orfloat

ORF-N-2026-013 · Thesis

The harness moves up to the org

Claim

The harness used to be the scaffolding one engineer wired around a model on their own machine, under their own account. Claude Tag lifts it to the organization: one shared agent per channel, acting under its own org-level identity rather than a borrowed human's, reached by tagging it into the room people already work in. The interface question and the governance question become the same question, and the harness is the half the business still owns and designs.

A year of writing about agents trained a precise vocabulary. An agent is a model plus a harness, and the harness is the half you own: the tools the model may call, the context it sees, the memory that survives a turn, the loop that carries a long job to the end. In almost every example we reached for, that harness lived close to a single person. It was the scaffolding an engineer wired on their own machine, under their own account, for their own work.

On 23 June 2026, Anthropic shipped the release that changes the scale of that word. Claude Tag lets anyone tag @Claude into a Slack channel, where it takes on real work using the organization’s tools and the shared context around it. It reads, at first, like a chat convenience. It is a harness that has climbed a level: out of the individual’s laptop and up to the organization, where it becomes a standing object the whole company shares, with an identity of its own.

The old integration, Claude in Slack, ran the model under your personal permissions in a private one to one chat. The new one states its rule in five words. “Access follows the channel, not the user.”

the access inversion: from a borrowed human identity to the agent’s own org-level identitybefore · claude in slackafter · claude tagyou, one persona private 1:1 threadacts as youruns under your personal permissionsthe agent borrows your identitywhat it can touch is what you can touchthe inversion# the channelthe roomone shared Claudeacts as org service accountconnectionsreposskillsthe access bundle is set per channel by an adminaccess follows the channel, not the user
the access inversion (claude in slack  ->  claude tag)
  before   a private 1:1 thread. the Claude in it acts as you,
           under your personal permissions. its reach == your account.
  after    a shared channel. one Claude everyone in the room shares,
           acting under its own org-level service account, not a person's.
           an access bundle (connections, repos, skills) is set per channel
           by an admin.
  the rule  access follows the channel, not the user.
Figure 1. the inversion at the center of the release. the old integration ran the model under your personal permissions in a private 1:1, so the agent borrowed your identity and reached exactly what you could reach. claude tag gives a channel one shared Claude that acts under its own org-level identity, a service account whose access an admin wires per channel. the agent stops wearing a person’s badge and starts carrying its own. source: Anthropic, claude tag docs, how it works.

Access follows the channel, not the user

That one line is the whole paradigm shift, and it is worth slowing down on. Earlier, an agent in your tools was a borrowed human. It logged in as you, saw what you saw, and acted with your reach. Convenient, and quietly wrong: the access model and the identity model were a person’s, on loan, with no boundary that belonged to the agent itself.

Claude Tag operates under service-account credentials, set per channel by an admin. The agent is no longer a stand-in for whoever invoked it. It is an entity with its own identity, its own scoped reach, and its own trail. When it opens a pull request, the commit is authored by the Claude app, not by a person it was pretending to be. When an administrator wants to change what it can touch, they change the channel, not a human’s account. Within a given channel, in Anthropic’s words, there is one Claude that interacts with everyone. The unit of access stopped being the user and became the room.

This is governance moving into the interface. The question a security team used to ask after the fact, what could this thing reach and on whose authority, is now answered by the same configuration that turns the agent on. You do not bolt a boundary onto a borrowed login. You give the agent an identity and scope it.

One Claude the whole room can steer

If the access model changed underneath, the interaction model changed on the surface, and the two are the same move seen from two sides. There is no new application to open. The interface is the channel the team already works in.

You start a task by tagging @Claude with it. Anyone in the channel can steer a running session by replying in its thread, without tagging again, so a second person can redirect work a first person began. You can ask the agent about itself in plain language, @Claude what can you access from this channel, and read its own configuration back. When it finishes, the result carries an “Open session in Claude” link to the full tool-call history, so the work is legible after the fact, not a black box that simply returned an answer. Everyone in a channel works with the same Claude, so anyone can pick up where someone else left off.

The shift here is from a private assistant you prompt to a shared colleague you delegate to in the open. The conversation is not a wrapper around the agent. The conversation is the agent’s interface.

A session is a sandbox the thread outlives

Underneath each task is an ephemeral cloud sandbox that Anthropic hosts, a real working environment where the agent can read documents, run code, build charts, and open pull requests. The sandbox is created when a conversation starts and discarded when it goes idle. Two threads in the same channel are two separate sessions in two separate sandboxes.

