What Is Claude Tag's Agent Identity? (And Why It Replaces Your Personal Login)
Agent identity means Claude Tag acts under its own admin-provisioned service accounts — not your login. In a Slack channel it posts as the Claude app, opens PRs as the Claude GitHub App, and queries data under a service account, so every action is attributable to the agent, scoped per channel, and billed to your organization.
For Claude Team & Enterprise · Beta · Official + media-reported
Old Claude in Slack vs Claude Tag — what changed about identity
The old Claude in Slack app borrowed your access for the length of a request — its actions were indistinguishable from yours. Claude Tag flips that: the agent gets its own identity. Here's the side-by-side.
Old "Claude in Slack"
- Acts as👤 You
- CredentialsYour login / personal tokens
- GitHub PRsYour name
- BillingYour seat
- PermissionsYours, inherited per user
- ContinuityBreaks when you log off / leave
Claude Tag
- Acts as🤖 Org agent identity
- CredentialsAdmin-provisioned service accounts
- GitHub PRsClaude GitHub App author
- BillingYour organization
- PermissionsGranted per channel by an admin
- ContinuityLives with the channel & org
What is agent identity, in one minute?
Agent identity is the design choice to give Claude its own accounts in every tool it touches, instead of borrowing a human's. An admin provisions service accounts — the Claude Slack app, the Claude GitHub App, a warehouse account — and Claude acts as those, scoped to the channels and tools the admin allows.
Think of it as a badge. The old app borrowed your badge for each request, so its activity looked exactly like yours and couldn't be told apart in any log. Claude Tag gives the agent its own badge. That separation isn't cosmetic — you can't govern what you can't distinguish from a real user, and a distinct identity is what finally makes that possible.
OfficialThis is the core idea in Anthropic's agent-identity access model. [Official]
Personal login vs agent identity — why the shift matters
Under personal-login AI, the assistant inherited whatever the user could reach, billed to that user, and its actions were attributed to a person. Agent identity decouples all three: the agent has its own scoped access, the org is billed, and actions are attributed to the agent — with a record of who requested them.
Who does @Claude act as? (channel vs DM)
The single most common confusion: when @Claude does something, whose account is it? Pick where you're talking to it and what it's doing — we'll show who it acts as, how it's attributed, who's billed, and how it's logged.
Pick where & what:
Where?
Doing what?
Select where and what
to see the identity result.
MediaChannel vs DM identity behavior is media-reported and consistent across coverage. [Media]
How agent identity works — service accounts & Agent Proxy
When an admin connects a tool, the credential isn't stored in Claude's "brain." It's held behind a component called Agent Proxy, which injects it at the network boundary only when Claude makes a request, and checks it against an allow-list. The model and sandbox never see the raw key.
- credential store — raw keys never reach the model or sandbox
- injected at the network boundary, only when needed
- default-deny — non-allowlisted hosts are blocked
- logged twice — Anthropic's systems + the tool's native audit
Two properties matter. First, default-deny: if Claude tries to call an API you didn't approve, it's blocked before the model even sees the credential. Second, double logging: every action lands both in Anthropic's logs and in the connected tool's own audit trail — so your GitHub admins still see a PR from the "Claude GitHub App," traceable end to end.
MediaAgent Proxy mechanics are media-reported (gadgetbond, Mervin) consistent with Anthropic's access-model description. [Media]
Per-channel identities & memory isolation
Identity is scoped to the channel. Private channels get distinct identities; public channels share a workspace-level one. A Claude set up for sales has no access to engineering data and can't seed its memories into another channel. What Claude learns in one channel stays there unless an admin explicitly connects them.
This is the answer to the oldest enterprise objection to shared AI — cross-context leakage. Because the channel is the boundary, "what Claude can reach" and "what Claude remembers" are both fenced by scope, not by trust in a single shared brain. Configure those fences per channel.
What agent identity means for you
Three practical wins fall out of one design choice. If you've ever fought messy AI audit trails, orphaned tasks, or tangled offboarding, this is the part that pays off.
Audit trails that make sense
Every action is attributed to the agent plus the user who requested it — not to "whoever was online." A GitHub PR even links back to the Slack thread that triggered it.
Tasks don't break when someone leaves
Because access and ownership live with the channel and org, a person logging off — or leaving the company — doesn't strand in-flight work or revoke the agent's access by accident.
One switch to revoke everything
To cut off the agent, disable its identity. You don't have to unwind permissions across a dozen user accounts — the access was never tied to them.
