Claude Tag in Slack: The Enterprise IT Governance Checklist (2026)

Why This Migration Can’t Wait

Anthropic is retiring the original Claude in Slack app on August 3, 2026. If your organization is on Claude Enterprise or Team, that’s your deadline. Claude Tag is the replacement.

This isn’t a slow-burn optional upgrade. The old app stops working. You migrate or you lose Claude in Slack entirely.

The problem is that Claude Tag isn’t just the same thing with a new name. It’s a fundamentally different model: persistent memory, team-shared context, tool connections that persist beyond the conversation, and an optional “ambient” mode that lets Claude act without being @mentioned. That’s a lot of new governance surface to get right before your users start tagging.

Separately, in July 2026, a cybersecurity firm called Tego AI published research claiming Claude Tag can be triggered by automated Slack content — bots, webhooks, external feeds — potentially causing unauthorized data actions through Claude’s connected tools. Anthropic disputed the severity. The debate is still live.

Both the deadline and the security controversy deserve more than the tutorial-level coverage they’ve received so far. This is the governance guide that practitioners actually need.

What Claude Tag Does — and How It’s Different from Everything Before It

The old Claude in Slack app worked like most AI chat integrations: one user, one conversation, isolated context. Claude Tag changes all three of those assumptions.

One Claude per channel, not per user. Within a given Slack channel, there’s a single Claude instance that every channel member interacts with. Anyone can pick up where the last person left off. Anyone can see what Claude is working on. This “multiplayer” model makes it much closer to a shared team resource than a personal AI assistant.

Persistent, channel-scoped memory. Claude builds context from the channel’s conversation history and any connected data sources. You don’t explain the same project background every session. The context accumulates over time, giving Claude the kind of tacit knowledge a new employee gradually picks up — except it doesn’t quit or forget.

Asynchronous task execution. Tag @Claude with a task and walk away. It’ll work through it in stages, post progress in the thread, and notify you when it’s done. It can schedule tasks for itself and pursue work autonomously over hours or days. Anthropic uses this internally in parallel across many Claudes at once — which is how they got to 65% of their product team’s code being created by their internal Claude Tag.

Ambient Mode. When enabled per-channel (it’s off by default), Claude monitors the channel and proactively flags relevant information, follows up on quiet threads, and takes initiative without being @mentioned. This is the most powerful and the most governance-sensitive feature Claude Tag offers.

Direct messages. Users can also DM Claude privately. In DMs, Claude uses that user’s personal tools and connectors, not the channel identity. This is separate from the channel governance model.

Claude Tag runs on Claude Opus 4.8. That matters — it’s not a smaller, cheaper model running in the background. You’re getting Opus capability on everything the agent does.

The Service-Identity Problem (This Is the Part to Understand Before Deploying)

Here’s where Claude Tag’s governance model diverges from every other AI tool you’ve deployed.

Claude Tag operates under a service identity. It’s not acting as you. It’s not acting as the user who sent the message. It acts with admin-configured credentials that apply to the entire channel. That means Claude’s capability in a given channel is determined by what the admin connected to it — not by who’s currently talking to it.

The implication: any content in an authorized channel can instruct Claude. Not just your employees. Any content.

This is what Tego AI’s July 2026 research surfaced. Their finding: Claude Tag can be triggered by messages containing the literal text @Claude, even without a genuine Slack @mention — meaning automated content from bots, webhooks, or external data feeds could be interpreted as instructions. If Claude has write-access tools connected, a triggered action could retrieve internal data, publish it to the channel, or delete resources through those connections.

Anthropic’s position: under default configuration, literal @Claude text or bot-generated messages don’t initiate Claude Tag sessions. They disputed the severity.

But here’s the thing. “Default configuration” is not the same as the configuration your organization will actually run. Enterprise Slack workspaces accumulate integrations over years. Channels routinely receive automated content from Jira, GitHub, PagerDuty, Salesforce, monitoring tools, and dozens of other sources. The moment you add Ambient Mode, or grant Claude write-access MCP connections, or deploy into a channel that receives external webhook traffic, the default configuration assumptions stop applying.

The governance checklist below is built around this reality.

Claude Tag’s Built-In Enterprise Controls

Before the checklist, here’s what Anthropic actually ships — confirmed from the official launch documentation.

Control	What It Does	Default
Per-org spend limits	Monthly token cap for the entire organization	Must be set by admin before deployment
Per-channel spend limits	Monthly token cap per channel	Admin-configurable per channel
Activity audit log	Log of every @Claude action + who requested it	On — accessible to admins
Identity isolation	Separate Claude identities per channel; memories don’t cross	On by default; configured per channel
Tool/MCP access	Admin approves which tools each channel Claude can access	No tools connected by default
Ambient Mode	Claude acts without @mention	Off by default; per-channel toggle
Channel access control	Admin defines which channels Claude can join	No channels by default
Claude Compliance API	Integration with DLP, SIEM, eDiscovery tools	Available for Enterprise; must be configured

The spend controls are the most underappreciated feature here. Per-channel token limits are real: an admin can cap how many tokens the Engineering channel Claude burns per month, independently of what the Sales channel Claude uses. For large orgs with dozens of active channels, this is the only way to prevent one team’s Ambient Mode from consuming the entire organization’s monthly budget.

