Claude Tag API: govern Slack agents as code

Anthropic released the Claude Tag API in beta on October 23, 2026 for Claude Enterprise organizations. It lets an organization read and change how Claude Tag behaves in Slack channels and workspaces, inspect which settings apply and where they were inherited from, and attach Access bundles. The useful production interpretation is not “another Slack bot API.” It is a control plane for an agent that can answer inside team conversations and may receive access to connectors, repositories and credentials.

The API can support approval workflows, configuration-as-code and continuous access audits. It does not connect Slack, create or edit Access bundles, manage every Claude Tag setting, or replace the human and policy work required to decide which channels should have which capabilities. Teams should model desired state, resolve inheritance explicitly, protect scoped Admin API keys, treat guest presence as a change in trust boundary, and reconcile the API’s state against Slack and their own approval system.

The release date, endpoint behavior, scopes, identifiers and documented limits below are Anthropic facts. The desired-state controller, risk tiers, rollout gates, audit model and recovery plan are engineering recommendations.

What Claude Tag and its API manage

Claude Tag is Claude working as a teammate in Slack: a person mentions Claude in a channel and Claude answers in the thread. Anthropic documents 14 beta endpoints across four resources:

• Slack channels: set up, list, find, read, update and remove;
• Slack workspaces: list, find, read and update;
• Access bundles: list and read;
• Bundle targets: list, attach, read and detach.

The API manages five optional settings at channel and workspace levels: enabled, instructions, model, environment_id and guest_policy. It can also show inherited values and the source of each effective value. Requests require an organization-scoped Admin API key with read:claude_tag or write:claude_tag, the normal Anthropic version header and the experimental-claude-tag-2026-10-21 beta header.

This boundary matters. Anthropic says this is a claude.ai Enterprise capability, not a Claude Platform workspace or inference API feature. Connecting or disconnecting Slack, changing organization-wide Slack defaults, creating or editing bundles, spend limits and settings outside the documented five remain in claude.ai.

Start with an authorization matrix

Do not begin by enabling Claude in every channel and cleaning up later. Classify the channel, its participants, the data it contains and the actions attached bundles can perform.

The matrix is an application policy, not an Anthropic default. Record the owner, business purpose, data classification, allowed model, approved environment, allowed bundles, guest behavior and expiry date for every exception.

Model desired state, effective state and evidence separately

A safe controller needs three views:

1. desired state: what an approved policy declares for a Slack workspace and channel;
2. observed state: what the Claude Tag API stores directly on that resource;
3. effective state: what applies after workspace and Slack-default inheritance.

Do not compare desired state only with an include_inherited response. That can hide where a value came from. Read stored settings without inheritance for drift correction, then read with include_inherited=true to verify the user-visible outcome and sources.

Instructions are especially important: Anthropic documents that channel instructions add to inherited instructions rather than replacing them. A channel can therefore carry a safe local sentence while inheriting a broad workspace rule that changes the resulting behavior. Persist the effective instruction chain or its hashes in audit evidence, not only the channel’s local text.

The model and environment are validated when written but are not continually revalidated. If a model or environment later changes, the stored value remains. A reconciliation job should therefore check both the string stored by Claude Tag and the current catalog or environment status in the organization.

Use stable identities without confusing Slack IDs

The API exposes its own resource IDs such as slch_, slws_, capp_ and btgt_. Slack uses channel IDs beginning with C or G and workspace IDs beginning with T or E. Query parameters used to find a resource take Slack’s IDs; most API response and request-body relationships use Claude Tag resource IDs.

Resolve and store both. A practical record looks like this:

{
  "slack_workspace_id": "T01ABCD2EFG",
  "slack_channel_id": "C05HJKL6MNP",
  "claude_workspace_id": "slws_...",
  "claude_channel_id": "slch_...",
  "policy_version": "claude-tag-prod-v3",
  "approved_bundles": ["capp_..."],
  "expires_at": "2026-12-31T23:59:59Z"
}

Anthropic notes that removing and later setting up a channel creates a new slch_ ID; the old one returns 404. Treat a clean 404 on a previously valid resource as a possible lifecycle change, re-resolve it using Slack’s IDs, and require approval before reapplying access. Do not blindly recreate a privileged channel from a stale database row.

Protect the administrative path

Separate observation from mutation. Use a read-only key for inventory, drift detection and dashboards. Keep the write key in a dedicated deployment identity used only by the reconciler or an approval job. Anthropic states that these organization keys continue working after the person who created them leaves, so offboarding the creator is not key rotation.

Controls should include:

• a secrets manager rather than repository or CI plaintext;
• explicit read:claude_tag and write:claude_tag separation;
• short operational access sessions for humans;
• outbound network restriction to the Anthropic API;
• request IDs, actor identity, approval reference and before/after hashes in logs;
• scheduled rotation and emergency revocation tests;
• alerting on mutations that did not originate from the reconciler or approved owner workflow.

Do not print instructions, credentials or bundle relationships into low-trust logs. Bundle metadata does not reveal the underlying grants, so maintain an internal catalog that maps each bundle to its owner, risk tier, review date and intended data systems without copying secrets.

Treat Access bundles as capabilities

An Access bundle is a named set of access—connectors, repositories and credentials—that Claude can use. Attaching one to a workspace can expose it across every channel in that workspace; attaching it to a channel narrows that scope. This makes bundle attachment an authorization decision, not a cosmetic configuration change.

Prefer channel-level attachment for sensitive tools. Give each bundle one coherent purpose and separate read from write capabilities. For example, documentation search, issue lookup and deployment execution should not live in one “engineering” bundle. A channel that needs the first two should not inherit the third.

