How to govern Claude Cowork in the enterprise

To govern Claude Cowork in the enterprise, control four things: what the agent can reach, which settings each group receives, where activity is exported, and who can review session transcripts. Each control is a setting you can check on every device. Most of the risk sits in the defaults, so check those first.

Checked against the Claude Desktop documentation as of 2026-11-01. The release numbers below are the ones those pages name.

Pick the admin surface you actually have

Cowork runs in Claude Desktop, and the controls depend on how your organization deploys the app. With the Enterprise Admin Console, Anthropic hosts the configuration for your Claude Enterprise organization, and administrators edit it on claude.ai. With MDM or a bootstrap server, you push the configuration to each device as a managed profile. If you run Cowork on Amazon Bedrock, the setup steps are in the Bedrock post. This guide covers the governance settings for either path.

Control	Enterprise Admin Console	MDM or bootstrap profile
Where you set it	Organization settings, under Desktop 3P, on claude.ai	Managed configuration file on each device, pushed by your device management tool
Per-group settings	Permission policies, one per group	One profile per device, so use separate profiles for separate groups
OpenTelemetry export	Telemetry and updates page	otlpEndpoint, otlpProtocol and otlpHeaders keys
Session transcripts	Compliance API, for Claude Enterprise organizations	Compliance API page covers Claude Enterprise organizations and does not name MDM-managed devices

The console can import an existing configuration file, so moving from MDM does not mean rewriting every key.

Restrict what Cowork can reach

Three keys decide most of the exposure. Set them before users sign in.

1. Set coworkEgressAllowedHosts to the hosts your team needs. Unset or empty means no web fetch in Chat and Cowork. Entries can be a hostname, a wildcard such as *.corp.com (subdomains only), or *, and an entry can end in :port.
2. Set allowedWorkspaceFolders to the folders Cowork may use, each with rw or ro. Unset means all folders are allowed, and an empty list allows none. Don’t list a home folder.
3. Set disabledBuiltinTools to block built-in tool rules, and builtinToolPolicy to require approval for a command pattern.

{
  "coworkEgressAllowedHosts": ["api.github.com", "*.corp.example.com"],
  "allowedWorkspaceFolders": [{ "path": "~/Projects", "mode": "rw" }],
  "disabledBuiltinTools": ["Read(//etc/**)"],
  "builtinToolPolicy": { "Bash(curl *)": "ask" }
}

Two items in the fine print matter here. The configuration reference says shell commands do not fully follow file-path rules, so a path rule in disabledBuiltinTools is not a complete block on what a shell command can read. Use builtinToolPolicy to put a person in the loop for command patterns you care about. The same reference says disableBypassPermissionsMode removes bypass mode from Code and Cowork, and it applies from Claude Desktop 1.46388.1. Set it on every managed device.

Scope settings by group

The console applies one permission policy per group, and you control which settings each group gets. Set the organization-wide defaults first, then add the group policies.

1. Save the organization-wide settings on the Connection page.
2. Open the Permission policies page under People, and add one policy for each group.
3. Rank the policies. For most settings, the highest-ranked policy that sets a value wins, and lower policies fill in only what is left unset.
4. Check the managed MCP servers. Those combine across policies, so a user keeps every server that any of their groups lists.

A user in no listed group gets the organization-wide settings. The example in the console documentation shows the rule. If a Traders policy, ranked first, turns Code off, and an Analysts policy, ranked second, sets a token limit, then a user in both groups has Code off and the Analysts token limit.

Check Unified Claude before you turn Cowork off

Unified Claude combines Chat and Cowork into one view. While it is on, it overrides the Cowork switch, including where you turned Cowork off. An unset desktopHome key is read as standard from November 10, 2026 (12:00 PM PT) in current app versions, and Cowork is then on even where coworkTabEnabled is false. The one exception is where chatSessionRetentionDays is set and coworkSessionRetentionDays is not set to the same number of days. standard turns Unified Claude on, and an explicit off turns Chat and Cowork off. Set the value explicitly, and confirm the result on a test device for each group.

