# Claude Cowork Integration > Desktop agentic productivity layer for healthcare lakehouse: implementation guide, department workflows, and compliance boundaries - **Category**: scaling-agentic-ai-healthcare-lakehouse - **Canonical URL**: https://designpattern.fyi/scaling-agentic-ai-healthcare-lakehouse/claude-cowork-integration/ --- ## Description Desktop agentic productivity layer for healthcare lakehouse: implementation guide, department workflows, and compliance boundaries ## Additional Notes # Claude Cowork Integration for Healthcare Lakehouse Claude Cowork is Anthropic's desktop agentic system for knowledge work — file organization, report assembly, spreadsheet analysis, and document synthesis. It operates on local files, folders, and connected applications, completing multi-step tasks with user-defined goals and approval gates.
Critical Compliance Boundary: Anthropic's Business Associate Agreement (BAA) explicitly excludes Cowork from coverage. This is a standing exclusion, not a gap that will be resolved with future features. Cowork must never see PHI under any circumstance — only de-identified or aggregated data from Gold/Diamond layers.
--- ## What Cowork Is — and Where It Sits in This Architecture Claude Cowork is a desktop agent that operates on local files, folders, and connected applications. You give it a goal instead of a single prompt; it plans a sequence of steps, shows you the plan, and executes across documents, spreadsheets, presentations, and connected tools until it produces a finished deliverable. It is not a chat window — it has permission to read, edit, and create files in the folders and connectors you grant it access to. This is an important distinction for how it fits into the 5-tier Medallion platform (Bronze → Silver → Gold → Diamond → Platinum): - **Cowork is a productivity layer for the people who build, curate, and operate around the platform.** Radiologists, lab directors, pharmacists, nurse managers, and operations analysts use it to compress hours of manual document work into minutes. - **Cowork is not the Platinum-layer agent runtime.** The governed, audited, Supervisor-Critic multi-agent system that autonomously flags critical values or activates STEMI protocols stays on the API/Agent SDK with strict tool contracts and an immutable audit ledger. Cowork does not have that governance model — it asks for your approval before consequential actions, but that's a UX safeguard, not a compliance one. ### Cowork's Role at Each Medallion Layer
Layer Access Level Data Protection Gate What it actually does
Bronze 🚫 No Access N/A — raw PHI never leaves the Bronze perimeter. On-premise PHI Redaction via Gemma sidecar strips identifiers before any payload exits the hospital network. Raw device telemetry and PHI-bearing streams never enter a Cowork-accessible folder.
Silver ⚠️ Indirect Only PII Redaction (permanent removal of direct identifiers via NER pipeline) + Anonymization (generalization of quasi-identifiers — age→bands, zip→region prefix) enforced at the Silver boundary before any export is made available. Data stewards export de-identified schema samples from Delta/Cosmos DB; Cowork checks the export for null-policy violations, format drift, and flags anomalies in a review memo. It never has folder or connector access to the live Silver store itself — only to what's already been exported and de-identified.
Gold ✅ Full Access Masking (format-preserving placeholders for analytics fields), Pseudonymization (HMAC-based aliases enabling cross-record joins without exposing identity), Tokenization (vault-backed token swap for any residual identifiers) — all enforced by the Silver→Gold ELT pipeline before KPI materialization. Data reaching Gold contains zero raw PII. Cowork is well suited to turning exported Gold-layer CSV/Excel extracts (KPIs, star-schema rollups) into narrative reports, slide decks, and recurring briefings.
Diamond ✅ Full Access PII Redaction on clinical text via NER before embedding, Anonymization (suppression and generalization on quasi-identifiers in structured fields), Synthetic Data generation for testing and QA against the Diamond RAG index — ensuring the vector store and document library contain no recoverable PII. Before documents (protocols, guidelines, SOPs) are embedded into the vector index, Cowork can organize, deduplicate, standardize formatting, and flag stale versions in the source document library. It does not run the embedding pipeline itself.
Platinum 📝 Limited Tokenization (all audit ledger references use vault-backed opaque tokens — no raw patient identifiers in execution traces), Differential Privacy (mathematically calibrated noise on aggregated metrics in exported reports). Cowork can draft and version tool-contract documentation, Supervisor-Critic evaluation rubrics, and audit-report summaries from exported ledger extracts — but it never executes the governed clinical actions itself.
⚠️ Critical Note: Every "yes" and "indirectly" in this table depends on the data already being de-identified before Cowork sees it. The "Data Protection Gate" column shows the specific techniques enforced at each layer boundary — this is not optional hardening, it's the only configuration that's compliant, since Cowork currently has no BAA coverage under which PHI could reach it at all.
--- ## Data Protection Pipeline — What Happens Before "Full Access" The reason Gold and Diamond can grant Cowork full access is that **every record has already passed through a multi-technique data protection pipeline** before it reaches those layers. The pattern is a **sanitize → process → verify** loop enforced by Pre-LLM and Post-LLM hooks deployed as sidecar containers at each tier boundary.
For the complete technical implementation — including code examples, vault architecture, compliance mapping (GDPR, SOC 2), and decision frameworks — see the full Data Protection & Privacy Techniques reference.
### The Six Core Techniques Applied Across the Medallion Layers
🎭 Masking ↩️ Reversible

