← Back to compare

Receipt vs Claude Tag: Who the Agent Is, and What It Leaves Behind

Receipt vs Claude Tag: Who the Agent Is, and What It Leaves Behind

Claude Tag gives the agent its own accounts and keeps credentials behind a proxy. Receipt ties each gateway call to the person who asked and records it before it runs.

Shared agents now sit in Slack channels, take instructions from many people, and act in business systems under some account. When a CRM record changes, two questions follow. Whose identity did the agent use? And what did it leave behind for someone to check later? This Receipt vs Claude Tag comparison takes them in order. Anthropic's Claude Tag answers the first carefully: the agent gets its own service accounts, and its credentials stay behind a proxy. Kentron's Receipt was built around the second: each gateway call is tied to the person who asked and recorded before it runs. The two designs put control in different places, and each pays for that choice somewhere. On credentials and network egress, Claude Tag's documented design is the stronger one today.

What Is Claude Tag?

Claude Tag is Anthropic's shared agent for Slack. Anyone in a channel can @-mention Claude with a task, such as fixing a bug or querying a data warehouse. Each thread gets its own session in an ephemeral cloud sandbox, on the infrastructure behind Claude Code on the web. Anyone in the channel can steer it by replying.

In channels, Claude acts through its own accounts: the Claude app in Slack, the Claude GitHub App, and service accounts an Owner provisions in other tools. One-to-one DMs from members with a connected Claude account run on that account instead. Admins attach connectors, repositories, plugins and domains to scopes (all of Slack, a workspace or a channel), often through bundles.

Claude keeps channel memory, runs routines and respects organization and channel spend limits. It suits Team and Enterprise organizations that want one agent a whole Slack channel can use. Announced on June 23, 2026, it is in public beta and runs Anthropic's Claude models. Because it retains transcripts and memory, it is unavailable to organizations using zero data retention, customer-managed encryption or Anthropic's HIPAA configuration.

What Is Receipt?

Receipt is Kentron's hosted agent product for organizations, at app.kentron.ai. People use it from web chat, Slack, Microsoft Teams, a command-line tool or MCP clients. In Slack, each user first links a Receipt account with the same verified email, and their requests run under that account's workspace permissions.

A model-based router either answers directly, without tools, or starts a durable background run. Its tasks execute in sandbox containers using OpenAI's Codex CLI, and the result posts back to the thread. Slack and Teams routing needs the organization's own OpenAI key.

Connected apps belong to a workspace. Owners and admins, or members they delegate, choose which operations each connection exposes, and writes stay off until enabled. For most connectors, agents reach apps through Receipt's gateway, which attaches the credential on the server and records each call before it runs. The gateway is also a hosted MCP server for coding agents such as Claude Code, Codex and Cursor.

The Architectural Difference

Claude Tag makes the agent a principal. Receipt makes the request one. Most other differences follow from that.

In a Claude Tag channel, AI agent identity is something an admin provisions. The agent holds an account in each tool, its credentials are bound to scopes, and the sandbox holds none of them. Each outbound request crosses Agent Proxy, which checks the destination against the credential's allowed hosts, the scope's allowed domains and the environment's network level. When a credential rule matches, the proxy fetches the secret from a separate store and attaches it. Anthropic's documentation says this happens "so the model and the sandbox itself are not given the key." Unmatched requests are blocked. Evidence lands wherever the request went, under the service account in each tool's own log.

Receipt gives the agent no identity of its own. Work runs for the linked user who asked, over connections the workspace owns. On the gateway path, the agent requests a named operation instead of calling the provider. The gateway re-checks the requester's membership and the connection's allowlist. It writes an intent receipt with the requester, workspace and full arguments, and refuses the call if that write fails. Then it calls the provider and records the outcome. These receipts are SHA-256 hash-chained. Runs are recorded the same way, and the runtime rebuilds their state from those records.

The trade-off cuts both ways. In Anthropic-hosted sessions, Agent Proxy governs all traffic leaving the sandbox, including requests from code Claude runs. Receipt's record covers gateway calls, not shell commands, native CLIs or model calls in its sandboxes. In exchange, it names who asked for each gateway call without consulting a second system.

Receipt vs Claude Tag

Here is how the designs compare on identity, credentials and evidence.

DimensionReceiptClaude Tag
Control pointGateway operation, recorded before the provider callAgent Proxy, between sandbox and network
Who acts in a channelThe requester's linked account, over workspace connectionsAdmin-provisioned service accounts; personal connectors run as the member
What downstream tools seeThe account that connected the appThe service account or Claude GitHub App
Credential pathIntegration server attaches it on gateway callsSeparate store; proxy injects it per request
Inside the sandboxA model API key; CLI connectors fetch credentials at command timeNo provisioned credentials; environment variables are readable
Network egressNo outbound network policy on task sandboxesDefault-deny plus trusted hosts; private and metadata addresses blocked
Tool permissionsPer-connection allowlists; writes off until enabledConnectors, repositories and domains bound to scopes
Checks before actingOptional approval before a whole runModel-based checker reviews each action in auto mode
Record of actionsHash-chained receipts per gateway call, naming the requesterTool audit logs, Slack thread, proxy export; no per-task log
ReconstructionReplay rebuilds run state; nothing re-runsAnthropic retains transcripts; no admin message export
Surfaces and MCPWeb, Slack, Teams, CLI; hosted MCP serverSlack today; MCP client through plugins

A Real-World Example

A revenue-operations channel asks the agent to move three deals to a new stage in the CRM and open a Jira ticket for legal review. A month later, finance asks who moved one deal and what exactly was sent.

