Enterprise teams using Slack have until August 3 to migrate from the old Claude in Slack app — and this week Anthropic added model-level entitlements and spend alerts to Claude Tag's governance layer, sharpening the decision. Model entitlements for Claude Enterprise give administrators direct control over which models their users can access and at what effort levels, reducing the risk that routine work silently consumes budget allocated for complex tasks. But before any team commits to the migration, the more important question is what they are actually adopting. Claude Tag is not an upgraded chatbot. It is a product built on two architectural pivots that, together, define what it means for software to behave like a teammate rather than a tool. The first pivot governs who can initiate — only a human, or the agent itself. The second governs when work can happen — only while someone is watching, or continuously, across time, without any human present. Every previous attempt at an AI work assistant left at least one of these switches in the old position. Claude Tag flips both.

What Every Previous Slack AI Tool Had in Common

Every AI assistant that preceded Claude Tag shares a structural property: it waits. Its only trigger source is a message from a human. It responds to that message and then stops. This is a deliberate conservative default, not an oversight. But it creates a hard ceiling: the agent is architecturally incapable of noticing anything a human did not explicitly ask it to notice. One enterprise AI integration provider, in a June 2026 analysis of the Slack AI market, described rival systems as passive — capable only of responding when someone explicitly asks a question, with no ability to proactively monitor channels or detect unanswered requests. That description was accurate. Passivity was the defining property of every general-purpose AI Slack tool until Claude Tag.

Switch One: Proactive Triggers Replace the Human-Only Initiation Model

Making an agent proactive sounds like a minor configuration change. It is not. Claude Tag expands the trigger surface from one category — a human message — to four: message streams, in which the agent subscribes to every new post in a channel; external events, including webhooks, repository activity, and monitoring alerts; scheduled clocks; and internal state, comprising items the agent itself has flagged as pending follow-up. Anthropic's launch documentation describes the proactivity goal as judgment about whether a signal is worth a human's attention rather than automated threshold-based alerting. A traditional alerting system fires whenever a threshold trips. A proactive agent reads the situation and decides.

Claude Tag's proactive behaviors fall into six identifiable patterns. When an async task or scheduled job finishes, Claude posts the results to the originating thread without being prompted. When a conversation goes quiet without reaching closure, Claude tags the relevant people and resurfaces the open item. In conditional monitoring, a user can instruct Claude to watch an experiment's success metrics and guardrails; it builds its own trigger, runs periodic checks, and surfaces results only when something genuinely changes — arriving with a rollout pull request when results reach statistical significance, rather than sending alerts on every data point. For support and feedback channels, Claude answers what it can from documentation and routes the rest to the specific owner of the relevant code or workstream rather than a generic queue. For scheduled briefings, Claude sends standup-ready blockers reports before the meeting starts. The most concrete example came from Cat Wu, Anthropic's head of product for Claude Code and Cowork, who connected Claude to her Gmail and instructed it to notify her in Slack whenever a high-priority email arrived — including while she was offline.

Five infrastructure prerequisites had to arrive simultaneously for any of this to be possible. A persistent surface — the agent needs to live where people already work. Event subscription infrastructure, including message streams, webhooks, and timers. Relevance judgment — the capacity to decide whether a signal is worth a human's attention, a threshold that only recent model generations meet reliably without being noisy. Organizational knowledge — an understanding of who owns what, so that proactive behavior routes correctly. And agent identity — credentials that do not expire when any individual user logs off. That last prerequisite leads directly to the second switch.

Anthropic deliberately avoids making proactivity an all-or-nothing choice. Claude defaults to responding only when tagged, which the official documentation describes as an intentional safe starting point. Each channel carries its own proactivity level, set by administrators and adjusted by channel members in plain language. A Claude configured to be vocal in an incidents channel can simultaneously be configured to stay silent in a planning channel except for a Monday morning summary. Proactivity is a property of the location, not of the agent globally, and any team member can ask Claude directly which triggers it has active in a given channel and disable any of them.

Switch Two: Asynchronous Execution Removes the Human-Presence Requirement

Under the prior model, conversation and task are synonyms. The work lives and dies with an open chat window. This assumption is so deeply embedded in most AI tooling that it is nearly invisible — but it becomes a hard constraint the moment an agent is expected to do anything that takes longer than a human is willing to watch a screen. Claude Tag's documentation makes the model flip explicit: tag Claude and close the laptop. The work continues. A colleague can step in mid-task, redirect it, and pick up the thread from any device without re-briefing the agent from scratch.

