Anthropic is rolling out a new security model for its team collaboration product, Claude Tag, that gives each AI channel its own identity and permissions. The goal: shut down the leak-prone practice of letting AI borrow a human employee's credentials.
With the old approach, an attacker could trick the AI into reading confidential files or spitting out API keys stored in local configs. The new system replaces borrowed credentials with dynamic policy profiles. Move to a different chat channel, and the AI automatically loads a different permission package. A dev channel can write to a database, but a public channel can only read.
Memory is physically isolated between channels, too. Secrets discussed in finance won't leak into the dev channel. And because all network requests get credentials injected by a gateway, the AI never even sees the keys. No keys to steal.
Later, Anthropic plans to add just-in-time authorization. Sensitive actions will trigger a pop-up for human approval, and the system will also check the requester's own permissions. The action only goes through if both the human and the AI have clearance. Double lock, no exceptions.