Replace sensitive values with structurally consistent placeholders while preserving format for testing and analytics. Insurance member IDs become ****-****-1234, emails become j***.d**@corp.com. Masking can be static (reproducible) or dynamic (non-reproducible) — Gold-layer analytics pipelines typically use static masking to enable consistent downstream lookups.

Applied at: Silver→Gold ELT pipeline for format-sensitive analytics fields.

🔒 Anonymization 🔒 Irreversible

Irreversible removal or transformation of personal data so individuals cannot be re-identified, even with additional data sources. Techniques include generalization (Age 34 → 30–39), suppression (field removed entirely), data swapping, and noise addition. Under GDPR, fully anonymized data ceases to be personal data.

Applied at: Silver boundary exports and Diamond structured fields before embedding.

🔑 Tokenization ↩️ Reversible

Replace sensitive values with random, opaque tokens stored in a secure vault (HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault). Tokens carry no structural resemblance to originals and cannot be reverse-engineered — the vault is the only authoritative mapping. Enables controlled reversibility under strict access governance.

Applied at: Silver→Gold pipeline for residual identifiers; Platinum audit ledger references.

🏷️ Pseudonymization ↩️ Reversible

Replace identifiers with artificial aliases (HMAC-based digests, study codes, internal reference numbers) while maintaining separate keys for re-identification under strict governance. Deterministic pseudonymization enables cross-record joins without exposing identity — critical for longitudinal analytics.

Applied at: Silver→Gold pipeline for patient/encounter references that need cross-record correlation.

✂️ PII Redaction 🔒 Irreversible

Permanent, irreversible removal of sensitive personal information from documents and records. Unlike masking (which preserves format) or tokenization (which preserves reference), redaction eliminates the data entirely. Production-grade redaction uses NER models (spaCy, Amazon Comprehend, Google Sensitive Data Protection, Microsoft Presidio) — not regex alone.

Applied at: Bronze edge (Gemma sidecar), Silver boundary exports, Diamond clinical text before embedding.

🧪 Synthetic Data

Generate statistically faithful test data with zero real PII exposure for prompt engineering, QA, model training, and pipeline testing. Approaches include rule-based synthesis (Faker), statistical model-based synthesis (SDV/CTGAN), LLM-based generation, and differential privacy. If the purpose is testing — don't use real data at all.

Applied at: Diamond RAG index testing/QA, Platinum agent evaluation pipelines.

The compliance equation: "Full Access" at Gold and Diamond does not mean "unrestricted access to patient data." It means Cowork has full access to data that has already been irreversibly de-identified through the techniques above. The de-identification is verified at each tier boundary — there is no fallback if something slips through, because Cowork operates outside BAA coverage entirely.
--- ## Foundational Setup (Do This Once Before Any Department Playbook)

🔌 1. Connector Strategy

Cowork reaches for connectors first, falls back to the browser (via the Claude for Chrome extension) when there's no direct integration, and only touches the screen (computer use, research preview) as a last resort.

