Dittwo vs Claude Tag: Channel Access vs Employee Identity

The short version

Anthropic built the same credential architecture we did, and we are not going to pretend otherwise: Claude Tag's sandbox holds no keys, its Agent Proxy injects them at the network boundary, and egress is default-deny. The difference is whose permissions the agent carries. In Claude Tag access belongs to the Slack channel, and Anthropic states that a channel member can therefore reach things they personally cannot. In Dittwo it belongs to the employee. If your work lives in Slack channels and you are an Anthropic shop, Claude Tag is excellent. If an agent's reach has to match a person's, or the whole system has to run on your own infrastructure, that is us.

Start with the part least convenient for us. Anthropic's agent identity post says the credential is "stored independently and mapped to that channel's identity, then injected at the network boundary at request time," and unlisted hosts are "blocked outright." That is the architecture this entire site argues for. Against Claude Tag it is not a differentiator, it is agreement: when the frontier lab shipped a team agent, they put the credentials outside the box too.

Dittwo

Claude Tag

The real difference: whose permissions?

Claude Tag's unit of access is the channel. An admin provisions service accounts, attaches them to a channel, and everyone in that channel shares them. Anthropic is direct about the consequence, in their words: "a channel member without direct access to the repo can ask Claude to read that repo, if the channel's profile grants Claude that permission."

Dittwo's unit of access is the employee. Each person's agent is scoped to what that person already has, so support cannot reach payroll by asking nicely. Nothing widens when someone joins a channel.

Neither answer is careless. Theirs solves a real problem: with four people steering one agent, whose permissions should apply? "The channel's" is defensible and it makes multiplayer work. It also means a public channel with a bundle attached grants that access to anyone who joins. Anthropic lists the fix as future work, an "identity-aware overlay." Until it ships, the compartment is the boundary.

Approvals: shipping versus planned

Claude Tag has spend limits, per-channel scoping, host allowlists, and a full audit trail. What it does not have yet is a hold on an individual action. Anthropic names it under what's next: "just-in-time credential grants, so that a user can approve a single sensitive action in the moment." That describes what Dittwo approvals do today. The agent works up to the sensitive step, the gateway holds that request, and a named person releases it. The refund waits; the check that led to it does not. Both products can say no to a whole capability. Only one can say "not this one, not yet."

How they differ

Dittwo

Claude Tag

Where they agree

Credentials in the sandbox

DittwoNone. Placeholders inside, real keys injected at the wire, model key included

Claude TagNone. Credentials live in a separate store and are injected by Agent Proxy at the network boundary

Same architecture, independently arrived at.

Egress

DittwoDefault-deny at the container network: the gateway and its runner are the only reachable destinations

Claude TagDefault-deny: unlisted hosts are blocked outright rather than merely unauthenticated

Both make bypassing the checkpoint impossible rather than discouraged.

Whose access the agent carries

Unit of access

DittwoThe employee. Each agent is scoped to what its person can already reach

Claude TagThe Slack channel. Service accounts are attached per channel and shared by everyone in it

The largest difference, and the one that decides most evaluations.

Can the agent exceed its human?

DittwoNo. An agent is a scoped extension of one person and cannot outrank them

Claude TagYes, by design: "a channel member without direct access to the repo can ask Claude to read that repo"

Anthropic calls this necessary for multiplayer. It is also an escalation path in a public channel.

Per-request approval

DittwoShips today. The gateway holds one request for a named human while the rest of the work proceeds

Claude TagOn the roadmap: "just-in-time credential grants" are listed under what is next

Until then the choice is granting a capability or withholding it, nothing between.

Memory boundaries

DittwoPer-employee memory in a sealed personal layer; the shared layer is what the company publishes deliberately

Claude TagPublic-channel memory is workspace-wide, and Claude can keyword-search public channels it was never added to

Their docs put it plainly: "isolating a credential doesn't isolate what Claude knows."

Where it runs and what it costs

Surfaces

DittwoWeb, Slack, and the terminal, with one identity and one audit trail across all three

Claude TagSlack today, with Microsoft Teams on a waitlist

They are deeper in Slack. We are the only one an engineer can reach from a shell.