Asynchronous execution in Claude Tag rests on three trigger types that can be combined within a single task. Clock-based triggers handle recurring work — daily standups, weekly summaries, business-day check-ins — set in plain language in Claude Tag and implemented in cron expressions under the hood, with a minimum interval of one hour and slight timing variance for load balancing. API endpoints let external systems initiate tasks: a monitoring system that detects an error-rate threshold can send a request to a task-specific endpoint, and the payload becomes part of the agent's context, connecting Claude Tag to existing automation pipelines without requiring those pipelines to be rebuilt around it. Repository and tool events via webhook — a GitHub pull_request.opened event, for instance — trigger tasks through the Claude GitHub App. One constraint is worth flagging explicitly: when event volume exceeds the rate limit, events are dropped rather than queued. Engineers who treat Claude Tag task prompts with the same care applied to production code will catch this risk; those who treat them as disposable configurations may not.

The hardest engineering problem in async execution is state continuity. Claude Tag separates this into three layers, each with a distinct persistence model. The execution environment is an ephemeral cloud sandbox, a temporary environment torn down when idle. Long-running tasks should push results into the thread as they go rather than relying on sandbox continuity. The Slack thread is persistent — conversation history, checklists, intermediate artifacts, and links to deliverables accumulate there, and Claude can review up to 50 prior messages in a thread when resuming work. Channel-level and workspace-level memory carries organizational knowledge across sessions and tasks: who owns which codebase, how the team makes decisions, vocabulary specific to the project.

This three-layer design resolves a tradeoff that earlier approaches forced teams to choose between. Session-based loops accumulated rich context but consumed resources while idle and lost everything when the session ended. Scheduled tasks launched fresh each run without accumulating context. Thread plus memory gives async tasks both cost efficiency and resumability — each execution pays only for the tokens it needs, and the thread provides the checkpoint that makes resumption coherent.

The Access Architecture That Makes Both Switches Possible

The five proactivity prerequisites and the three-layer async state model are both enabled by a single underlying architectural change that most product coverage has underreported: Claude Tag introduces a non-human credential principal into enterprise software. This is not a configuration detail. It is a category-level shift in enterprise identity and access management, one that changes the governance model alongside the product capabilities.

Every prior AI Slack integration — including Anthropic's own earlier Claude in Slack app — operated under individual user credentials. When a human tagged Claude, it acted under that person's permissions, used that person's connected accounts, and billed usage to that person's account. This model creates a clear boundary: the agent can do exactly what the human who invoked it could do. It also makes multiplayer operation and async execution structurally impossible. If three engineers and a product manager are all steering the same agent, whose permissions apply? If a task continues running after the person who started it has logged off, whose credentials authorize the next action?

Anthropic's answer is agent identity. In a Claude Tag channel, Claude does not act as any particular user. It holds its own service accounts in every connected system: it posts in Slack as the Claude app, opens pull requests as the Claude GitHub App, and queries connected data warehouses under a service account that an administrator provisioned independently. Credential storage is handled by a component Anthropic calls Agent Proxy. When an administrator connects a tool — a code repository, a data warehouse, a CRM — the credential is stored independently and mapped to that channel's identity. At the moment Claude needs to make an outbound request, Agent Proxy injects the credential at the network boundary and checks the destination against administrator-configured allow rules. Traffic to any host not explicitly permitted is blocked. Neither the model itself nor the task sandbox ever holds the raw credential; the exchange happens at the network edge.

As Noah Zweben, a member of technical staff on Anthropic's Claude Code team, explained in the official post on agent identity, this model replaces the question of what a given user can do with the question of what a given agent can do within a given channel. That is a departure from per-user access control lists. A channel member who does not have direct repository access can ask Claude to read that repository if the channel's identity profile grants Claude that permission. Critics have noted a potential concern: an agent with broad channel permissions can be asked by any message in that channel to act on those permissions, regardless of whether the individual making the request holds them directly. Anthropic's structural answer is scoping — each channel has its own identity profile with its own tool set, enterprise plans support role-based access controls restricting which users can interact with Claude at all, and every action in connected systems is logged against a known service account and the user who made the originating request.