Recommendation: Build one internal MCP connector that exposes a small, well-defined set of read-only endpoints against the Gold and Diamond layers.

Example endpoints:

This connector should call through the same Apache Trino / vector-search services already running in the lakehouse and should inherit Apache Ranger's existing row/column/department policies. Cowork never gets its own, separate access path into the data platform — it uses the same governed path everyone else uses.

📁 2. Folder Scoping per Department

Create a shared-drive (SharePoint, Google Drive, or on-prem file server) folder tree, one root per department, each containing only:

Security Pattern: Grant each department's Cowork users access only to their own folder tree. This is the same least-privilege pattern already used for Silver-layer partitioning (/TenantID/DepartmentID) — just applied at the file-share level.

🧩 3. Private Plugins per Department

A Cowork plugin bundles skills (templates, tone, department conventions), connectors, and sub-agents into one install.

Recommendation: Build one plugin per department (or one plugin with department-specific skill modules) so that a radiology analyst opening Cowork gets radiology report templates and the radiology-scoped connector by default, without re-explaining context every session.

Use the private plugin marketplace (available to Enterprise admins) rather than ad hoc prompting.

✅ 4. Approval Posture

Cowork's default behavior is to show a plan and wait for approval before significant actions; org admins can also grant permission to act without approval for lower-stakes, well-defined tasks.

Default Setting: Keep approval-required as the default everywhere, and only relax it for narrowly scoped, non-PHI, fully reversible tasks (e.g., "reformat this KPI CSV into a chart" — not "email this to the department head").

☁️ 5. Deployment Path

Cowork is accessible via a standard Claude account or through the organization's existing cloud provider relationship (Amazon Bedrock, Google Cloud Vertex AI, or Microsoft Foundry).

Recommendation: If the lakehouse is already deployed cloud-agnostically across AWS/Azure/GCP/on-prem (per the platform's design principles), route Cowork through whichever cloud the organization already has a signed agreement and data-residency posture with, rather than defaulting to a direct Claude account.

⚠️ 6. BAA Boundary as Hard Constraint

Anthropic holds SOC 2 Type I & II, ISO 27001:2022, and ISO/IEC 42001:2023, and offers a HIPAA-ready configuration with a Business Associate Agreement — but that BAA is granted surface by surface, not as blanket coverage for everything Claude touches.

⚠️ Critical: Per Anthropic's own BAA documentation, Cowork is explicitly excluded from BAA coverage: it's available to use, but any organization enabling it is responsible for ensuring it isn't used in a way that violates their compliance obligations. This is not a rolling-out-soon audit-log gap — it's a flat exclusion with no current path to coverage, regardless of retention settings.

Practical Implications

Connector Consideration

The internal MCP connector deserves a second look under this same lens: connectors are usable under BAA, but data flowing through them to a third party isn't covered. If the connector only talks to your own internal Trino/vector-search services, that's not a third party in the relevant sense — but confirm with whoever owns your BAA relationship with Anthropic, since it's a legal determination, not a technical one.

Audit Logging

Separately — and lower stakes — Cowork activity streams tool calls, file access, and approval states to an organization's SIEM via OpenTelemetry, but Enterprise audit logs and the Compliance API don't yet capture it. Route that OpenTelemetry stream into existing SIEM/GRC tooling and review on the same cadence as other access logs.