The piece that matters is what survives the discard. The compute is disposable; the thread and its memory are not. When the sandbox is released, the conversation and what the agent learned in it persist, so the next tag resumes against the last one rather than starting cold. Ephemeral where it should be ephemeral, durable where it should be durable.

the session lifecycle: an ephemeral sandbox, a persistent thread and memoryone ephemeral session · sandboxtag @Claudeor a routinesandbox buildshosted, isolatedwork loopchannel accesspost resultto the threadidlesandbox discardedreads + writesthe thread and its memory persistthe next session attaches to it, sharper than coldthe thread persists, so the next tag resumes it
the session lifecycle (ephemeral compute, persistent thread)
  tag @Claude (or a scheduled routine)
    -> sandbox builds: an ephemeral, hosted, isolated working environment
    -> work loop: reads docs, runs code, opens PRs, with the channel's access
    -> post result to the thread
  -> idle: the sandbox is discarded
  the thread and its memory persist outside any one session; the session
  reads and writes that memory, and the next tag resumes the thread sharper
  than a cold start. two threads in a channel are two separate sandboxes.
Figure 2. one task, one disposable sandbox. a tag or a scheduled routine starts a session in an ephemeral environment Anthropic hosts; it works with the channel’s access, posts to the thread, and is discarded when the conversation goes idle. the compute is throwaway, but the thread and its memory persist, so the next session attaches to what the last one learned. source: Anthropic, claude tag docs, overview and how it works.

The harness, drawn as org primitives

Set the pieces side by side and the shape is familiar. We have always said the harness is tools, context, memory, feedback, and orchestration. Claude Tag is those same parts, re-expressed as organizational objects with owners and boundaries.

The identity is a service account, scoped per channel, not a borrowed login. The access bundle is the connections, plugins, and skills an admin wires at the channel, workspace, or organization level. The memory is scoped on purpose: memory from public channels is shared across the workspace, while private channels keep isolated stores, and identities are compartmentalized so that, in Anthropic’s example, a Claude set up for sales work will not pass its memories to one set up for engineering. The audit view tracks the agent’s tasks and network calls against its own identity. Scheduled routines let it carry standing work that no one has to tag for each time. The harness did not get simpler. It got an org chart.

the org-level harness as a hub: agent identity, access bundle, and scoped memory above; audit view and scheduled routines below, all wired to the centrethe org-level harnessthe agent as an organizational objectagent identitya service account, scopedper channel by an admin.not a borrowed login.acts as: the org, not a personaccess bundleconnections, plugins, skills,wired per scope.channelworkspaceorgan admin decides what it may touchscoped memorypublic channels share a store;private channels stay isolated.salesengno memory crosses the barrieraudit viewevery task and network calltracked to the agent’s ownidentity, not a person’s.open session · tool-call logscheduled routinesstanding work, triggered on aschedule or an event, not onlyon a mention.does not wait to be asked
the org-level harness (the agent as an organizational object)
  agent identity      a service account, scoped per channel by an admin.
                      not a borrowed login. acts as the org, not a person.
  access bundle       connections, plugins, and skills, wired per scope
                      (channel | workspace | org). an admin decides reach.
  scoped memory       public channels share a store; private channels stay
                      isolated. a sales identity passes nothing to an
                      engineering one. no memory crosses the barrier.
  audit view          every task and network call tracked to the agent's
                      own identity. open session shows the full tool-call log.
  scheduled routines  standing work, triggered on a schedule or an event,
                      not only on a mention.
Figure 3. the harness, re-expressed as organizational objects. the same parts we have always named, tools and context and memory and orchestration, become an identity the company owns, an access surface an admin governs, a memory scoped and walled by team, an audit trail tied to the agent itself, and standing routines it runs unasked. the harness did not get simpler; it got an org chart. source: Anthropic, claude tag docs and announcement.

What we argued, one level up

We made the general case in the harness is the half you own: an agent is a model plus a harness, the model is bought and the harness is built, and the half you build is the only half you own. Claude Tag is that claim lifted from the developer to the organization. The per-person scaffolding becomes an org-level harness, with an identity the company owns, an access surface an admin governs, a memory scoped to a team, and a set of routines that run on their own clock.

The thing worth naming plainly is that the interface question and the governance question turn out to be one question. How a person reaches the agent, by tagging it into a channel, is the same fact as what the agent is allowed to reach, the access the channel carries. The surface where humans meet the agent and the surface where the organization governs it are the same surface. That is the paradigm shift the release hallmarks: the harness stops being something a single engineer operates and becomes the place the whole organization meets its agent, on terms it sets.

