On October 20, 2026, Anthropic released the Claude Tag API in beta. Enterprise administrators can now collect and change Slack channel settings from their own systems. The release makes a recurring access review easier to automate, but the export is only part of the evidence needed to approve a channel.
Before approving a channel, establish which sensitive services Claude can use there and who can ask it to act. That requires checking effective settings and inherited access, then accounting for work already running there.
This guide proposes a review procedure from Anthropic's documented behavior. General Analysis has not tested the beta against a live Enterprise tenant.
Collect effective settings with a read-only key#
The API reference requires a Claude Enterprise organization with Slack connected. Have its Primary Owner create an organization-level Admin API key in claude.ai with read:claude_tag. A Claude Console key does not work. Keep configuration writes in a separate workflow.
Request include_inherited=true and retain sources alongside settings. Otherwise, a channel's unset value can be mistaken for the value it actually uses. The channel list covers configured records, so reconcile it with your authorized Slack inventory. Follow next_page until null, even after an empty page.
Code source: Anthropic's Claude Tag API, adapted for one read-only page of effective channel settings.
curl --fail-with-body -sS -G \
"https://api.anthropic.com/v1/organizations/claude_tag/slack_channels" \
-H "x-api-key: ${CLAUDE_TAG_READ_KEY}" \
-H "anthropic-version: 2023-06-01" \
-H "anthropic-beta: experimental-claude-tag-2026-10-21" \
--data-urlencode "slack_workspace_id=${SLACK_WORKSPACE_ID}" \
--data-urlencode "include_inherited=true" \
--data-urlencode "limit=100"
Supply Slack's workspace ID, such as T01ABCD2EFG, for that query parameter. The example retrieves one page; it is not a complete collector. Preserve the same filters when passing the returned cursor as page.
Save collection times and failures with the export. An interrupted run should leave the last completed review intact and mark the new attempt incomplete. Restrict access to raw responses because instructions can contain internal context. Our Claude Compliance API guide covers the separate activity and content evidence streams.
See how your AI systems hold up under real attacks
General Analysis maps AI applications and agents, red teams prompts, retrieval, tools, MCP servers, browser actions, permissions, and business workflows, then turns findings into evidence your team can reproduce and retest.
Reconcile the access the export leaves out#
The API omits bundle contents, attachment conditions, default-scope targets, and channel-pattern grants. Treat its attachment list as a partial map. In the admin guide, Anthropic directs reviewers to a channel's Claude's access table for resolved shared access and its inheritance. Members' personal connectors require separate review.
For each sensitive channel, collect the following evidence. These are proposed review requirements, not fields in an API response.
| Review question | Evidence to retain |
|---|---|
| Who can invoke Claude here? | Member-access policy and the channel's membership and sharing state |
| Which shared services can it reach? | The resolved Claude's access table, including each grant's origin |
| What does a bundle authorize? | Its actual connections, repositories, and permitted operations; a display name is insufficient |
| Which actions have standing approval? | Applicable Auto mode allow rules, including inherited rules |
| What work predates the change? | Existing threads, routines, and the environment each relevant session started with |
Suppose a team removes an incident-response bundle from #inc-payments and sees no direct attachment in its export. That is a useful observation, but it leaves a question: does the same access arrive through the workspace, Slack defaults, or a rule matching inc-*?
Anthropic's per-channel access documentation describes additive bundle access and channel-name rules. Removing a channel attachment leaves broader grants in place. In this hypothetical review, record the source of the remaining access and change that source if the business decision requires removal. Repeatedly deleting the direct attachment cannot resolve an inherited grant.
Review the audience before approving the result. The same documentation explains that a bundle attached to a public channel makes its access available to people who join. A private channel shared externally also needs an explicit audience review. Channel privacy alone is an inadequate approval criterion.
Check action approval separately from service access#
Service access does not tell you whether a deployment needs fresh approval. Anthropic's customization guide says Auto mode allow rules let named actions proceed without the permission checker stopping them. Rules on broader scopes carry down; channel rules add to them.
Inspect the Slack, workspace, and channel rules together. If a rule authorizes deployments, record the destination and operation it permits. A channel-specific rule for staging is easier to review than a general instruction permitting deployments throughout a workspace. Have the service owner confirm whether the connector's own authority matches that boundary.
Keep ordinary instructions out of the role of access enforcement. An instruction saying to avoid production does not remove a production credential. The same customization guide places credentials in connectors, outside the sandbox, and warns against putting them in environment variables where sessions can read them. Review the environment configuration as well as the visible bundle names.
For the broader problem of untrusted content reaching privileged tools, see our MCP server security guide.
Verify the change in a new thread, then account for existing work#
Anthropic's access documentation says bundle changes take full effect in new threads. Existing threads retain their starting skills, plugins, and custom instructions. The environment documentation likewise says an existing thread keeps its starting environment.
Use a fresh thread for a harmless acceptance check after a change. Choose a test service and dummy record, confirm the intended access, and retain the service's own log. Record the effective settings and resolved access used for that check. This is a proposed test plan; a successful API read is not a test result.
Then identify older work that could still matter. Do not treat the new thread's result as evidence that every prior session has the same context. For urgent removal of a sensitive capability, involve the downstream service owner and verify revocation there rather than relying solely on a changed attachment list.
Give the channel owner the resolved grants, approved audience, standing approvals, and disposition of existing work. If only the API collection is complete, say so in the review record. Keep the access decision open until the missing evidence has an owner and a result.
