The previous article entitled "Managing Risks With AI Agents in Regulated Environments" looked at using general-purpose agents in regulated environments broadly. A lot of clients have been asking about Claude Cowork specifically, and want to understand how to use it safely within these environments.
Anthropic splits what Cowork can do into two buckets. Read tools let Claude see content, like scanning your inbox or taking a screenshot of your screen. Write tools let Claude do something, like creating a calendar invite, deleting a file, running a command, or clicking around your apps. Read tools can have issues when it comes to data privacy issues, and write tools have increased risk since they can actually modify things. So the whole safety question comes down to two things, what Claude can see and what Claude is allowed to do.
Cowork sessions run in an isolated, temporary environment on Anthropic's servers, and people hear "isolated" and assume their data stays put. Anthropic is clear that this isolation only limits where Claude's code executes. It does not limit what Claude sees or does through the access you granted. If you've connected a folder of deal documents, an isolated session can still open every one of them, and since the session lives on Anthropic's servers, whatever it opens gets processed there rather than staying on your machine.
Worth being precise about where the session actually lives, though, because there are now two answers. Sessions run remotely by default, with the agent loop and code execution on Anthropic's servers and the session and its files saved to the member's Claude account. Local execution remains available for existing desktop deployments, where the agent loop runs on the member's device and code runs in an isolated virtual machine on that same machine. The paragraph above describes a remote session. In a local session, the isolation boundary is a VM on the laptop, not Anthropic's infrastructure.
That distinction carries through to storage. For local sessions, Cowork stores conversation history on the user's machine, outside central retention policies and data exports, which is a real wrinkle for residency and retention. For cloud sessions, the session and its files are saved to the member's Claude account instead. For a firm with data residency requirements, those are the details to catch.
The guide gives the clearest framing I've seen on prompt injection. For an attack to work, two things have to be true at the same time. Claude can see something outside your trusted boundary, like a web page, an email, or a document with hidden instructions, and Claude can take an action that could hurt you. Break either one and the attack gets much harder. That's useful because it tells you exactly which knobs to turn. Either narrow what Claude can see, or narrow what Claude can do, and preferably both for sensitive work.
Cowork runs on Pro, Max, Team, and Enterprise. Both Team and Enterprise owners get org-level switches that individual plans don't. Either can stream Cowork events to a Security Information and Event Management (SIEM) system through OpenTelemetry, and either can turn off web search for Cowork and Chat, or shut off Claude in Chrome, from organization settings.
Start with the defaults, because they do the work if you don't. Cowork is on by default for the whole organization, and an owner has to turn it off. Running Cowork in the cloud is a separate toggle: on by default for Team, off by default for Enterprise, where an owner turns it on and then grants the capability to a group through custom roles. Claude in Chrome splits the same way, enabled by default on Team and disabled by default on Enterprise. So a Team admin has to act to close things down, while an Enterprise admin has to act to open them up.
Both plans also get the connector permissions setting, Allow "Always allow" for connector tools, which is off by default and forces per-task approval of write-capable connector tools. On Enterprise, the most restrictive layer wins, and custom role grants can't override it.
Enterprise adds device and remote-session controls Team doesn't have. Enterprise can disable plugin-bundled and locally configured MCP servers and block desktop extensions on managed devices. Remote sessions have their own settings, including turning off persistent always-allow and requiring trusted-device enrollment and a recent sign-in. Plugins can be curated through a marketplace on either plan, but only Enterprise can vary those preferences per group.
One very important point to note is that "not training on your data by default" is not an Enterprise-only feature. Anthropic does not train on commercial Claude for Work data by default, and that covers the Team plan too. What Enterprise actually adds on top is the compliance-grade layer we covered before, meaning audit logs, the Compliance API, US-only inference, custom data retention, SCIM, and finer-grained role-based access. A Team plan does not come with that same set.
It cuts the other way for personal accounts, though. Consumer Pro and Max plans now train on your data by default unless a user opts out, which is exactly why the personal-account leak scenario from the first article stings.
Regarding residence, Cowork and Claude Enterprise offer US-only inference but no EU data residency today, so a firm with EU or other residency obligations has another reason to constrain Cowork or build something custom.
Here's the part that surprises people, though, and it's the one place where Anthropic's own documentation currently disagrees with itself. The Cowork safety guide, the getting-started guide, and the OpenTelemetry article all say Cowork activity isn't captured in the Compliance API at this time, and the architecture overview goes further, saying it isn't captured in audit logs, the Compliance API, or data exports. But the Team and Enterprise page, which Anthropic updated more recently, says Cowork via mobile and web is captured in the Compliance API and links out to documentation on retrieving remote sessions. Read together, the most defensible reading as of late July 2026 is that local sessions sit outside compliance tooling and remote sessions are moving inside it. Confirm the current state with your account team before you build a control on either answer, because this is clearly in motion.