Important: Don't mistake fixing the audit gap for solving the compliance question — even with full audit visibility, Cowork still sits outside BAA coverage. Verify current terms directly with Anthropic (trust.anthropic.com and your account team) before scaling Cowork into any workflow near regulated data — coverage details change, and this document isn't the source of truth for that.
--- ## Department Playbooks Each playbook lists: who uses it, what it connects to, and a step-by-step sequence of concrete tasks. Each ends with an explicit guardrail — what Cowork should *not* be used for in that department. ### Radiology
🩻 Radiology Cowork Workflow
Users: Radiology department analyst, imaging operations manager, radiology IT
Connects to: Gold radiology KPI exports (TAT, RVU, critical-finding notification time), Diamond RAG connector scoped to de-identified report corpus, RIS/PACS worklist CSV exports (metadata only)
Step by step:
  1. Point Cowork at the `radiology/gold-exports/` folder containing the weekly TAT and RVU CSVs produced by the existing Airflow DAG.
  2. Task: *"Read this week's TAT export, flag any modality where p95 turnaround exceeds target, and draft a one-page variance report with a chart."* Cowork proposes a plan (read file → compute variance → generate docx with embedded chart), you approve, it writes the output to `radiology/working/`.
  3. Task: *"Using the Diamond RAG connector, pull the last 20 flagged reports from the QA review queue and compile a peer-review packet with report excerpts and the flag reason for each."* Output feeds the existing peer-review committee process — it does not replace it.
  4. Task: *"Compare this PACS vendor renewal SOW (attached PDF) against our actual study volume from the Gold utilization export and flag any commitment we're under or over."* Useful ahead of contract renewal cycles.
  5. Task: *"Take last quarter's four monthly TAT reports and roll them into a single trended quarterly summary for the radiology chief."*
    No direct connector to PACS pixel data or unredacted report text. Everything Cowork touches here is a Gold/Diamond export or metadata file — never a live study.
--- ### Clinical Lab / Pathology
🔬 Clinical Lab / Pathology Cowork Workflow
Users: Lab quality coordinator, pathology informatics analyst
Connects to: LIS instrument QC export folder, Gold lab KPI dashboard exports (TAT, critical value notification time, QC failure rate)
Step by step:
  1. Set up a watched folder (`lab/qc-exports/daily/`) where the LIS drops the previous day's instrument QC log each morning.
  2. Schedule a recurring Cowork task: *"Every weekday at 7am, read the new QC export, flag any control run outside 2 standard deviations, and draft a summary email for the lab director's review — do not send, save as draft."* Scheduled tasks run on the cadence you set; the human still approves before anything leaves the building.
  3. Task: *"Aggregate the last four quarters of reagent lot failure records into a trend chart and draft a root-cause narrative, citing which instrument and lot showed the most failures."*
  4. Task: *"Build a CAP/CLIA readiness binder — combine our current QC policy documents with the last six months of exception reports into one organized document with a table of contents."*
  5. Task: *"Cross-check this proficiency testing result export against our accreditation requirements checklist and flag any gaps."*
    Cowork works from aggregate/QC data, not individual patient results. It drafts the exception summary; it does not decide what corrective action to take.
--- ### Cardiology
❤️ Cardiology Cowork Workflow
Users: Cardiology service-line analyst, cath lab operations coordinator
Connects to: Gold cardiac KPI exports (door-to-balloon, 30-day HF readmission, AFib detection rate), shared drive of current ACC/AHA guideline PDFs and internal protocols
Step by step:
  1. Point Cowork at `cardiology/gold-exports/` and `cardiology/guidelines/`.
  2. Task: *"Build a quarterly cath lab performance deck from this KPI export — trend charts for door-to-balloon time and readmission rate, benchmarked against last year."* Output is a PowerPoint draft for the service-line meeting, not a final board document.
  3. Task: *"Compare our current STEMI protocol document against this updated ACC/AHA guideline PDF and produce a redline summary of what changed and what sections of our protocol may need review."* This flags differences for a clinician to evaluate — it does not rewrite clinical protocol.
  4. Task: *"Cross-reference this FDA device recall notice against our device inventory export and tell me how many implanted units are potentially affected — aggregate count only, not a patient list."*
  5. Task: *"Turn this month's cath lab utilization export into a capacity-planning workbook with a formula-driven what-if scenario for adding a second lab day."*