Attaching the same bundle-target pair is idempotent according to Anthropic: the API returns the existing target. Use that property in reconciliation, but still verify the returned target type and IDs. The API lists targets by bundle; it does not provide a complete “all bundles effective in this channel” endpoint, and rules or defaults can grant more than direct targets reveal. Build the audit by reading bundles, targets, settings sources and your organization’s defaults together.

Make guest presence a policy event

Slack guest accounts and Slack Connect participants represent external trust boundaries. Claude Tag supports allow, restrict and channel_only guest policies. With channel_only, Claude can answer using only bundles attached directly to the channel; restrict stops it from answering while guests are present.

Choose restrict as the safe default where uncertainty is unacceptable. Channel-only is useful only when every directly attached bundle was reviewed for external participants and when instructions prevent disclosure of internal context. Do not assume the policy changes the historical messages, files or human permissions already present in Slack.

Your audit should flag:

• enabled channels with allow and external participants;
• workspace-level bundles reaching a shared channel;
• a channel-only policy with no documented bundle review;
• a guest-policy change without external-collaboration approval;
• channels whose participant type changed after approval.

Slack remains the source of truth for the full channel and participant inventory. Anthropic says the Claude Tag API lists only set-up channels, not every Slack channel. Reconcile the two systems rather than treating a short Claude Tag list as proof that the Slack workspace is clean.

Build an approval-driven reconciliation loop

A production loop can run in this order:

1. import approved desired state from a signed configuration or policy database;
2. list workspaces and every page of set-up channels;
3. read stored settings and effective settings with sources;
4. inventory bundles and every bundle target page;
5. join Slack channel ownership and participant facts;
6. calculate a plan that separates safe additions, risky expansions and removals;
7. require approval for new access, write bundles, guest-policy weakening or scope expansion;
8. apply bounded idempotent changes;
9. read back effective state and attach evidence to the change record;
10. alert and roll back when the final state differs from the approved plan.

Pagination is not optional. Anthropic warns that a page can contain fewer items than the requested limit while next_page is still set. Continue until next_page is null. A controller that stops on a short page can silently miss channels or bundle targets.

Use optimistic safeguards in your own layer: hash the observed resource before approval and re-read it immediately before mutation. If it changed, discard the plan and calculate again. The API documentation does not describe an ETag or compare-and-swap contract for these changes, so application-side read-before-write and read-back verification are essential engineering controls.

Rollout and rollback

Start with a read-only inventory. Then run drift evaluation without writes. Pilot one low-risk workspace and a small channel cohort. Enable Claude only after the intended bundles are attached, so the first session does not start with an incomplete access policy.

For rollback, keep the previous desired-state version and the exact before state. Prefer disabling the channel and detaching a risky bundle over deleting the channel record. Anthropic documents that channel removal is destructive: it removes stored settings, bundle targets, sessions and transcripts, memory, routines and published artifacts, and normally requires Claude to be disabled first. A DELETE call is therefore not routine drift correction.

Test failure cases: expired or revoked key, 403 scope failure, 404 after channel recreation, 400 for a Slack ID in the wrong field, 503 while inherited levels cannot be read, partial pagination, bundle attachment blocked by on-call management, and an environment that became inactive after being stored.

Best practices

• Keep a read-only inventory key and a separately protected write key.
• Resolve Slack IDs to Claude Tag resource IDs and retain both.
• Compare stored and effective settings; preserve the source of inheritance.
• Attach sensitive bundles at channel scope and separate read from write.
• Default guest and Slack Connect channels to restrict.
• Reconcile Slack’s full inventory with Claude Tag’s set-up resources.
• Fetch every pagination page until next_page is null.
• Read back effective state after every mutation.
• Time-bound privileged exceptions and rehearse revocation.
• Treat channel removal as destructive retention work requiring explicit approval.

Anti-patterns

• One workspace-wide bundle containing every connector and credential.
• Storing an Admin API key in source control or a shared shell profile.
• Assuming user offboarding revokes the key they created.
• Comparing only inherited output and losing the origin of a setting.
• Treating the list of set-up channels as the complete Slack inventory.
• Enabling Claude before the approved bundles and guest policy are in place.
• Reusing a stale slch_ ID after channel removal and recreation.
• Stopping pagination when a page is shorter than limit.
• Using DELETE to “reset” drift without understanding the retained-data impact.

Limitations

The API is beta and requires an experimental header, so contracts and availability can change. It is limited to Claude Enterprise and Slack. It does not manage organization defaults, connect Slack, create bundles, expose bundle grants, list all effective bundles for one channel or control every Claude Tag setting. Some self-hosted runner-pool environments cannot be changed through the API. Group direct messages have additional restrictions. The API also cannot decide whether a business approval is valid or a bundle is appropriately scoped.

Those limits are a reason to design a narrow controller, not to avoid automation. Use the API as one evidence source and one controlled mutation surface inside a larger governance process.

Executive takeaway

Claude Tag API turns part of Slack agent administration into an auditable interface. The durable design is a desired-state controller with scoped keys, explicit inheritance, channel-level capabilities, guest-aware policy, complete pagination, human approval for scope expansion and read-back verification. Treat bundles as privileges and deletion as destructive. The goal is not maximum deployment speed; it is proving which Claude instance can use which capability in which channel, under which approval.

Continue with the AI, RAG and vector search hub, Applied AI service, Anthropic API 2026-10-21 migration guide, Anthropic User Profiles safety architecture and secure RAG ingestion guide.

Primary references

• Anthropic — Claude Platform release notes, October 23, 2026
• Anthropic — Claude Tag API
• Anthropic — Admin API
• Slack — Understand guest roles
• Slack — Slack Connect security and administration guide
• Wikimedia Commons — Slack HQ photograph.jpg)
• Creative Commons Attribution-ShareAlike 2.0

Prepared by: Noor Yasser

Prepared by: Noor Yasser