Permissions and Safety: What Cowork Asks Before It Acts

Cowork is designed to do real work on your files, which means it can make real changes. Understanding what it can and cannot touch, and how much control you keep, makes the difference between a productive session and a stressful one.

The folder boundary

Claude can only read and write files inside the folders you connect to a session. Anything outside those folders is out of reach, full stop. It cannot browse your desktop, reach into other directories, or access files on drives you have not explicitly shared. (Source)

This is the first and most important constraint. It means you can limit exposure before a session even starts. If you are working on a single project, connect only that project’s folder. If you want to experiment without touching live files, connect a copy instead.

The practical habit: when in doubt, work on a duplicate. Copy the folder, point Cowork at the copy, and you have a clean rollback path if something goes sideways.

Code runs in an isolated virtual machine

When Claude writes and runs code during a session, it executes inside an isolated virtual machine that is separate from your main operating system. (Source) A shell script or piece of code Claude runs cannot reach your system processes, installed applications, or anything outside the sandboxed environment.

This matters most when you ask Cowork to do something like process a batch of files with a script, run a build command, or automate a task. The code executes in isolation. Your actual operating system is not the execution environment.

That said, the code can still read and write to the folders you have connected. The VM boundary protects your system; it does not protect you from file changes inside the session scope. Those still happen, and they are real.

Two permission modes

Cowork offers two ways to supervise what Claude does during a session. (Source)

“Ask before acting” means Claude pauses and asks for your approval before each action. It is slower, but you see exactly what is about to happen before it does. This mode is recommended when you are new to Cowork, when you are working with files you cannot easily replace, or when you are trying something unfamiliar.

“Act without asking” lets Claude move faster, chaining actions without stopping at each step. It is useful once you trust the workflow and understand what Claude is doing. It is riskier because mistakes can compound before you notice them.

There is no shame in staying on “Ask before acting” indefinitely. The friction is the point. Approving each step keeps you in the loop and forces you to actually read what Claude is doing before it does it.

Start every new type of task in “Ask before acting.” Once you have seen the pattern a few times and know what to expect, you can decide whether the faster mode makes sense.

The deletion safeguard

One action that always requires your explicit permission: permanent file deletion. In both modes, before Claude deletes any file, you will see a prompt asking you to allow it. You have to actively approve. (Source)

This is not something you can accidentally bypass by switching modes. The safeguard applies regardless of how you have configured the session.

Still, “explicit permission” means you will be asked. It does not mean the delete cannot happen. If you approve without reading carefully, files can be removed. Treat every deletion prompt as a moment to slow down and verify the file path before you confirm.

Plans and approval steps

Before taking significant actions, Claude shows you a plan and waits for your approval. You can redirect the approach, ask for changes, or stop the session entirely before anything happens. (Source)

Read the plan. This is where most people go wrong: they skim the summary, assume it looks fine, and click through. The plan is where you catch a misunderstanding before it turns into a problem. If the scope is larger than you expected, or if Claude is proposing to touch files you did not mean to include, the plan step is where you catch it.

Consequential decisions are meant to stay with you. Cowork is built around human oversight, not around automating your judgment away. That only works if you are actually paying attention at the approval steps, not rubber-stamping them.

Habits worth keeping

A few things that make a real difference in practice:

• Start with a throwaway or copied folder until you understand how Claude approaches your type of task.
• Keep “Ask before acting” on for the first several sessions with any new workflow.
• Back up anything you cannot afford to lose before connecting it to a session. Cowork has safeguards, but safeguards are not a substitute for a backup.
• Read deletion prompts carefully before approving. The file path matters.
• If a plan looks bigger than what you asked for, say so. You can redirect before anything executes.

For a broader look at how Cowork handles data and what Anthropic’s safety commitments cover, see Is Claude Cowork Safe?. If something is not behaving as expected, the troubleshooting guide covers common session issues.

The next lesson covers connectors, skills, and scheduled tasks, where Cowork can reach into external tools and run work on a timer.