    Device recall cross-checks produce a count for the clinical team to act on through the EHR — Cowork does not identify or contact individual patients.
--- ### Oncology
🧬 Oncology Cowork Workflow
Users: Research coordinator, tumor board administrator, oncology data analyst
Connects to: Diamond RAG connector scoped to trial-eligibility criteria and protocol documents, Gold research/enrollment KPI exports, clinical trials protocol shared drive
Step by step:
  1. Point Cowork at `oncology/protocols/`, `oncology/gold-exports/`, and the Diamond trial-matching connector.
  2. Task: *"Given this folder of de-identified case summaries for Thursday's tumor board, compile a briefing packet — for each case, surface any open trials from the eligibility index that look relevant, with the matching criteria listed."* This is a candidate list for the tumor board to evaluate against the full chart, not an enrollment decision.
  3. Task: *"Merge these three protocol amendment drafts into one clean redlined document showing all proposed changes against the current approved version."*
  4. Task: *"Pull the Gold enrollment KPI export and build a monthly funnel chart — screened, eligible, consented, enrolled — with a short narrative on where the biggest drop-off is."*
  5. Task: *"Draft the background and significance section of this grant proposal using the attached prior publications and our program's enrollment data — flag anything I should double-check before submission."*
    Trial matching output is a suggestion list requiring clinician and research-coordinator verification. Cowork does not access identifiable patient records to make matching decisions — only de-identified summaries provided into its working folder.
--- ### Pharmacy
💊 Pharmacy Cowork Workflow
Users: Pharmacy formulary analyst, P&T committee coordinator
Connects to: Gold formulary compliance and cost KPI exports, internal formulary document library, Diamond RAG connector over guideline/formulary text
Step by step:
  1. Point Cowork at `pharmacy/formulary-docs/` and `pharmacy/gold-exports/`.
  2. Task: *"Assemble this month's P&T committee packet — combine the drug monograph for [new agent], the utilization trend from the Gold export, and a cost comparison against current formulary alternatives."*
  3. Task: *"Given this drug shortage notice, search the formulary document library for therapeutic alternatives already on formulary and draft a one-page comparison brief."*
  4. Task: *"Cross-reference this sample of aggregate dispensing records against our 340B contract pharmacy eligibility rules and flag exceptions for pharmacist review."*
  5. Task: *"Turn last year's twelve monthly formulary compliance exports into one annual trend report."*
    Cowork does not touch individual patient medication orders, does not perform real-time drug-interaction checking, and does not draft anything that reaches a patient chart. Order-level interaction checking stays with the CPOE-integrated Platinum pharmacy agent already defined in the platform's Diamond/Platinum layers — that's a server-side, audited, always-on system; Cowork is a desktop tool a person runs when they choose to.
--- ### Emergency Medicine
🚨 Emergency Medicine Cowork Workflow
Users: ED operations analyst, ED medical director's office
Connects to: Gold ED throughput KPI exports (door-to-provider, LWBS rate, boarding time), ED protocol document library
Step by step:
  1. Point Cowork at `ed/gold-exports/` and `ed/protocols/`.
  2. Schedule: *"Every weekday morning, read yesterday's throughput KPI export and draft a one-page briefing — flag any metric outside target — for the ED medical director."*
  3. Task: *"Using this historical census export, build a staffing scenario workbook for [upcoming high-volume event] — model three staffing levels and show projected wait-time impact."*
  4. Task: *"Compare our current sepsis screening protocol against this newly published guideline PDF and list sections that may need updating."*
  5. Task: *"Compile the last six months of LWBS incidents by hour of day into a chart and short summary for the throughput improvement committee."*
    No involvement in real-time triage or acuity scoring for an active patient — that's the Platinum-layer Triage Agent's job, running server-side with full Iceberg audit logging. Cowork's ED role here is retrospective reporting and planning, not point-of-care.
--- ### ICU / Critical Care
🏥 ICU / Critical Care Cowork Workflow
Users: ICU quality coordinator, critical care service-line analyst
Connects to: Gold ICU KPI exports (LOS, ventilator days, mortality index, sepsis bundle compliance), guideline library, biomedical equipment utilization exports
Step by step:
  1. Point Cowork at `icu/gold-exports/` and `icu/guidelines/`.
  2. Task: *"Given this folder of de-identified case summaries, compile a structured mortality & morbidity conference packet — for each case, pull relevant guideline excerpts via the Diamond connector."*
