## Someone Just Tagged @Claude Where They Used to Tag You

A junior developer used to be the person you @mentioned in Slack when a pull request needed opening. In June 2026, Anthropic released Claude Tag, and that mention started going to an AI instead. The obvious headline writes itself: another productivity tool or copilot integration. That framing misses the actual story.

Claude Tag is not a chatbot bolted onto Slack. It is a persistent agent. It has a distinct identity and memory. Its permissions are scoped to the channel it lives in, rather than to you. That single design choice inverts basic assumptions about enterprise software security and pricing. It also breaks how junior people learn their jobs. Most coverage stops at "Claude can now open PRs." The structural rewrite holds the real consequences.

The load-bearing idea here is **Channel-as-Perimeter**. A casual chat channel stops being an organizational convenience. It becomes a strict identity and access boundary with heavy security weight. Anthropic built a teammate. They quietly turned your `#eng-backend` channel into something closer to an Active Directory group. Almost no one treats it that way yet.

## Why Channel-Scoped Identity Is the Whole Story

The headline change is the identity model, not the chat surface. Earlier Claude integrations ran under your personal permissions. Claude Tag gives the whole organization a single shared Claude acting under an org-level identity, scoped per channel.[^1] An admin grants it access to specific channels and connects approved tools. They also set spending limits and define what the agent can touch.[^2] You are no longer opening a tool. You are talking to a colleague who is already in the room.

As AI Builder Club noted in their teardown, "the unit is the channel, not the user." That explains why it behaves like a teammate instead of an app.[^3] Within a given channel, one Claude interacts with everyone. Anyone can see what it is working on and pick up where the last person left off.[^4]



![a single name badge clipped to a shared office door rather than to any one person's lapel](https://storage.googleapis.com/sol-assets-secondorderlabs/.assets/images/articles/claude-tag-proves-enterprise-ai-is-not-a-chatbot-but-an-ambient-team-member/illustrations/visual-1.webp)
*Claude Tag's identity belongs to the channel, not to whoever typed the message.*



The consequence is subtle and large. Microsoft Copilot is wired into Microsoft Graph and operates under per-user identity inside M365 tools.[^5] Copilot answers as *you*, with your access. Claude Tag answers as the *channel*, with the channel's access. For cross-functional, asynchronous work, the channel model is more powerful. The AI sees the shared context of how the whole group operates. But it severs the link between the human asking and the permissions granted. That severance breaks everything else.

## Channel-as-Perimeter Turns Casual Chat Into a Security Boundary

Slack channel membership was never designed to be a permission system. People get added casually or invited as a courtesy, and are often left in channels long after projects end. Claude Tag forces this loose social construct to act as a rigid IAM boundary. The agent inherits the channel's access and hands it to everyone in the room.

> The agent doesn't ask who you are before it acts on your behalf, and that's not a bug, it's the entire architecture.

This is a textbook confused deputy problem. A privileged entity misuses its privileges on behalf of a less-privileged one. A user with no rights to a system can ask the channel's Claude, which does have rights, to act on their behalf. As PromptQL framed it, agent identity means "either the AI is useless or is a confused deputy security risk waiting to blow."[^6] Guardbase's security analysis was sharper: Claude Tag separates Claude's identity from users, "but it becomes a confused deputy problem because nobody treats Slack channel membership like a permission boundary."[^7]

| | User-scoped (Copilot) | Channel-scoped (Claude Tag) |
|---|---|---|
| Access boundary | The individual | The shared channel |
| Inherits permissions from | Microsoft Graph identity | Admin-configured channel tools |
| Confused deputy risk | Low | High |
| Best fit | Personal M365 tasks | Cross-functional async work |
| Audit unit | User identity | Channel membership |

The practical fix is unglamorous. Security teams must audit Slack channel rosters with the exact rigor they apply to directory groups. A stale member in `#finance-ops` is no longer minor housekeeping. That person can borrow the agent's credentials. The Hacker News critique lands the dilemma cleanly: Claude's permissions "will never align with the members of a Slack channel," so finding the lowest common denominator of access "probably results in a dumbed-down, useless experience."[^8] You can have a capable agent or a safe one. Reconciling the two is an operational job that did not exist before this launch.

## Ambient AI Is the Feature That Makes the Risk Worse

The security story compounds because Claude Tag does not wait to be asked. With ambient behavior enabled, Claude proactively flags information across channels and follows up on threads that have gone quiet without being resolved.[^9] That is an automated project manager running in the background. It is genuinely useful and a standing source of channel noise. Anthropic clearly knows this. Ambient mode ships off by default, alongside spend controls and the per-channel identity.[^10] That default is a confession. A proactive agent in a shared room becomes disruptive fast.



