Anthropic's governance page for Claude Tag sets out where the agent is allowed to act. In channels it responds only where it has been added and addressed, an @-mention guarantees a response, and once a thread is active it follows the replies in that thread. Most of the narrowing controls require the Owner role in the Claude organization, while a channel manager or member can take a smaller listed set of actions.
Two defaults deserve attention. Anyone in a channel where the app has been added can address it until a single toggle narrows that to people inside the Claude organization, which matters in guest and Slack Connect channels where the membership is not the organization. And the agent may reply to a message that does not mention it, when it judges a reply is warranted — so the boundary is where it was invited, not where it was asked.
Direct messages are a separate surface running on the user's own account, which means the channel controls do not describe the whole exposure. That is the same shape as an organization agent being a scoped runtime rather than one bot, and it is why the agent security hub treats invitation scope as an access-control question.
The page documents controls and permissions rather than observed behaviour, and the judgement rule for unprompted replies is described without criteria. The condition to watch is whether unprompted replies become separately auditable, because a control surface that assumes an explicit mention understates where the agent can speak.