  3. Task: *"Analyze this ventilator utilization export and build a capacity-planning workbook for biomedical engineering and ICU leadership."*
  4. Task: *"Take the sepsis bundle compliance export for the last four quarters and produce a trend report — where compliance dropped, list the shift/unit pattern if visible in the data."*
  5. Task: *"Draft the quality committee slide summarizing this quarter's central line infection rate against last year, with the CDC NHSN benchmark noted."*
    Cowork is retrospective and conference-prep only. Real-time deterioration/sepsis alerting on active patients is the Platinum-layer Sepsis Sentinel Agent's job — a separate, always-on, server-side system with its own audit trail, not something Cowork touches.
--- ### Surgery
🔪 Surgery Cowork Workflow
Users: OR operations analyst, value analysis committee coordinator
Connects to: Gold OR utilization KPI exports, surgical case scheduling exports, supply chain/implant cost data
Step by step:
  1. Point Cowork at `surgery/gold-exports/` and `surgery/case-schedule-exports/`.
  2. Schedule: *"Every Monday, pull last week's block schedule and case data and produce a utilization scorecard by surgeon and service line."*
  3. Task: *"Cross-reference these implant purchase orders against the case volume export to identify cost-per-case outliers by device type, and draft findings for the value analysis committee."*
  4. Task: *"Compare the OR schedule against the billing/coding export and flag any case with missing charge capture — output as a reconciliation worksheet."*
  5. Task: *"Aggregate the last six months of surgical site infection (SSI) surveillance data into a trend report for the surgical quality committee."*
    Cowork analyzes aggregate utilization and cost data — it does not access individual patient records or make clinical decisions about surgical care.
--- ### Nursing
👩‍⚕️ Nursing Cowork Workflow
Users: Nurse manager, unit-based council coordinator, nursing informatics
Connects to: Gold nursing KPI exports (fall rates, pressure injury incidence, staffing ratios), unit protocol document library
Step by step:
  1. Point Cowork at `nursing/gold-exports/` and `nursing/protocols/`.
  2. Task: *"Compare these handover templates across units. Identify inconsistencies in structure and produce a single standardized template incorporating the best elements of each, plus a change summary for each unit."*
  3. Task: *"Synthesize the month's fall and pressure-injury incident notes into a short trend summary for the unit-based council meeting."*
  4. Task: *"Take this quarter's staffing ratio export and build a visualization showing where we fell below target staffing levels."*
  5. Task: *"For patient education: take the current library of patient education handouts and reformat/simplify a batch of them to a target reading level, keeping clinical content unchanged."*
    Cowork works with aggregate quality metrics and protocol documents — it does not access individual patient care records or make clinical nursing decisions.
--- ### Hospital Operations
🏢 Hospital Operations Cowork Workflow
Users: Hospital operations analyst, capacity management coordinator, administrative staff
Connects to: Gold operations KPI exports (bed census, OR utilization, ED boarding, staffing), department protocol libraries
Step by step:
  1. Set up a working folder that receives the daily exports already generated elsewhere in the platform: bed census (Gold), OR schedule (Gold), ED boarding snapshot (Gold), and staffing roster (HR system export or connector).
  2. Ask Cowork: *"Every weekday morning, pull bed census, OR schedule, ED boarding hours, and staffing roster from this folder and produce a one-page capacity briefing: current occupancy, predicted 24-hour demand, any staffing gaps against acuity-adjusted ratios, and today's discharge candidates."*
  3. Approve the plan once, then set this as a recurring scheduled task (daily, before the morning huddle) so it runs without re-prompting.
  4. Cowork delivers the finished briefing to the working folder each morning; the shift supervisor reviews and adjusts before the huddle.
  5. For deeper ad hoc analysis — e.g., a monthly capacity trend deep-dive — connect Cowork to the relevant connectors (Slack for team context, the analytics export folder) and ask it to build an interactive dashboard artifact rather than a static report.
    Cowork produces capacity planning briefings and operational reports — it does not make real-time bed assignment decisions or override clinical judgment about patient placement.
--- ## Cross-Department Patterns Worth Standardizing
--- ## What Cowork Should Not Be Used For Here
--- ## Suggested Rollout Sequence
  1. Start with Hospital Operations and Gold-layer reporting.

