Claude Cowork Manual or Auto? Choose an Approval Mode for File Work

Claude Cowork can work with files, but the permission mode should match the consequence of the task. A folder review that only produces a plan needs a different boundary from a task that edits or deletes files.

This guide uses a fictional project folder. It does not claim a Cowork run or a result. The output is an approval boundary card that helps you decide whether to run the task, change its mode, or stop.

Evidence label: documentation based and illustrative. Anthropic says Cowork can read and write local files through the Claude Desktop app when you connect folders. Its documentation describes Manual, Auto, and Skip approval modes, and recommends Manual when work touches sensitive files or actions that are difficult to undo. The folder, prompt, and card below are fictional.

The reader and decision

This is for an operations manager who wants Claude to review a project folder and propose a cleanup plan. The decision is whether the task should run in Manual mode, Auto mode, or stop until the scope is clearer.

The artifact is an approval boundary card with:

• the connected folder
• the files Claude may read
• the actions Claude may propose
• actions that require approval
• actions that are forbidden
• the output location
• the stop conditions
• unknown owners, dates, approvals, and dependencies

The card is a review aid. It does not grant Claude access or approve a file change.

Before you start

You need a paid Claude plan with Cowork available. For local file access, Anthropic says the Claude Desktop app must be open and connected. In current cloud sessions, local files opened through Desktop are processed on Anthropic’s servers, not just on your computer. Connecting a local folder does not make the task local-only. Check your organization’s data rules before using real files.

Work from a copy or a dedicated practice folder. Do not use credentials, payroll records, customer exports, or other sensitive material in this exercise. Turn off unnecessary connectors and computer use, and do not grant browser or app access for this file-only task. If you cannot establish those boundaries, stop before connecting files.

Create a folder named project-review-practice with this fictional structure:

project-review-practice/
  brief.md
  meeting-notes.md
  draft-report.md
  old-export.csv
  README.txt

Put this text in brief.md:

Project: Northstar onboarding
Review task: identify duplicate drafts and missing handoff details
Allowed output: review-plan.md in this folder
Do not rename, move, edit, or delete any source file
Open question: the owner of the old export is not recorded

Create these remaining plain-text fixtures. The Markdown files are text documents, not empty files with a Word extension.

meeting-notes.md:

# Meeting notes
Missing handoff detail: the old export's owner is not recorded.
No dates, approvals, or dependencies are recorded in these practice notes.

draft-report.md:

# Draft report
This is a practice draft. The export owner still needs confirmation.
No duplicate draft has been identified in these notes.

old-export.csv:

file,owner
old-export.csv,UNKNOWN

README.txt:

Fictional practice folder only.
Use brief.md for the task boundaries. Do not change source files.

Three steps

1. Classify the task before opening the folder

Write down the requested outcome in one sentence:

Create a review plan from the five named practice files. Do not change source files, do not contact anyone, and do not infer the owner of old-export.csv.

Then mark each action:

Action	Decision
Read the five practice files	Allowed for this exercise
Create review-plan.md	Allowed only after you inspect the proposed content
Rename or move a source file	Forbidden
Delete a source file	Forbidden
Send a message or open a signed-in site	Forbidden
Guess the owner of old-export.csv	Forbidden

Cowork can take real actions through connected tools and files. Check that the card permits only the review you requested.

2. Ask for an approval boundary card

Open Claude and select Cowork if the message box shows a Chat/Cowork selector. If your account has the unified Claude experience and the selector is absent, start from the same message box and describe the bounded task below. Connect only the practice folder and choose Manual where available.

Check permissions before starting. In Anthropic’s connector table, Manual asks for permission for tools marked “Needs approval”. Tools set to “Always allow” can remain preapproved, subject to workspace policy. Anthropic also warns that computer use lacks the permission checks applied to other Cowork tools. Manual is not a guarantee that every read, write, or action will pause. Keep unnecessary connectors and computer use off, and verify the explicit waits requested in this prompt:

Work only with the connected folder project-review-practice.

Create an approval boundary card before doing the review.