The Governance Checklist Before You Deploy

Work through this in order. Each section builds on the last.

Access Control

Don’t enable Claude Tag org-wide on day one. Start with one channel and expand from there.

• Select 1–2 pilot channels; restrict all others until governance review is complete
• Audit every pilot channel’s inbound automated content — list every bot, webhook, and feed that posts there
• If a channel receives external or untrusted automated content, do not deploy Claude Tag there until you understand the Tego AI risk and have mitigated it
• Review channel membership with the same rigor you’d apply to an Active Directory group — stale accounts and ex-employee access mean Claude’s actions are attributable to your organization’s credentials, even if the human who set up the channel is long gone
• Confirm Claude cannot access private channels (by design it can’t, but verify in your admin settings)

Spend Controls

Set these before anything else. Without them, a single channel running Ambient Mode on Opus 4.8 can burn through budget faster than you’d expect.

• Set a per-org monthly token limit in admin settings before enabling Claude Tag for any channel
• Set per-channel limits for any channel where Ambient Mode will be enabled
• Review token usage weekly for the first 30 days — normal usage patterns aren’t obvious until you see them

Permissions and Tool Scope

This is where the most governance debt accumulates. Be deliberate about what you connect.

• Document every MCP tool connection before enabling it — name, scope, access level, which channels it applies to
• Apply least-privilege: read-only tool access wherever possible; write/delete access requires explicit documented approval
• Create separate Claude identities for each team or use case (Sales, Engineering, Support, etc.) — a Claude scoped to sales data and tools should never be the same identity as one scoped to engineering repositories
• Treat Ambient Mode as a privileged feature: keep it off by default, require a named owner and documented use case for every channel where it’s enabled, and review it quarterly

Audit and Compliance

• Enable the Claude Compliance API (launched June 2026) and integrate with your existing DLP, SIEM, or eDiscovery tooling — this is an Enterprise feature and requires explicit setup
• Verify that your audit log exports capture MCP and GitHub tool call traffic, not just Claude’s conversational responses — Tego AI’s research identified this as a potential blind spot
• Determine whether Slack’s native audit log retention and your Claude Tag activity logs together satisfy your compliance posture; for regulated industries, document the gap analysis before deployment
• Note the data retention defaults: inputs and outputs are retained for 2 years by default; flagged content for 7 years; data is deleted within 30 days if the integration is disconnected

Offboarding and Continuity

This one gets skipped more than any other.

• Document which admin set up each Claude identity and which tool connections are active — when that person leaves, someone needs to own the audit trail
• Ambient Mode routines do not automatically stop when their creator offboards; they continue running with channel-level credentials until an admin disables them
• Define your process for deprovisioning Claude’s tool connections when employees who configured them leave the organization

Claude Tag vs Slack AI vs Microsoft Copilot: When Each Makes Sense

Most organizations using Slack are already paying for Slack AI — it’s included in Business+ at $15/user/month at no extra charge. That changes the Claude Tag evaluation question. The question isn’t “should we add AI to Slack?” It’s “is Claude Tag’s capability worth the additional cost?”

	Claude Tag	Slack AI (native)	Microsoft Copilot (Teams)
Cost	~$20/seat/mo (annual) for Claude Enterprise + API tokens billed separately	Included in Business+ ($15/user/mo) and Enterprise+	$30/user/mo add-on; $69–90/seat total depending on M365 plan
AI model	Claude Opus 4.8	Slack’s own LLM stack	GPT-series via Azure OpenAI
Memory	Channel-persistent, team-shared	Per-query context	Per-user, Microsoft Graph-scoped
Async tasks	Yes — hours or days	No	Limited
Ambient mode	Yes (opt-in per channel)	No	No
Identity isolation	Per-channel; admin-scoped	Workspace-level	Tenant-level via Purview/Entra
Audit logging	Activity log per action + Claude Compliance API	Slack audit logs	Microsoft Purview stack
Platform required	Slack	Slack	Microsoft Teams
Best for	Complex multi-step tasks, code, cross-functional async work	Search, summaries, quick answers, workflow automation	M365-centric orgs with document-heavy work

Slack AI is good. It’s better than it gets credit for, especially for channel summarization and enterprise search across integrated apps. If your team’s primary AI Slack use case is “catch me up on this channel” and “find that document,” Slack AI does the job at no additional cost.

Claude Tag earns its uplift when teams are delegating multi-step work — research tasks, code generation, investigation workflows, analysis that takes hours rather than seconds. The persistent memory model means teams stop re-explaining context. The async model means Claude works while humans focus elsewhere.

Microsoft Copilot is effectively out of scope for Slack-primary orgs. At $69–90/seat all-in, it only makes sense for organizations where Teams is the collaboration layer and Microsoft 365 is the primary workflow platform. If you’re reading this, that probably isn’t you.