MediaGovernance benefits are media-reported (Unosecur, HelpNetSecurity). [Media]
What's still missing — the honest limits
Agent identity is a real improvement, not a finished story. Today, access is channel-level, not per-user: if you can post in a channel, you can use every tool connected there. And the cross-channel ambient audit trail is still maturing. Design around what exists now, not what's promised.
Anthropic has signaled identity-aware access controls — where an action would require both the channel's permissions and the requesting user's access rights to allow it. That would close the per-user gap. It's planned, not current, so don't assume per-user enforcement when you scope sensitive channels.
Agent identity glossary
- Agent identity
- The model where Claude acts under its own admin-provisioned accounts, scoped per channel, rather than borrowing a user's login.
- Service account
- A non-human account (Claude Slack app, Claude GitHub App, a warehouse account) the agent uses to act in a tool; no personal credentials involved.
- Agent Proxy
- The component that stores credentials and injects them at the network boundary only when needed, with default-deny on outbound hosts.
- Access bundle
- The named set of credentials, tool grants, and instructions Claude uses in the channels it covers (configured on the permissions page).
- Workspace vs private-channel identity
- Public channels share a workspace-level identity; private channels get distinct, isolated ones.
Claude Tag agent identity FAQ
What is agent identity in Claude Tag?
It's the model where Claude acts under its own admin-provisioned service accounts in a channel — not your login — so actions are attributable to the agent, scoped per channel, and billed to your organization.
How is it different from the old Claude in Slack app?
The old app acted as you, using your login and permissions, billed to your seat. Agent identity gives Claude its own accounts, org billing, and continuity that survives you logging off or leaving.
When @Claude opens a PR, whose account is it?
The Claude GitHub App's — a service account, not yours. The PR even links back to the Slack thread that triggered it.
Is a DM to Claude the same identity?
No. In a DM, Claude runs under your personal claude.ai account and your connectors. In a channel it uses the org's service accounts.
Where are the tool credentials stored?
Behind Agent Proxy, in a credential store. Raw keys never reach the model or sandbox; they're injected at the network boundary only when a request needs them.
Can the agent reach systems we didn't approve?
No — Agent Proxy is default-deny. Outbound traffic to any host an admin hasn't explicitly allowed is blocked.
Can we audit what the agent did?
Yes. Every action is logged in Anthropic's systems and in each tool's native audit trail, along with the user who requested it.
What happens when the person who started a task leaves?
The task doesn't break — access and ownership live with the channel and the org, not the individual.
How do we revoke the agent's access?
Disable its identity to revoke everything at once, instead of unwinding privileges across many user accounts.
Does each channel have its own identity?
Private channels get distinct identities; public channels share a workspace-level one. Memory stays isolated to its scope.
Will it ever check the requesting user's permissions too?
Anthropic has signaled identity-aware access controls — where both the channel's and the user's permissions must allow an action — as planned, not current.
Is this page official?
No — independent guide with sources. See Anthropic's agent-identity blog for the primary source, and verify in your admin console.
Keep a record of who @Claude acts as
Agent identity is easy to lose track of across channels. The Rollout Command Center logs who @Claude acts as in every channel — identity, owner, and access scope — instead of you holding it all in your head.
Pre-filled and ready the second you duplicate it: a channel tracker with risk flags, a live credit runway, a 4-week plan, 12 ready prompts, and a boss-ready one-pager.
- Per-channel identity & owner log
- Access scope + risk flags
- Live credits burn bar + runway
- 4-week rollout timeline
One-time $7 · pre-filled · 14-day refund. Independent template, not affiliated with Anthropic.
Get concept & beta updates
Claude Tag is in beta and the identity model is still evolving — including planned identity-aware access controls. We'll email you when the model changes in ways that affect how you govern it. No spam, unsubscribe anytime.
Sources & how we keep this accurate
The definition of agent identity is from Anthropic's official announcement and its agent-identity access-model blog. Mechanism details — Agent Proxy, channel vs DM identity, per-channel isolation, audit — are from those sources plus hands-on coverage, and may change during the beta. Last verified June 26, 2026.
- Anthropic — Introducing Claude Tag & Agent identity: a new access model (official)
- gadgetbond, Mervin, aiandapi, DataCamp, HelpNetSecurity, TheRouter.ai — identity-model coverage (Jun 2026)
- Unosecur — non-human identity governance perspective (Jun 2026)
We are not affiliated with Anthropic or Slack. Always verify the current model in your Claude admin console.