Configure per-group access with bundles

A bundle is a named set of instructions, connectors, skills, secrets and GitHub repositories that applies to several groups at once. Use one when a set of groups needs the same tools, such as every incident group or every group on one team, without setting each up by hand. They work like Claude Tag's bundles and scope rules.

Owners and Admins manage bundles on the organization's Bundles tab.

Make a bundle

  1. Under New bundle, give it a name and create it.
  2. Under Where it applies, and its instructions, choose any of:
    • Group address patterns, one per line. * matches any characters and ? one: inc-* matches inc-db@yourcompany.com.
    • Every group these agents are in: tick an agent to apply the bundle wherever that mailbox answers.
    • These groups: tick groups by hand.
  3. Add instructions if the bundle's groups share standing guidance.
  4. Add its connectors, GitHub repositories, custom skills and secrets, as on a group's pages.

The page lists the groups it applies to now. New groups that match a pattern or an agent pick it up as they join.

How access stacks

A group gets everything from its organization, every bundle that applies to it, and its own settings:

Setting How they combine
Instructions Added in order: organization, agent, each bundle, then the group
Connectors All of them. For the same server, the narrowest wins: the group's own connection, then a bundle's, then the organization's. Between two bundles, the first by name wins
Repositories All of them, with the narrowest winning for the same repository
Skills All of them
Secrets All of them. A variable name can be set in only one place for a group, so Cloud Tag refuses a second one

A group's own connection can replace a wider one only with its own sign-in or token. A connection with no sign-in can't override a wider one that has one, since it would otherwise use the wider account under the group's permissions.

Each group's pages list what it gets from the organization under From the organization, and mark anything its own settings replace.

An agent attaches up to 20 MCP connectors and 500 unique skills, including inherited resources and built-in skills. Built-in skills come first, then the group's resources, bundles by name, and organization resources; resources within a scope are ordered by name. The group's Connectors and Skills pages name any capacity omissions, including those from bundles. Turning off an included resource frees a place for the next one. Duplicate attached skill IDs count once, with the narrowest scope's version winning. Repository-discovered skills also count toward the provider's session limit and are additional to this attached-skill selection.

Delete a bundle

Delete bundle first withdraws it from affected groups and retires their old sessions and its owned credentials. Cleanup remains pending during provider outages; confirm deletion again once it finishes. New writes to a deleting bundle are refused. Other groups' inherited credentials are preserved.