The Salesforce Angle: Running Claude Tag Alongside Agentforce

Salesforce’s Summer ‘26 release made Slack the default collaboration tool for all new Enterprise and Unlimited edition orgs. Every new Salesforce Enterprise customer now has a Slack workspace.

That means if you’re a Salesforce shop deploying Claude Tag, you’re likely running two credentialed AI agents in the same Slack workspace: Claude Tag (general purpose, Anthropic-powered) and Agentforce agents embedded in Slack (CRM-workflow specific, Salesforce-powered).

Both can respond to Slack messages. Both have tool access. Both maintain context. Without an explicit policy, your users will start routing work to whichever agent is most familiar to them — which means neither agent is being governed correctly, and your IT team has no clear ownership of the boundary.

The right policy is straightforward: Claude Tag handles general-purpose work (code, research, analysis, cross-functional tasks that don’t require Salesforce data). Agentforce-in-Slack handles CRM-workflow execution (opportunity updates, case routing, quote approvals, anything that writes to Salesforce objects).

Define the boundary in writing. Communicate it to users before either agent is broadly deployed. Otherwise you’ll spend the next quarter fielding support tickets about which Claude gave conflicting answers on a deal.

Pricing Reality

Claude Tag pricing runs through your Claude Enterprise or Team subscription.

Component	Cost
Claude Enterprise	Custom pricing (typically $40–60/seat/month for mid-market orgs)
Claude Team	Starts at ~$25/seat/month (annual, minimum 5 seats)
API token consumption	Opus 4.8: $5/million input tokens, $25/million output tokens
Launch credits	Anthropic is offering migration credits for eligible Enterprise and Team orgs — check admin settings

The token consumption piece is the hidden cost variable. A single Ambient Mode channel running Opus 4.8 against active engineering discussions can consume tens of thousands of tokens per day. Set per-channel spend limits before enabling Ambient Mode anywhere. Without a cap, you’ll get a bill surprise before you get a usage report.

Slack AI, by contrast, has no per-token usage cost — it’s bundled pricing. For orgs where cost predictability matters more than capability ceiling, that’s a real consideration.

Recommended Deployment Path

Phase 1: Controlled Pilot (Weeks 1–2)

• Select one channel — ideally a non-critical team with high tolerance for experimentation
• Connect read-only tools only; no write or delete permissions in any connected system
• Ambient Mode: off
• Set per-org and per-channel spend limits before enabling Claude for any user
• Designate a single admin owner who will be accountable for the identity and its connections

Phase 2: Governance Review (End of Week 2)

Before expanding to additional channels:

• Review the activity audit log: is everything Claude did expected and attributable?
• Confirm MCP traffic is captured in your audit exports (or document the gap)
• Verify spend stayed within limits; review if limits need adjustment for expanded deployment
• Run Tego AI’s scenario: does your channel configuration expose you to the automated-content trigger risk? Apply mitigations if needed.

Phase 3: Expand (Week 3 onward)

• Each new channel gets its own Claude identity with documented tool scope
• Each Ambient Mode enablement requires a named owner and documented use case
• Quarterly review: deactivate unused identities, audit tool connections, verify admin ownership is still current

Bottom Line

Claude Tag is worth deploying. The 65% code creation stat from Anthropic’s own team isn’t marketing — it’s a proof point for what persistent memory and async task execution do to team throughput when the agent is set up right.

But it’s not a chatbot you install and forget. It’s closer to a service account with model-grade reasoning. The governance model that works for Microsoft Copilot or Slack AI — workspace-level controls, occasional audit log check — isn’t sufficient for an agent that maintains channel memory, executes tasks asynchronously, and can act in Ambient Mode without being @mentioned.

The Tego AI finding is a real signal even if the exact exploit is disputed. “Default configuration is safe” is a statement about Anthropic’s test environment. Your environment has automated feeds, legacy bots, external integrations, and edge cases that Anthropic didn’t test for. Build the governance checklist into your deployment, not your incident retrospective.

Migration deadline is August 3. That’s enough time to run a clean Phase 1 pilot, complete the governance review, and expand thoughtfully before the old app goes dark. Start in the next 7 days. Set spend limits first. Document every tool connection before you enable it. Treat each channel identity like a service account. Everything else follows from those three practices.

Rating: 4.3 / 5 for enterprise teams with complex, async, multi-step work needs running Slack as their primary collaboration layer. 2.8 / 5 for orgs where “AI in Slack” means summarization and quick answers — Slack AI covers that use case at no extra cost.

Related Articles

• Grok CLI Uploaded User Files to xAI’s Servers: What Enterprise IT Must Do Now
• Agentforce Coworker: Hands-On Look at Salesforce’s New AI Teammate (Beta Review)
• Salesforce Einstein AI: What It Actually Does (And What It Doesn’t)
• AI Governance Framework for IT Teams
• Salesforce Acquires Fin: What Enterprise IT Teams Need to Know About the $3.6B Agentforce Bet