Anthropic has introduced Claude Tag, an agent identity and access model designed to make AI agents first-class enterprise identities.
With Claude Tag AI agents operate with their own identities, credentials, and permissions. They authenticate to enterprise systems as independent subjects and retain those identities across sessions, allowing actions to be attributed to the agent itself rather than an individual user.
While a step up from agents sharing credentials of an employee, Claude tag presents significant implications for how enterprises handle identity, authority, accountability, and governance for agentic AI.
How it works
With Claude Tag, each channel or workspace is assigned a persistent Claude identity with its own permissions. Everyone in that channel interacts with the same agent, which is invoked by default whenever Claude is used in that workspace.
When interacting with enterprise systems, the agent authenticates using its own identities and entitlements rather than the credentials of the individual user. It posts in Slack as the Claude app, opens pull requests as the Claude GitHub App, and queries data warehouses using dedicated service accounts.
Because the identity persists across sessions, actions are consistently attributed to the agent rather than whichever user happened to invoke it. Permissions can be managed and revoked independently of any individual user, making the agent manageable as its own enterprise subject.
The model is designed to support collaborative, long-running autonomous work without relying on shared credentials or impersonating users. Direct messages are the exception, where Claude instead operates using the individual user's own identity and connected accounts.
Implications for enterprises
While it's helpful that Anthropic is advocating for agents to have unique identities and be valid users in a system, there are important implications for enterprises.
Static entitlements
The access controls seem to be a new implementation of a role-based entitlement model, but for AI agents. This is unexpected as static entitlement models have struggled to keep pace as systems have become more dynamic. Now we are dealing with the most dynamic systems ever introduced into enterprise environments, yet the controls governing them remain similarly coarse and static. This can lead to entitlement creep, over-provisioned agents, and authority that expands over time without a corresponding mechanism to continuously re-evaluate whether it remains appropriate.
Independent authority
The model deliberately separates agent authority from user authority. Once assigned to a channel, the agent operates using its own identity, its own credentials, and its own entitlements. In practice, this means the agent is no longer acting on behalf of the user, but as an independent actor in the system. It can continue working without the user present and, where required, perform actions beyond the permissions held by the individual who requested the work.
This breaks the traditional link between a user's intent and the actions taken in their name. When that link is removed, it becomes much harder to determine who is responsible for outcomes, how actions should be constrained, and what safeguards should apply as the agent continues to operate autonomously.
Further, the authority assigned to the agent remains constant while the context in which it operates changes continuously. That is an uncomfortable mismatch.
Continuous execution
If an agent belongs to a channel with broad entitlements, how are those permissions constrained as the agent retrieves information, invokes tools, delegates work, or interacts with other agents?
The initial entitlement determines what the agent can access. Autonomous execution creates an entirely new set of decisions. Should the agent retrieve additional information? Should it combine data from multiple systems? Should it invoke a tool? Should it delegate work to another agent? Should it perform an action using the data it has retrieved? These questions can’t be answered when access is granted - they emerge continuously throughout execution.
Closing the gaps
Claude Tag establishes who an agent is and what it can access. It leaves a significant gap between assigning authority to an autonomous system and governing how that authority is exercised as the system retrieves information, invokes tools, delegates work, interacts with other agents, and accumulates context over time.
The AI Agent Security Playbook explores this challenge in more detail, including why governing autonomous decision chains requires more than assigning identities and permissions.
