References

5.2 Collect Independent Audit Trails and Cap Autonomous Spend

Profile Level: L1 (Crawl)

Description

Correlate Tag’s activity with upstream service logs and Enterprise transcripts, and bound the financial impact of autonomous work.

Rationale

Why This Matters:

  • Network events are best-effort and omit git/MCP traffic; absent records do not prove no activity.
  • Invoiced Enterprise usage has no upper bound until a spend limit is set.

Attack Prevented: Undetected service-account abuse and runaway autonomous consumption.

Prerequisites

An authorized Owner or appropriately delegated administrator; approved test channels and non-sensitive fixtures. Plan-specific capabilities are called out below.

ClickOps Implementation

Review Claude Tag → Activity for scheduled work, memory and hourly network events; centralize dedicated service-account audit logs. On Enterprise with Compliance API enabled, collect authorized session transcripts under restricted access. Configure Usage → Claude Tag monthly and per-channel limits appropriate to the pilot; include group DMs and unlinked-user DMs in the billing assessment. Separate personal-seat DM limits from channel limits. Alert on new scopes, grants, channel managers and unusual service activity.

Automation: The inventory pack in 1.1 supplies partial evidence only. The current Tag API covers only five scope settings plus explicit bundle attachments, not these connector, identity, retention or other console/upstream-service controls. Use their documented console/service configuration and verify effective inheritance separately. See the automation-surface census in the research ledger; this is a pack coverage boundary, not a claim that vendor APIs do not exist.

Validation & Testing

Trace a harmless action from Slack thread to upstream service log and, where available, transcript. Record logging gaps rather than treating the network export as exhaustive. Verify configured limits and alert ownership without deliberately generating billable runaway work.

Expected result: Approved operations succeed, disallowed operations fail, and untested or inaccessible surfaces remain explicitly unknown.

References

Compliance Mappings

These are thematic mappings, not certification evidence.

Framework Controls Application
NIST SP 800-53 AC-3, AC-6, IA-5, SC-7 Authorization, least privilege, credentials and egress
NIST SP 800-53 AU-6, SI-4, CM-6 Audit correlation, monitoring and configuration
CIS Controls 3, 5, 6, 8 Data protection, identities, access and audit logs
SOC 2 CC6.1, CC6.3, CC7.2 Logical access and operational monitoring

Operational Impact

Strict channel scopes, mandatory review and restricted network access reduce convenience and may break unapproved workflows. Federation reduces stored secrets but does not supply employee device trust or user-delegated authorization. A separate policy enforcement point is needed when upstream authorization must depend on a specific employee or device. Validate beta behavior before broad deployment; API inventory and fixture tests do not establish effective tenant security.

References

Changelog

Date Version Maturity Changes Author
2026-11-11 0.1.0 ai-drafted [SECURITY] Initial Tag-specific boundary controls, current federation guidance and guarded API/SDK inventory/containment packs. No live validation. OpenAI Codex