Models

DittwoModel-agnostic across 25+ providers, or bring your own keys, with the key still never entering the sandbox

Claude TagClaude only, on Anthropic's first-party service

Reasonable from a model company, and still a single-vendor dependency.

Deployment

DittwoDittwo Cloud, or the whole system on your own infrastructure on the Enterprise plan

Claude TagAnthropic-hosted only. Not available for third-party deployments, and unavailable to organizations with Zero Data Retention enabled

For a regulated org this decides it before any feature does. The ZDR exclusion is worth checking early: retention is required for channel memory, so the strictest orgs are out.

Pricing shape

DittwoPer user and per agent, with models included or BYO keys

Claude TagNo per-seat charge. Channel work draws from a usage balance with an admin-set spend cap; DMs bill to the sender's own seat

Usage billing is friendly for a pilot and harder to forecast for a fleet. Different risk, not a better deal.

Running both

These are less mutually exclusive than the table suggests. Anthropic runs their own product team on Claude Tag and reports 65% of that team's code coming out of it. Split by whether the work belongs to a room or to a person. Collaborative triage in a channel, where everyone should see it and any of them could pick it up, is Claude Tag's shape. Work scoped to one employee's accounts, or touching a step somebody has to approve, is ours. A Dittwo agent can also call the Anthropic API through the gateway like any other service, so using Claude as the model does not require adopting the access model.

When to use which

Use Claude Tag when

Your team's work genuinely happens in Slack channels and should stay visible to the room
You are already a Claude Enterprise or Team customer and want the deepest Claude integration available
Multiplayer is the point: several people steering one agent on one thread
Channel-scoped service accounts match how you already think about access
You want Anthropic to host and operate the whole thing

Use Dittwo when

An agent must never reach something its human could not reach directly
You need to hold one sensitive action for approval without switching off the capability behind it
People need their agent from a terminal or the web, not only from Slack
You want to choose the model, or change it later, without changing platforms
Zero Data Retention, self-hosting, or reading the source is a requirement rather than a preference

Common questions

Anthropic built the same credential model. Doesn't that undercut your pitch?

It confirms the pitch and removes it as a differentiator against this one product, which are different things. The frontier lab shipping exactly what we argued for is the strongest validation the model could get. It just means the argument here has to be about identity rather than keys.

Is the channel access model actually a problem?

It is a deliberate trade, and Anthropic documents it rather than hiding it. In a private channel scoped to its least-privileged member it works well. The risk is a public channel with a bundle attached, where the access belongs to anyone who joins. If your compliance story is written in terms of people, a compartment-based model is hard to map onto it.

Can I use Claude models with Dittwo?

Yes, and it is a common setup. The Anthropic key lives in Dittwo and gets injected at the gateway per request, so the sandbox runs on a placeholder. Model spend is metered per employee as a side effect, and you can switch models later without changing how access works.

Does Dittwo work in Slack too?

Yes. Each employee's agent is reachable in Slack with the same identity, permissions, and audit trail it has on the web and in the terminal. The difference is that Slack is a way to reach a person's agent, not where its permissions come from.

What does Claude Tag do better?

Multiplayer, and depth in Slack. One agent per channel that everyone can watch and redirect mid-task is a good design for collaborative work, and we have no equivalent. Their ambient behaviour, surfacing a stalled thread without being asked, is also ahead of us.

Can we run this entirely on our own infrastructure?

Yes, and this is the clearest split between the two. Dittwo is self-hostable on the Enterprise plan, so the agents, the gateway, and the audit log can all sit inside your own network with no data leaving it. Claude Tag is Anthropic-hosted only and is not available for third-party deployments. If on-prem is a requirement, the comparison ends here.

The longer version of the enforcement argument is in why an MCP gateway cannot see most of what your agent does, and the shape of the product is on the product page.

Also compared

Dittwo vs Grok BotGrok Bot hires you new digital teammates, each with its own computer and its own logins. Dittwo gives every employee you already have an agent, and the sandbox holds no credentials at all.Dittwo vs HermesHermes is a single-tenant personal agent that holds your credentials. Dittwo is one agent per employee, and the sandbox holds none.Dittwo vs OpenClawOpenClaw gives one person an agent with the run of their machine. Dittwo gives a company one per employee, with nothing it can steal.

Dittwo vs Claude Tag