Task:
- after I approve the card, read brief.md, meeting-notes.md, draft-report.md, old-export.csv, and README.txt;
- identify duplicate draft names only if supported, and missing handoff details;
- propose content for review-plan.md in the conversation, then wait again;
- do not edit, rename, move, or delete any source file;
- do not send messages, open signed-in websites, or use other folders;
- do not use connectors, browser tools, or computer use for this file-only task;
- do not guess an owner, date, approval, or dependency when the files do not state it.

The card must include:
1. connected folder;
2. files in scope;
3. read actions allowed;
4. write actions requiring my approval;
5. forbidden actions;
6. output path;
7. stop conditions;
8. unknowns that must remain unknown.

Before reading a file, show the card and wait for my approval. After I approve the card, read the files, show the proposed review-plan.md content in the conversation, and stop again for my approval. If a file is missing or unreadable, report that exact filename and stop. Do not create review-plan.md until I approve both the card and the draft content. A permission mode or a preapproved connector is not my approval for these steps.

Watch whether Claude actually stops after showing the card, before it reads a file. After you approve the card, inspect the proposed report and verify a second stop before file creation. If either wait is skipped, stop the task and inspect what it accessed or changed. Do not treat the selected mode or a model’s claim that it waited as evidence of an observed stop. Mode availability and labels can vary by account and product surface.

3. Review the card and decide

A passing illustrative card should look like this:

Approval boundary card
Connected folder: project-review-practice
Files in scope: brief.md, meeting-notes.md, draft-report.md, old-export.csv, README.txt
Read allowed: inspect these five practice files only after the card is approved; do not invent duplicates
Write requiring approval: create review-plan.md after its draft is reviewed
Forbidden: edit, rename, move, or delete source files; send messages; open signed-in sites; use other folders, connectors, or computer use
Output: project-review-practice/review-plan.md
Stop if: a file is missing or unreadable, the task leaves the folder, a source read occurs before card approval, or an output write occurs before draft approval
Unknowns: owner of old-export.csv, dates, approvals, and dependencies not stated in the files
Decision: Manual mode with unnecessary connectors and computer use off; explicitly wait for card approval before reading, and draft approval before creating the output

Compare the card with the prompt and the fictional folder. Approve the next step only if every file, action, output path, and stop condition matches. This editor-written card is a target, not a captured Cowork result. The fixture does not establish any duplicate draft or export owner.

Acceptance checks

The exercise passes when:

1. all five filenames appear exactly once in the in-scope list;
2. the source files are read-only in the task definition;
3. review-plan.md is the only proposed output;
4. deletion, rename, move, messaging, signed-in browsing, and other folders are forbidden;
5. the missing owner remains unknown;
6. the selected mode and reason are recorded;
7. you observe the requested stop before source reads and a second stop before the proposed output write, rather than assuming Manual enforces them;
8. unnecessary connectors and computer use remain off, and no owner or duplicate is invented.

A passing card does not prove that a later action is safe. Review the actual proposed action each time.

If something goes wrong

• Claude proposes a cleanup instead of a review: restate that the deliverable is a plan and repeat the forbidden actions. Do not approve a broader task.
• A file is missing: stop and compare the connected folder with the five fictional names. Do not ask Claude to fill the gap from memory.
• The mode labels differ: use the current permission label shown in your Claude surface and record what it allows. Do not assume that a different label has the same behavior.
• Claude asks to write before showing the card: deny the request and stop the task. Check connector approvals and computer-use access before trying again with the explicit waits. Selecting Manual alone is not a repair.
• Claude continues without the requested wait: stop the task, inspect the files and activity for unexpected reads or writes, and keep the exercise failed until you can verify the stops. Do not grant broader access to make it finish.
• The task reaches a signed-in site or another folder: stop the task. Anthropic warns that connected files, websites, and apps can expose untrusted content or trigger actions outside the intended scope.

What to keep

Save the final card beside the practice notes only if you have reviewed its contents. For a real project, replace the fictional folder with an approved working copy and preserve the same boundary fields.

If you want more practical AI workflows for real work, join the Weekly Verdict.

Sources

• Get started with Claude Cowork
• Use Claude Cowork safely