Notifications
Clear all
Topic starter
24/07/2026 4:09 pm
TL;DR: Anthropic’s agent identity access model for Claude Tag reframes Slack channels as part of the IAM surface because people can now cause an AI agent to use its own identity, access repositories, documents, and tools, according to Noma Security. The governance problem is no longer just whether an agent has access, but who can trigger it to use that access and how the resulting actions are audited.
NHIMG editorial — based on content published by Noma Security: Claude Tag agent identity and Slack authorization implications
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
Q: How should security teams handle Slack-connected AI agents as identities?
A: Treat every Slack-connected AI agent as an NHI with explicit ownership, scope, and revocation requirements.
Q: Why do AI agents create more IAM risk than ordinary developer tools?
A: AI agents can make independent tool calls, chain actions, and authenticate with non-human identities while executing a task.
Q: What breaks when AI agents are given broad standing access?
A: Broad standing access breaks governance because the agent can move from one task to another without a fresh authorization check.
Practitioner guidance
- Define channel-level authorization boundaries Map which Slack channels can invoke the agent, which connectors they may reach, and whether the action is read-only or write-capable.
- Record prompt-to-action evidence Retain chat prompts, thread context, agent outputs, and downstream API events in one investigation path so responders can reconstruct the request chain.
- Limit agent access by default Begin with low-risk channels and read-only data sources, then widen permissions only after owners can explain the access path in plain language.
What's in the full article
Noma Security's full analysis covers the operational detail this post intentionally leaves for the source:
- The article’s channel-by-channel access model for Claude Tag and how workspace administrators scope permissions.
- The specific governance questions raised by a Slack agent that can read threads, query systems, and take action under its own identity.
- The PocketOS incident details and how the agent found and used an unrelated API token to delete a production database.
- The article’s recommendations for owners, logging, and low-risk rollout decisions before agent access expands.
👉 Read Noma Security's analysis of Claude Tag agent identity and Slack access →
Claude Tag in Slack: what it means for IAM teams?
Explore further
24/07/2026 4:13 pm
Channel membership is now an identity control, not just a collaboration convenience. When an AI agent has its own identity in Slack, the access question expands to who can cause that agent to act and in which context. That means channel governance, not just connector governance, becomes part of the IAM surface. Organisations that treat Slack membership as low-risk collaboration metadata will miss the fact that membership may now be the effective trigger for downstream privileged action.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
A question worth separating out:
Q: Who is accountable when an AI agent misuses Slack access?
A: Accountability sits with the team that approved the integration, the owner of the OAuth app or webhook, and the governance function that failed to constrain access. For regulated environments, the relevant control question is whether the organisation can prove who granted access, what the agent could do, and how quickly it can be revoked.
👉 Read our full editorial: Claude Tag agent identity changes how Slack access is governed
