Claude Tag gives AI agents their own identity in Slack

At a glance

What this is: Claude Tag assigns AI agents their own identity inside Slack, shifting them from borrowed user access to governed non-human identities with their own credentials and scoped access.

Why it matters: IAM and NHI teams need to treat agent identity as a lifecycle problem, because ownership, entitlement scoping, and review models built for people do not translate cleanly to autonomous software actors.

👉 Read Unosecur's analysis of Claude Tag assigning AI agent identity in Slack

Context

AI agent identity in Slack is the security problem here, not the convenience feature. When an agent stops borrowing a human session and instead carries its own credentials, it becomes a separately governable identity with its own access, ownership, and audit implications.

That shift matters because identity governance assumes you can tell one actor from another, assign accountability, and review entitlements on a stable cadence. Once the agent is a first-class identity inside Slack, the governance burden moves from user context to non-human identity lifecycle control.

This is a familiar pattern in NHI programmes: the technical change looks small, but the governance impact is large. The article describes a workspace where agents, bots, OAuth tokens, and service accounts already coexist, so Claude Tag adds another identity class to an environment that is already hard to inventory cleanly.

Key questions

Q: What breaks when an AI agent shares access through a Slack channel?

A: A shared channel turns access into a standing non-human identity grant, so a person’s individual permissions no longer constrain what the agent can do. That breaks the assumption that delegation is tied to a single user session. The practical failure is broad, reusable access that persists until someone explicitly revokes the agent credential.

Q: Why do AI agents increase access risk even when they are visible?

A: Because visibility does not reduce privilege on its own. If the agent has broad or standing access, the risk remains until the organisation ties the identity to an accountable owner, constrains its access scope and moves sensitive activity toward task-scoped authorization.

Q: How can teams tell whether an agent's access is starting to drift?

A: Look for changes in the tools it reaches, the channels it operates in, or the data it touches. Drift is usually signalled by runtime behaviour that no longer matches the original access purpose, especially when a bundle has grown beyond the task it was created for.

Q: Should IAM teams govern Slack agents differently from human users?

A: Yes. Human users are governed through authentication and user-centric lifecycle controls, while Slack agents need inventory, ownership, entitlement scoping, and offboarding at the non-human identity layer. The control objective is the same, but the lifecycle mechanics are not.

Technical breakdown

From borrowed session to owned service-account identity

Claude Tag changes the identity model by moving an AI assistant out of a human user's session and into its own service-account style identity. That matters because the agent is no longer indistinguishable from the person who summoned it. It can have its own credentials, its own channel-scoped bundle, and its own lifecycle. In NHI terms, that is the difference between delegated use and separately governed identity. The governance question is no longer who clicked the button, but who owns the agent, what it can reach, and how its authorisation changes over time.

Practical implication: Treat the agent as a distinct non-human identity from day one, with explicit ownership and inventory records.

Access bundles create standing privilege unless they are tightly scoped

The article makes clear that Claude Tag needs real tool access to be useful, and that access is packaged into bundles. That is a standard provisioning pattern, but it becomes risky when bundles are broad, persistent, or difficult to review. The core issue is not whether the bundle works. It is whether the bundle encodes least privilege, whether its scope matches the task, and whether entitlement creep is prevented after the initial setup. Once a bundle is granted, it behaves like any other standing permission unless there is a governance process around it.

Practical implication: Review agent bundles as standing privileges, not temporary convenience settings.

Protocol-layer control matters as much as identity control

The article points to protocol mediation through Model Context Protocol connections and authentication gateways. That is important because an agent's effective reach is defined not only by its identity, but by what it can do once it reaches tools, data sources, and APIs. In practical terms, the protocol layer is where authorisation boundaries become concrete. If those connections are unmanaged, the agent inherits broad runtime reach even when the workspace looks controlled on paper. For identity teams, that means authentication and authorisation have to be visible at the tool-integration layer, not just in Slack administration.

Practical implication: Govern the protocol connections that carry agent access, not just the Slack object that represents the agent.

Threat narrative

Attacker objective: Abuse the agent's standing access and connected tools to reach data or actions that were not intended to be available through a human session.

1. Entry occurs when a user summons Claude inside Slack and the platform provisions a dedicated agent identity with credentials and tool access.
2. Credential access is then established through service-account style bundles and OAuth-linked integrations that let the agent reach real systems.
3. Impact follows if the bundle is oversized or unattended, because the agent can continue operating with standing access after the original task has ended.

Breaches seen in the wild

• Slack GitHub breach 2022: Slack employee tokens stolen via a compromised vendor were used to download private GitHub repositories over the 2022 holidays.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Claude Tag exposes a classic assumption collapse in identity governance: access review assumes the actor being reviewed is stable, visible, and owned. That assumption was designed for human sessions and long-lived service accounts. It fails when an AI agent can be provisioned as its own identity inside a collaboration workspace, because the review target is no longer a person or a simple bot. The implication is that governance has to shift from session attribution to first-class non-human identity ownership.

