Sharing an AI assistant among multiple people at work is a recipe for data leaks. Anthropic is rolling out a new security architecture for its team collaboration feature, Claude Tag, that fundamentally changes how AI accesses systems. Instead of acting under a human employee's account, each AI gets its own dedicated identity. That means when Claude posts in Slack, commits code on GitHub, or queries a data warehouse, it does so under its own credentials.
Enterprise admins can centrally control which tools and repositories the AI can access, and fine-tune permissions per channel. For example, only specific development channels can write to the database, while general public channels get read-only access. Because the AI has a separate identity in every private channel, sensitive conversations and accumulated memories in legal or finance channels stay completely siloed. For direct messages, Claude falls back to the personal account system, handling private tasks like writing emails securely.
During routine operation, security tokens are loaded dynamically only when making network requests. If the AI tries to reach an external server that the admin has blocked, the request is intercepted. Administrators can also see AI-specific audit logs in the connected system's logs. Future updates will include instant authorization—a human pop-up confirmation for sensitive actions—and double-checking the initiating user's permissions. Only when both the human and the AI have the necessary rights will the action be allowed, minimizing the risk of privilege abuse.