Claude Tag. The channel's bundle holds a CRM credential for an admin-created service account, plus Jira access. Everyone in the channel acts through that account unless a task uses a member's personal connector. The thread's sandbox session runs in auto mode, with the permission checker reviewing each action. Agent Proxy attaches the CRM credential for the allowed host, paths and methods, so the key never enters the sandbox. In the CRM, the changes appear under the service account.

For finance, an admin starts in the CRM's audit log, which names the service account. The Slack thread shows who tagged Claude and who steered it. Anthropic keeps the session transcript, but admins have no page or export for its messages. An Owner can download hourly network-events files, which exclude Git and MCP traffic.

Receipt. The request starts a background run under the requester's linked account. If the workspace requires run approval, the run waits until the requester or a workspace owner approves it. The sandbox calls the CRM and Jira connections through the gateway, which permits the writes because an admin enabled them. The CRM credential stays in Receipt's integration server, but the sandbox holds a model API key and a task token that can request stored credentials. Before each call, the gateway records the requester, workspace and full arguments, then a result preview. Native CLI commands would fall outside this record.

For finance, a workspace admin opens the run from the receipt link in the thread. The replay lists each gateway call with its receipt, and the gateway activity view covers the last 30 days. The CRM shows the account that connected the app, not the requester.

Where Claude Tag Wins

On AI agent credentials and network egress, Claude Tag's documented design is stronger than Receipt's current one. Credentials stay in a separate store, and Agent Proxy attaches them per request, limited to hosts, path prefixes and methods. With federated access, the agent presents short-lived identity tokens, so Anthropic stores no long-lived secret for those systems. Sandbox egress is default-deny, and private ranges and cloud metadata endpoints stay blocked even under an allow-all rule. Receipt's sandboxes hold a model API key, its CLI-based connectors fetch credentials into the sandbox when a command runs, and it sets no outbound network policy on them.

Attribution downstream is cleaner too. Actions land under dedicated service accounts and the Claude GitHub App, and pull requests link back to their Slack thread. Repository work, code changes and pull requests are native. Routines cover schedules, channel watches and repository events. Channel members need no individual setup, anyone in the thread can steer, and spend limits apply per organization and channel.

Where Receipt Wins

Receipt's advantage is the record and the person it names. Each gateway call is attributed to the requester and recorded before the provider is called, or it does not run. Claude Tag names the requester when personal connectors run. For channel work under its own accounts, its audit documentation is direct: "There is no per-action log of every task and who asked; for that, use the trails below."

Receipt keeps that kind of per-call record for its gateway, one stream per workspace, as an AI agent audit trail admins can open directly. Receipts are SHA-256 hash-chained, so an edit or deletion inside a stream breaks the chain when verified. The runtime checks a run's chain before rebuilding its state, and the replay view walks the run step by step without re-running anything. Admins can print a replay or copy a receipt as JSON.

The same connections and record serve agents outside Slack: web chat, Teams, the CLI, and coding agents such as Claude Code, Codex and Cursor over MCP.

The limits are real. The record covers gateway calls, not sandbox shell commands or model calls. Receipts are unsigned: tamper-evident when verified, but no defense against database write access. Approval gates a whole run, not each call, and there is no bulk export.

Which Should You Choose?

Choose Claude Tag if your work lives in Slack and you want a shared agent with little setup. It is the better pick when keeping credentials away from the agent and limiting where it connects come first. It also suits engineering-heavy teams that want repository work, routines and channel spend caps, and that already watch downstream audit logs. Check its plan and data-retention requirements first.

Choose Receipt if you most need to answer who asked for an action and what was sent, from a record the system runs on. It fits organizations whose agents act from Slack, Teams, web chat and coding tools through one governed connection layer.

Use both when Claude Tag handles engineering work in Slack and Receipt governs the connections your other agents use.

Conclusion

A service account tells you which key turned. It cannot tell you whose request turned it. Claude Tag answers the first question cleanly and keeps the key away from the agent, which makes its credential model the stronger one today. Receipt answers the second by recording the operation, the person and the arguments before the call runs. Shared agents take instructions from whole channels, so that second question tends to arrive late, from finance or legal. By then, an answer recorded at the moment of action is easier to use than one reassembled from several systems.

Claude Tag details are based on its official documentation and announcements as of October 7, 2026; Receipt details reflect the product as shipped on that date. Both change quickly, so check the sources below for current behavior.

Sources