Setting up the desk: keys, buildings and badges

So far, the borrowed desk has been the same for everyone: a temporary computer on the company's servers. Claude now lets you shape that desk in three ways. This page gives the ideas. The fourth section's Cloud environments and self-hosted runners gives the details.

Keys held at reception

This is a second kind of key at reception: for a service the desk calls directly, not an app connector. A network secret is a password for another service, such as an API key (a password one program uses to call another). You store it once in the desk's settings, called the cloud environment. The desk never sees the key. Anthropic's proxy (reception: a gate that every request passes through on its way out) adds it to a request after the request leaves the desk, so "the key itself stays outside the VM".¹ For Brightline, the accounting system's key could be kept this way, as an illustration.

A desk in your own building

Usually, the borrowed desk stands in Anthropic's building. With self-hosted environments, a company runs the same desks on its own computers, inside its own network. The files, the work and the secrets stay on machines the company controls. The conversation itself still goes to Anthropic, and Anthropic says it "never connects into your network". This is in public beta, an early version open for testing, for Team and Enterprise plans, and it is off by default.²

A worker with its own badge

A project belongs to one person. Claude Tag puts Claude in a team's Slack channels (Slack is a team chat app), where anyone can tag @Claude and hand it work.³ In a channel, Claude acts with its own service accounts, "rather than as a specific user". A service account is an account made for a program, like a staff badge. An organization Owner or a Claude Tag admin sets up the keys for the team's tools, and they still stay at reception: the proxy adds them on the way out. In a one-to-one message with Claude, it works differently: Claude works as you, with your own connectors.⁴ Claude Tag is in public beta for Team and Enterprise plans.³

Rule to remember: the setup decides what the desk can reach and whose badge it wears. Approvals still decide what it may do. Brightline's payment still needs the second signature.

Next, Claude and ChatGPT: the same idea compares the two apps.