The gap widens on its own

Put two businesses on the same frontier model and change one thing: where the harness lives. One keeps an agent per person, each under its own login, its own memory, its own slice of access. The other lifts the harness to the organization. Let them scale, and the curves come apart.

the widening gap: an org-level harness compounds while a per-person setup plateauscompoundsthe widening gap(mostly self-inflicted)context boundariesadopts the org-level harnessstays per-personhighloweffective throughputwork scaling across people, teams, and context boundariesschematic, not a measurement
the widening gap (schematic, not a measurement)
  axis x   work scaling across the org: more people, teams, context boundaries
  axis y   effective throughput (what the business actually gets done)
  adopts the org-level harness   each context boundary is resolved once (one
                                 identity, one memory, one access surface) and
                                 stays resolved, so throughput compounds: a clean
                                 upward curve that bends, not steps
  stays per-person               every context boundary is a fresh handoff
                                 (re-permission, re-explain, lost context); the
                                 handoffs cap throughput and the curve plateaus
  the gap between them widens on its own. the model is the same on both sides;
  the difference is all harness, and for the laggard it is mostly self-inflicted.
Figure 4. the same frontier model, two operating models. the business that lifts the harness to the org resolves each context boundary once (one identity, one memory, one access surface) and compounds; the one that keeps an agent per person pays the handoff again at every boundary and plateaus. the gap widens on its own. this is a schematic, not a measurement: it names the shape of the argument, not a measured curve.

The reason is the context boundary. Real work crosses them without pause: person to person, team to team, one tool to the next. For the per-person setup every boundary is a fresh handoff, because the agent on the far side has never seen the thread, holds none of the memory, and has to be re-permissioned before it can act, so a human carries the context across by hand. Each crossing taxes the next, and the handoffs cap throughput no matter how good the model becomes.

The org-level harness resolves the boundary once. One identity reaches across the channel, one memory survives the handoff, one access surface is already wired, so the agent picks up on the far side in real time instead of waiting for a person to bridge it. A bottleneck removed once stays removed, and the gains compound. The curve does not step up. It bends. The gap that opens is not a fixed lead but a widening one, and for the business that waits it is mostly self-inflicted: the model on both sides is the same, and the difference is all harness.

Where this honestly stands

The discipline of a note is to read the release at its word and mark the edges. Claude Tag is in beta, on Slack only at launch, for Team and Enterprise plans. It replaces the earlier Claude in Slack app, which retires on 3 August 2026. Anthropic’s announcement places it on Claude Opus 4.8 and reports that its own teams now delegate much of their work to many Claudes in parallel, with a majority of one product team’s code written by their internal version of this. We read that for direction, as the company’s own figure rather than an independent result, the same way we treat any first-party number. Some of the standing, proactive behavior described around launch is not yet pinned on the core documentation, and we do not lean on it here.

None of those edges change the shape of the thing. A beta on one surface is still the first general productization of an org-level harness, identity and access and memory and audit and schedule, wired as one object a company configures.

The half you own, now org-shaped

For a lab whose practice is wiring frontier models into operating businesses, this is the shape of the work, named out loud. We do not hand a company a chatbot per desk. We design the org’s agent: the identity it acts under, the tools and data it may touch, the memory it keeps and the walls between teams that memory has to respect, who in the room is allowed to steer it, and what it does on a schedule when no one has asked. That is an org-level harness, and it is the half a business owns.

Claude Tag makes the surface official. It does not make the design decisions for you. What to expose and what to wall off, which team’s memory stays sealed from which, what the agent is trusted to do unattended and what stays behind a person, is judgment, and it is exactly the embedding work we argued for in the capability overhang: closing the distance between what a model can do and what your business does with it is integration, not installation. An org-level harness is what that integration looks like when it is built to last.

If there is an agent somewhere in your operation that still acts under one person’s login, that is a design you have already outgrown. Start a conversation with us about a Discovery Phase.

References

  1. Anthropic. Introducing Claude Tag. 23 Jun 2026. anthropic.com/news/introducing-claude-tag
  2. Anthropic. What is Claude Tag? Help Center. support.claude.com/en/articles/15594475-what-is-claude-tag
  3. Anthropic. Claude Tag: overview. claude.com/docs/claude-tag/overview
  4. Anthropic. Claude Tag: how it works. claude.com/docs/claude-tag/concepts/how-it-works