![a lamp left glowing in an empty conference room long after everyone has gone home](https://storage.googleapis.com/sol-assets-secondorderlabs/.assets/images/articles/claude-tag-proves-enterprise-ai-is-not-a-chatbot-but-an-ambient-team-member/illustrations/visual-2.webp)
*Ambient mode keeps the agent watching quiet threads, which is both its value and its noise problem.*



The shift from reactive prompt-response to proactive monitoring separates a tool from a teammate. It also means the confused deputy is no longer waiting for a trigger. It is awake and watching, fully capable of initiating action. There is a quieter cost alongside the security one. When the always-on agent follows up on stalled tasks and answers routine questions, the junior colleague who used to do that nudging gets bypassed. Call it **mentorship hollowing**. The public delegation that taught newer employees how work actually flows now routes to an AI. The throughput gain is real. So is the erosion of the apprenticeship loop that produced the next senior engineer.

## How Claude Tag Breaks the Per-Seat Pricing Model

For two years the enterprise pitch was simple: every knowledge worker gets a copilot, billed per seat. Claude Tag does not fit that template. The misfit is deliberate. The work is billed to your organization rather than to you. Administrators get token spend controls at both the organization and channel level.[^2][^11] When one agent serves an entire channel, the seat stops being the unit of value. A channel of twenty people sharing one Claude does not generate twenty licenses. It generates one workflow with a metered budget.

As Saanya Ojha framed the procurement shift, the buyer's question moves from "which worker gets a copilot" to "which recurring workflows can this agent own, and what systems is it allowed to touch." That pushes pricing "away from flat per-seat chatbot licenses and toward outcomes, throughput, managed workflows, or agent capacity," funding "a new kind of labor layer."[^12]



![Where AI value gets metered](https://storage.googleapis.com/sol-assets-secondorderlabs/.assets/images/articles/claude-tag-proves-enterprise-ai-is-not-a-chatbot-but-an-ambient-team-member/charts/chart-1.svg) {.full-width}
*Claude Tag's billing-to-org, per-channel spend model pushes the metering unit down this list, away from seats.*



Org-level billing aligns AI cost with departmental budgets rather than individual software licenses. You fund labor this way, not software. Anthropic's own figure makes the labor framing concrete: 65% of its product team's code is created by an internal version of Claude Tag.[^4] That is not a copilot assisting a team of engineers. That is capacity replacing a meaningful share of the work itself. You do not price capacity by the seat.

## Anthropic Is Renting Slack to Own the Agent

Why would Anthropic build its flagship enterprise agent as a guest on Salesforce's Slack, a surface it does not control? Owning the chat interface was never the goal. The durable position is owning the agent's identity and memory loop, no matter whose surface it runs on.[^13] Persistent memory means Claude Tag maintains context across long-running projects. Standard chat sessions forget everything when they close.[^14] That memory, plus the channel identity, is the lock-in. The UI is interchangeable.

> "Slack is the only layer in the AI stack where teams work together. Bringing Claude Tag into Slack is about making AI multiplayer. Instead of a private back-and-forth, Claude Tag shows up in the open, in your channels, alongside your team, where it can see the real context of how your organization works and make the whole company smarter in the process."
> Rob Seaman, *Anthropic and Salesforce Announce New Claude to Slack Integration*

Seaman is right that Slack is where teams work together. The framing flatters Slack, though. Multiplayer AI learns from shared organizational context. It builds a compounding knowledge advantage that lives in Anthropic's agent, not in Slack's database. The more the agent learns about how your company works, the more value pools in the identity-and-memory layer Anthropic controls. Slack becomes the room. Claude becomes the colleague you cannot replace. The chat surface risks becoming a dumb pipe for workflows that belong to someone else.

## What Operators Should Do Before the Next Stale Channel Bites

Treat channel membership as a credential. Before you enable Claude Tag on any channel touching production systems or sensitive data, audit the roster the way you audit a privileged directory group. Keep auditing it. The confused deputy does not announce itself. It waits in a channel someone forgot to clean up.

Leave ambient mode off until you decide what "quiet thread follow-up" should and should not touch. Anthropic made that the safe default for a reason.[^10] Stop benchmarking against per-seat copilots. Start asking which recurring workflows you will actually let an agent own, then meter against throughput. Watch the apprenticeship gap. When the routine delegation that trained your juniors routes to an AI, the productivity shows up this quarter. The missing senior engineer shows up in three years. The teammate is real. You now have to govern the fallout.