    Lowest risk, clearest ROI, no PHI exposure — validates the folder/export pattern before expanding.

  2. Expand to documentation-heavy departments next

    Pharmacy formulary memos, Nursing template standardization, Lab QC synthesis. These are high manual-effort, low-clinical-risk workflows.

  3. Add Diamond-layer document curation

    Cardiology guidelines, Oncology trial criteria, ICU protocols once the export pattern is trusted — this directly improves RAG retrieval quality without touching the embedding pipeline itself.

  4. Build department-specific plugins

    Once 2–3 workflows per department are validated, to lock in consistent formatting and reduce onboarding time for new staff.

  5. Don't expand toward PHI-adjacent workflows on the assumption that better audit logging will resolve the compliance question.

    It won't — the reassessment trigger isn't Cowork's audit logging reaching parity with the Compliance API, it's Cowork actually gaining BAA coverage, which is a contractual change on Anthropic's side, not a product feature to wait out. Verify current status directly at trust.anthropic.com or with your Anthropic account team before revisiting this boundary, and treat "still excluded" as the default assumption until you see it change in writing.

    --- ## Governance Checklist Before Wider Rollout
    • Scope network egress before enabling Cowork, not after — it's set at the org level and applies to new sessions only.
    • Treat "trust boundary" as a design decision, not a default. Anything Cowork reads outside files/sources you control (inbound email, web content, third-party documents) is a potential prompt-injection vector. The risk is structural: injection requires both *reading untrusted content* and *having write/action capability* — removing either breaks the attack, so scope read access and write permissions independently rather than granting both broadly by habit.
    • Default to step-by-step approval for anything with write actions (file deletion, sending messages, posting data, purchases). Deletion specifically requires an explicit "Allow" prompt by design — don't build workflows that train users to rubber-stamp it.
    • Computer use needs its own review. It has no sandbox between Claude and your applications — per-app permission prompts and an app blocklist exist (investment/trading and crypto platforms are blocked by default), but treat any computer-use-driven workflow touching financial or PII-bearing systems as higher risk than file- or connector-based workflows.
    • Use plugin marketplace controls deliberately on Enterprise — *installed by default* for sanctioned function plugins, *required* where you want no opt-out, *hidden* for anything not yet reviewed. Don't leave this as wide-open self-service for regulated workflows.
    • Don't schedule anything irreversible. Scheduled/unattended tasks should start with low-risk categories (summaries, draft generation) before anything that writes to a system of record.
    • Know what's not logged centrally. Cowork activity isn't in the Compliance API today; OTel-to-SIEM is the available monitoring path for Team/Enterprise, and project/task data lives locally on the user's machine, not in a central export.
    --- ## Where Cowork Is the Wrong Tool

    Be precise about this rather than discovering it mid-rollout:

    • No cloud/headless execution. Every task needs the desktop app open and the machine awake. If the requirement is "this must run reliably even if no one's laptop is on," Cowork's scheduled tasks are the wrong mechanism — that's a server-side automation problem, not a Cowork one.
    • No session sharing. Cowork tasks can't be shared with colleagues the way a chat or artifact can. Collaborative review happens via the output file, not the session.
    • Memory is project-scoped only. Standalone sessions don't retain memory across runs — if a workflow needs persistent context, it needs a Project, not an ad-hoc task.
    • Higher usage cost than Chat. Multi-step, compute-intensive tasks consume usage allocation faster than single-turn chat; for high-volume rollouts, monitor usage and batch related work into single sessions rather than spinning up many small ones.
    • Computer use gaps on Linux, and generally a newer, less battle-tested capability than file/connector-based work — weight accordingly for anything customer-facing or financially consequential.
    • Not a system of record. The output is a draft for human action, not an audit-grade transaction log. Anything requiring formal audit trail needs to remain in your existing system of record, with Cowork upstream of it, not replacing it.
    --- ## Quick Decision Reference
    If the problem is... Reach for...
    A single document/analysis, one-shot Claude Chat
    Multi-step, multi-file, recurring, produces a deliverable Claude Cowork
    The workflow itself needs to become permanent internal software Claude Code
    Must run unattended on infrastructure with no machine kept awake Not Cowork today — server-side automation or a Code-based scheduled/cloud job
    Requires acting on sensitive systems with no human review step Don't automate this with any agentic tool until a review gate is designed in