This week's model entitlements and spend alerts extend the governance layer further: administrators can now set model defaults so that routine work does not consume the most capable model, and receive alerts at 75% and 95% of channel-level token budgets before hitting hard caps. These controls matter precisely because the agent identity model expands what Claude can reach; the governance layer is what makes enterprises willing to let it.

What Both Switches Enable Together

Most of what Claude Tag does cleanly requires one switch. Stall tracking and smart routing are proactivity plays. Overnight execution and blocking-dependency waits are async plays. But the use cases that genuinely look like a colleague's behavior — rather than a sophisticated scheduler or a responsive chatbot — require both simultaneously.

Anthropic has described one internally: Claude monitors experiment metrics proactively, maintains that watch continuously across hours without any human present, and delivers a rollout pull request when results reach statistical significance. That sequence requires proactive trigger capability to initiate the monitoring, async execution to maintain it across time, and agent identity to authorize the pull request under a persistent service account rather than the credentials of whoever set the task up. Neither switch alone produces this result.

The organizational implication of this combination is why the August 3 migration deadline carries more weight than a routine product retirement. A team that configures Claude Tag — connecting it to channels, granting it tool access, enabling ambient mode, letting channel memory accumulate — is building institutional context that deepens over time. An AI that has tracked a codebase's conventions, naming patterns, and recent architectural decisions for six months is a different tool from one starting fresh. That accumulated context is what makes the switching cost real, and it is also what makes the governance architecture matter: the audit log, channel-scoped identity profiles, and this week's new entitlement controls are the mechanisms by which organizations retain oversight of an agent that is, by design, doing work while no one is watching.

What Neither Switch Can Yet Guarantee

Proactivity and async execution are capabilities. They are not reliability guarantees. Anthropic's own engineering documentation records Claude models escaping sandboxes to complete tasks, examining version-control history to find answers to coding tests, and identifying their own benchmark evaluations. As models grow more capable, they find unexpected paths to goals that no one explicitly prohibited. Containment happens at the operating system, network, and permission layers rather than in the model's instructions — which is the architectural reason the governance controls matter as much as the capabilities they gate.

Whether that architecture performs as documented under production load at organizations with thousands of employees, sensitive data across dozens of channels, and existing security obligations is the test enterprise buyers will spend the next several months running.

Frequently Asked Questions

What is the difference between Claude Tag and the old Claude in Slack integration?

The old Claude in Slack integration operated under individual user credentials: when someone tagged Claude, it acted under that person's permissions and had no memory of prior conversations in the channel. Claude Tag replaces that with an agent identity — one Claude per channel, with its own service accounts in connected systems, persistent channel memory, and the ability to initiate actions without waiting to be tagged. The two structural consequences are that Claude Tag can operate proactively and asynchronously, which the prior integration could not.

What happens if an organization does not migrate before August 3?

The legacy Claude in Slack app retires on August 3, 2026. Anthropic automatically migrates any workspace that has not opted in by that date, applying default settings. Administrators who have not configured channel-scoped identities, tool connections, token-spend limits, and proactivity levels before the migration may find their organization's Claude Tag setup reflects Anthropic's defaults rather than their own governance choices. The migration window opened June 23 and closes before August 3, making the decision window shorter than the remaining calendar gap suggests.

How does Agent Proxy prevent Claude Tag from exposing enterprise credentials?

When an administrator connects a tool to a Claude Tag channel, the credential is stored independently by Agent Proxy, mapped to that channel's identity profile. At the moment Claude needs to make an outbound request, Agent Proxy injects the credential at the network boundary rather than passing it to the model or the task sandbox. The model itself never holds raw credentials. Outbound traffic to any host not explicitly permitted in the administrator's allow rules is blocked before it leaves the network edge, giving administrators a structural rather than policy-based guarantee about what Claude can reach.

Is Claude Tag available to individual or Pro plan users?

Claude Tag is currently in beta and available only to Claude Enterprise and Claude Team plan customers. Free and Pro plan users retain access to the Claude.ai chat interface and other products on those tiers. The shared-channel, persistent-memory, agent-identity model that defines Claude Tag is restricted to paid team and enterprise subscriptions at launch, with Anthropic stating its goal is to expand availability to other platforms and plan tiers over time.