That matters for the plan question, because the Compliance API is Enterprise-only. If remote-session coverage is real and it sticks, Enterprise gets a compliance path for cloud Cowork that Team does not, and the two plans stop being equivalent here. What doesn't change is local sessions, where OpenTelemetry is the only stream on either plan. That gap stands out more, not less, when you notice Anthropic has since built a broad Compliance API integration ecosystem for the rest of Claude, spanning DLP, SIEM, eDiscovery, and identity vendors. The tooling around Claude keeps maturing, and local Cowork still sits outside it.
For local Cowork sessions, then, Team and Enterprise are close on logging and audit, since the Compliance API doesn't reach them either way. On access control, though, Enterprise is meaningfully ahead. On Enterprise, admins use groups and custom roles to scope Cowork to specific users and teams, and to layer connector-tool approvals per group. A Team plan has no such granularity and can only switch Cowork on or off across the whole org.
The Enterprise controls matter a lot for the rest of Claude. For non-Cowork activity, OpenTelemetry alone won't capture claude.ai web use or traditional audit events like logins, permission changes, and org admin actions, so on Enterprise the Compliance API and OpenTelemetry together give you fuller coverage. For local Cowork sessions, though, you're leaning on your own logging stack no matter which plan you're on.
So don't assume upgrading to Enterprise hands you a clean Cowork audit trail. OpenTelemetry is a real-time telemetry stream, not the equivalent of compliance audit logging. Both plans leave the same gap on local sessions, and you close it with tooling you set up. Account for one more thing before you roll out: EDR tools can't inspect activity inside the VM, and remote sessions run entirely outside your endpoints, so endpoint visibility doesn't fill the gap either.
None of this means Cowork has no place in a regulated firm. It means you configure it deliberately before you trust it. A few steps that get you most of the way:
Limit what Claude can see. Make a dedicated working folder instead of pointing Claude at broad access, and keep financials, credentials, and personal records out of it. Keep backups of anything important, since Claude can write and permanently delete files it can touch.
Match approval mode to the stakes. Cowork has manual approve, auto approve, and skip all approvals. Use manual approve any time the task touches sensitive files, money, or a tool you haven't used before. Auto mode still screens each action for safety, but skip all approvals checks nothing. Claude always asks before it permanently deletes a file, in any mode.
Lock down connector tools and network egress. The org setting Allow "Always allow" for connector tools is off by default, so leave it there and members have to approve write-capable connector tools on every task. And before you enable Cowork, review the network egress permissions under organization settings and capabilities, since Cowork honors those egress rules when a session is created. Two limits to know. Changes you make while a conversation is already running don't take effect until a new session starts. And egress permissions don't apply to web fetch, web search, or MCPs, including Claude in Chrome, so the allowlist you built is not the whole boundary.
Go slow on scheduled tasks. They run when you're not watching, even with your computer off. Start with low-risk summaries, keep sensitive data and consequential actions out of them, review the output after each run, and pause the ones you aren't using.
Know where computer use sits. Team and Enterprise plans don't have access to it today, and it's in research preview on Pro and Max. That makes it a shadow-IT question for a firm rather than a configuration one, since an employee with a personal Pro or Max account can run it on a work machine. Understand the shape of it either way. When Claude works your screen directly, there's no sandbox between it and your apps, it takes screenshots to see what it's doing, sensitive apps like banking and healthcare portals should be blocked, and if it clicks a link, that link opens even in an app you never approved.
Keep web and browser access tight. Only give internet access to sites you trust, since web content is the main way injection gets in. Team and Enterprise owners can switch off web search in org settings, and Anthropic flat out advises against using Claude in Chrome for anything sensitive.
Turn on OpenTelemetry from day one. If you're on Team or Enterprise, stream Cowork events into your SIEM so there's a record living somewhere other than each user's laptop. You configure it in Claude Desktop under organization settings and Cowork, and it needs Claude Desktop 1.1.4173 or later, so check that before you rely on it. Configure redaction at your collector before you route anything downstream, because prompt text is included in events by default, tool parameters can carry file paths and command arguments, and user email addresses ride along in event attributes. Turned on without that step, it opens an exposure while closing one. It isn't full compliance logging, but it beats having nothing and gives your compliance team something to look at.
Vet MCPs and plugins. Each one widens what Claude can do, and a single plugin can bundle several capabilities together. Only install ones you trust.
Watch the Office add-ins. When the Claude for Excel and PowerPoint add-ins are used alongside Cowork, Claude can read, edit, and pass context between those applications without you explicitly directing the transfer. Keep sensitive workbooks closed while a Cowork session is running.
Cowork is reasonable for the low-risk work: internal research, drafting, summarizing public filings, organizing notes. However, once a task touches LP data, deal terms, portfolio financials, or anything a regulator will end up reading, the out-of-the-box product still puts the compliance burden on you, and an Enterprise upgrade changes that only partly for Cowork, on the remote-session side, and only if the newer documentation holds. That's when a custom agent with a real audit trail and deterministic guardrails is important.