First-class agent identity is not a convenience layer, it is a governance boundary: once the agent is separable from the human user, the controls that matter are inventory, ownership, entitlement scope, and revocation. The article is right to frame visibility as a gift, but visibility without accountable ownership only produces a better-managed liability. Practitioners should read this as a warning that unmanaged agent identities become part of the NHI estate, not an exception to it.

Slack is becoming an identity mesh, not just a chat workspace: people, guest accounts, bots, OAuth tokens, service accounts, and now AI agents all coexist in the same operational plane. That makes the challenge one of identity classification and lifecycle governance, not just application permissioning. The more identity classes share a surface, the more important it becomes to distinguish them cleanly and govern them through the same lifecycle discipline.

Protocol-layer authorisation is now part of identity governance: the article's emphasis on tool connectivity and MCP-style access is a reminder that identity risk is created at the moment of delegation, not only at the identity record. If teams only govern the visible agent object and ignore the runtime connections behind it, they are leaving the most important authorisation decisions unreviewed. Practitioners should treat the agent's tool path as part of the identity boundary.

Shadow AI and Shadow NHI are converging in the same workspace: once an agent can appear in Slack, use tools, and inherit organisational trust, the control problem is discovery followed by lifecycle control. The next challenge is not whether a tool exists, but whether the organisation can prove who owns it, what it can do, and whether it still needs to exist. Teams should expect agent sprawl unless they build governance in before adoption accelerates.

From our research library:

• 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
• Read next: AI Agent Identity Security Buyer's Guide

What this signals

Owned agent identity is the right direction, but only if ownership is real: when an AI agent moves out of a human session and into its own identity, the governance model becomes closer to service-account management than to chat configuration. Teams should expect discovery, ownership, and entitlement review to become the first operational questions, not the last.

Agent visibility does not equal agent control: once a collaboration workspace contains people, bots, OAuth tokens, and AI agents, the control plane becomes an identity catalogue problem. Access review cadences, lifecycle offboarding, and protocol-layer authorisation have to catch up before agent sprawl becomes normal.

Slack-style collaboration surfaces already contain hidden identity risk, and 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, according to the State of Secrets Sprawl 2026. That makes agent identity governance part of a broader issue: the places where teams collaborate are now part of the credential attack surface.

For practitioners

• Inventory every agent identity in collaboration tools Create a register of AI agents, bots, OAuth apps, and service-account style identities in Slack and adjacent SaaS tools. Tie each record to an owner, purpose, and expiration or review date so the agent cannot exist as an unowned asset.
• Scope access bundles to a single task boundary Define the minimum tools, channels, and data sources each agent requires, then avoid reusing broad bundles across multiple use cases. If a bundle cannot be tied to a narrow purpose, it is already too wide for safe governance.
• Treat OAuth grants and service accounts as part of the agent lifecycle Track the credentials and downstream accounts an agent depends on, because revocation of the visible agent object does not automatically remove its connected access paths. Offboarding must include the credentials the agent used to operate.
• Monitor behavioural drift at the identity layer Baseline what each agent normally does, then alert when it changes tools, channels, or execution patterns. A change in runtime behaviour is often the first sign that an agent's scope no longer matches its intended purpose.
• Review protocol-level authorisation for agent tools Check the mediation layer that connects agents to databases, APIs, and internal systems, and verify that authentication, authorisation, and logging are enforced there rather than only in the chat workspace.

Key takeaways

• Claude Tag shows how quickly an AI assistant becomes a non-human identity issue once it owns credentials and tool access inside a real workspace.
• The governance gap is not the agent itself but the assumption that borrowed human access is enough to control it.
• Identity inventory, ownership, and lifecycle review are the controls that determine whether agent visibility becomes control or just a better-lit blind spot.

Key terms

• Agent Identity: An agent identity is the set of attributes, credentials and permissions assigned to an autonomous software entity. It is treated as a non-human identity because it can authenticate, act on systems and accumulate access over time, which creates governance, audit and lifecycle obligations similar to other production identities.
• Access Bundle: An access bundle is a packaged set of entitlements granted together under one requestable unit. It can improve usability and reduce ticket volume, but it also increases the importance of review, ownership, and expiry discipline because multiple privileges move as one decision object.
• Borrowed Access: A pattern where an AI assistant operates under a human user's permissions during a session. It hides the agent's activity inside the person's legitimate access, which makes review, detection, and accountability difficult because the identity boundary is blurred.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.

What's in the full article

Unosecur's full blog covers the operational detail this post intentionally leaves for the source:

• How Claude Tag's access bundles map to Slack channels, tools, and service-account style credentials
• The vendor's explanation of its Unified Identity Fabric and MCP Auth Gateway for runtime control
• Details on inventory, posture checks, and behavioural baselining for Slack identities
• Examples of remediation actions such as disabling, revoking, or downgrading access

👉 Unosecur's full blog covers the Slack identity model, access bundles, and protocol-layer control

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.