Claude Cowork: Setup, Approval Modes, and Safe Delegation¶
For / Key Points
For: People and administrators delegating file, document, browser, or connected-service work to Claude
Key Points:
- Cowork exposes a Claude Code-derived agent architecture without requiring a terminal
- Remote work can continue with the computer closed, but local files and computer use require Desktop connectivity
- Auto approval includes safety classification but is not perfect; keep irreversible work on Manual
Claude Cowork plans, executes, and returns multi-step work through a conversational interface. It can create documents, organize files, research the web, and work through connectors.1
Calling it “Claude Code for non-developers” is a useful introduction but no longer a complete description. Cowork now spans macOS and Windows Desktop, web, and mobile, and supports remote sessions and scheduled tasks.1
Current availability¶
| Item | Current condition |
|---|---|
| Plans | Pro, Max, Team, Enterprise |
| Desktop | macOS and Windows |
| Other surfaces | Web and mobile, including beta rollout |
| Main capabilities | Plans, subagents, documents, connectors, browser actions, scheduled tasks |
Availability can vary by account rollout and organization policy. If Cowork is absent, check the plan and administrator settings as well as the app version.1
Separate remote and local work¶
Cowork combines sessions on Anthropic infrastructure with operations routed through Desktop.
| Work | Continues with Desktop closed | Requirement |
|---|---|---|
| Research and generation inside a remote session | Yes | Remote account session |
| Cloud-service work through a connector | Depends on configuration | Active connector and authentication |
| Local file access | No | Claude Desktop open and connected |
| Local browser or computer use | No | Claude Desktop open and connected |
Remote conversations, attachments, and outputs follow the account. Access to folders and applications on a computer exists only while Desktop is connected.1
Start with a bounded task¶
Delegate reading and drafting before granting mutation rights.
Read the invoice PDFs in this folder.
Create a table with date, vendor, amount, and items needing review.
Do not move, rename, or delete source files.
Mark unclear values as “needs review” instead of guessing.
Include four elements:
- Scope: Folder, service, and time range
- Deliverable: Table, document, or draft
- Prohibited actions: Deletion, sending, publishing, or purchasing
- Completion checks: Counts, duplicates, and unresolved fields
Review the proposed plan before execution and narrow an overly broad scope early.
Choose an approval mode¶
Cowork provides Manual, Auto, and Skip modes.1
| Mode | Behavior | Recommended use |
|---|---|---|
| Manual | Confirms operations before they run | First runs, external sends, deletion, publishing, sensitive data |
| Auto | Automatically approves operations that pass safety classification | Repetitive work with a tightly limited impact radius |
| Skip | Skips confirmation and safety checks | Only in a separately isolated test environment |
Auto includes a classifier intended to stop dangerous operations, but no classifier is a perfect defense. Skip removes the checks, so it is inappropriate for a normal work computer or production account.1
Scheduled tasks¶
Cowork can create recurring tasks through /schedule. Scheduled tasks run remotely and can execute while the computer is closed.1
Before scheduling, run the same instruction manually and verify that it:
- Exits safely when there is no input
- Does not duplicate posts or records when rerun
- Uses a fixed and reviewed destination for external sends
- Makes no partial changes after failure, or can be retried safely
Automation repeats mistakes as reliably as correct work. Separate draft generation from human approval before removing supervision.
Organization controls¶
Cowork may hold broader authority than an ordinary chat. Add organization-level boundaries:
- Restrict connectors and local access to teams that need them
- Default to Manual and define criteria for Auto
- Use least-privilege service accounts for important systems
- Consider OpenTelemetry monitoring on Team and Enterprise
- Account for Cowork activity not currently appearing in the Compliance API
Anthropic warns that agents and internet access introduce risks beyond ordinary conversations.1 Design for instructions embedded in pages, incorrect plans, and excessive permissions.
Summary¶
- Cowork delegates multi-step work without a terminal
- Treat remote sessions and Desktop-dependent local access separately
- Keep first runs and irreversible actions on Manual
- Validate retry safety before scheduling a task
The goal is not to remove every review. It is to delegate research, organization, drafting, and repetitive operations while keeping human decisions at the right boundaries.