Set up Cloud Tag

You set Cloud Tag up once for your organization. After that, adding the agent to another Google Group takes a minute, and everyone in that group can use it with no setup of their own.

Use the copy icon beside an agent or group address, a setup command or the webhook URL to copy it. Documentation examples have the same icon at the top right.

What you need

  • A Google account to sign in with. You become the Owner of the organization you create.
  • An Anthropic API key with Managed Agents access. Every agent in your organization runs on it, in your own Anthropic account: agents, sessions and spend all live there.
  • A dedicated mailbox for the agent, such as cloud@yourcompany.com. It's the agent's identity: its address is what you add to groups, and its name is what people mention. Which groups it can join depends on the kind of mailbox:
    • A Google Workspace mailbox joins only groups on its own domain: cloud@yourcompany.com can join sre@yourcompany.com.
    • A personal Gmail account joins only public groups on googlegroups.com.
  • Owner or manager rights in the Google Groups you want to add it to.
  • DKIM signing on your Workspace domain (Google Admin console → Apps → Google Workspace → Gmail → Authenticate email). The agent believes group mail only when Gmail confirms the group's domain sent it.

1. Create an organization

Sign in to Cloud Tag with Google. The first time anyone signs in, Cloud Tag creates an organization for them and opens its page. You can rename it under Defaults for every group, and create more organizations from Organizations.

2. Add the API key

Under 1. Anthropic API key, paste the key and click Check and save. Cloud Tag checks that it works and stores it encrypted. Only its last characters are shown afterwards.

Under 2. Agents, click Link a Gmail mailbox, sign in as the agent's mailbox, and allow Gmail, Google Drive and group-member access. Drive access is read-only, and lets the agent open the Drive files each group can reach. Member access is read-only too: the agent answers only the group's members. The mailbox becomes an agent called Cloud, mentioned as @cloud (mentions ignore case).

Open the agent to set:

  • its @name, which people mention;
  • its model and effort, if they should differ from the organization's defaults;
  • instructions for it in every group it's in.

You can link several mailboxes. Each is a separate agent with its own @name.

4. Set a spend limit

Under Spend limits, set a monthly limit for the organization and a default limit per group. See Set a spend limit.

Add the agent to a group

  1. In Google Groups, open the group's Members → Add members.
  2. Turn on Directly add members, add the agent's address, and type a welcome message: Google sends its "You have been added" notice only when there is one. An invitation doesn't work: the mailbox can't click Accept.
  3. Set the agent's delivery to Each email, and make sure its posts aren't held for moderation.
  4. In the group's settings, send replies to the group. Otherwise Reply on the agent's post addresses the agent itself, and it may not be able to verify that copy. See Reply to the group.
  5. Google emails the mailbox "You have been added to …". Within a minute, every Owner and Admin of your organization gets a private email asking Should Cloud join …?, with Yes, join and No links. The notice is found even if Google filed it as spam.
  6. Open the link and click Yes, join on the page it opens. The agent is on for the group. Current organization Owners and Admins can manage it; activation does not create a separate Group-admin grant. No takes the agent out of the group. Links expire after 14 days.

If you added the agent without a welcome message, post @cloud connect to the group, or just mention @cloud there. Your Owners and Admins get the same Yes / No email. An Owner or Admin can also open the group in Cloud Tag and click Turn it on now on its Overview.

If the mailbox was only invited, it emails your Owners and Admins how to add it directly instead. If the group is on a domain the mailbox can't join, they get an email saying why.

Each agent in a Google Group is set up there on its own, even agents from different organizations: each one asks its own Owners and Admins, and answers only once they say Yes. Each organization sees only its own agent's copy of the group.

5. Check that it works

Post to the group:

@cloud !help

Within a minute or two it replies in the thread with its commands. Then try a real request:

@cloud what can you access from this group?

If nothing comes back, see Troubleshoot setup.

6. Configure the group

Open the group from Groups, or click Configure in any reply's footer. From there you can:

  • write the group's instructions and choose when it replies (Customize);
  • add connectors, secrets and network access (Give it access to your tools);
  • add files, import past mail, add other admins, and set routines.

Optional: faster turns

Add a webhook in the Anthropic Console for your key's organization, pointing at https://<your Cloud Tag domain>/webhooks/anthropic, for session.status_idled, session.requires_action and session.status_terminated. Paste its signing secret on the organization page. Without it, agents still answer; long turns are picked up by a poll each minute.

Optional: import past mail

The agent sees only mail sent after it joined. To give it the group's earlier history, export it as an mbox (for example a member's Google Takeout of the group's Gmail label) and upload it on the group's History page. Imported mail is searchable; the agent never replies to it. Each upload must be under 4 MB, so split large archives.

Organization Owners and Admins choose which groups may update an agent's shared notes on the organization page. Earlier checked settings need approval again; Group admins cannot grant this permission. Review existing shared notes before approving a writer.