Export Cowork activity to your collector

Cowork exports OpenTelemetry events to a collector you run. On a third-party deployment, set otlpEndpoint, otlpProtocol and otlpHeaders in managed configuration. On the first-party path, set the OTLP endpoint, protocol and headers under Admin settings, then Cowork. Monitoring requires Claude Desktop 1.1.4173 or later.

1. Set the endpoint, protocol and headers in managed configuration or admin settings.
2. Choose what content each event carries, using the table below.
3. Have users restart Claude Desktop, or start a new Cowork session. The app reads these keys at launch and at session start.
4. Confirm events arrive in the collector’s own request logs. If the collector refuses requests, the app keeps working, shows no error and drops the batches.

Event	What it records
user_prompt	A prompt submitted by a user, with prompt_length
assistant_response	Model response text, with response_length. Needs Claude Desktop 1.17377 or later
tool_result	Tool name, success, duration, decision and source, plus MCP server and tool names
tool_decision	Whether a tool call was accepted or rejected, and by which source
api_request	Model, token counts, cache tokens and cost_usd for each API call
api_error	Model, error, status code and attempt number

Every event carries prompt.id, which links all activity from one prompt. Filter on that value to trace a single request end to end. The cost_usd value is an estimate, so use your billing dashboard for totals.

Setting for otlpContentCapture	What events carry
Not set	Metadata only, on current versions
A list, such as userPrompts or toolDetails	The content in the listed categories. On Claude Desktop 1.17377 or later, userPrompts also brings model responses
[]	Metadata only, on every version that supports the key

Two limits to know. The Cowork event settings do not cover Code tab sessions, including Code sessions that Dispatch starts. And workspace.host_paths is sent whatever the content setting says, so configure your backend to redact folder names if they can be sensitive.

Keep transcripts and an admin change record

Claude Enterprise organizations can retrieve Cowork transcripts through the Compliance API. The endpoints use the Compliance Access Key with the read:compliance_user_data scope.

GET /v1/compliance/apps/sessions/local
GET /v1/compliance/apps/sessions/local/{session_id}/messages
GET /v1/compliance/apps/sessions/remote
GET /v1/compliance/apps/sessions/remote/{session_id}/messages

The local endpoints cover Cowork on a user’s machine. The remote endpoints cover Cowork sessions started on claude.ai web or mobile, which run in Anthropic-managed environments. The transcripts include user prompts, assistant responses, and tool calls and results. The remote transcripts exclude thinking blocks and images. The session endpoints are read-only, and transcripts are kept for six years by default. An organization with a finite custom conversation retention period gets that period instead. For local sessions in an organization with HIPAA readiness enabled, the period is 30 days.

Admin activity sits in a separate record. The Activity Feed keeps role changes and saves of the Claude Desktop configuration and permission policies, and you read it with a key that has the read:compliance_activities scope. Usage analytics is a separate switch on the Telemetry and updates page. It is off by default, and turning it off makes each app stop reporting at its next configuration check and discard counts it has not yet sent. Counts Anthropic has already received are not deleted.

A control map for the rollout review

Use this table in the rollout review. Each row names a risk, the control that addresses it and where that control lives.

Risk	Control	Where
Web access to arbitrary sites	Egress allowlist	coworkEgressAllowedHosts
Files outside the project	Folder allowlist	allowedWorkspaceFolders
Commands that need a person to approve	Tool approval	builtinToolPolicy set to ask
Unreviewed MCP servers	Managed MCP tool policy, with allow, ask or blocked	managedMcpServers
Users adding their own plugins or skills	Upload and creation switches	userPluginUploadsEnabled, skillCreationEnabled
Bypass mode	Removed from Code and Cowork	disableBypassPermissionsMode
Prompt text in your logs	Metadata-only export	otlpContentCapture set to []
Review of what a session did	Transcript retrieval	Compliance API session endpoints
Changes made by admins	Audit record	Activity Feed

Before the rollout, confirm that each row has a value, and that the group policies rank the way you intend.

Enforcing this with AIControls

The vendor settings above control what Cowork can reach, which settings a group gets and what gets exported. They do not give you a spend limit per developer or per session. AIControls adds per-user tokens and per-user and per-session cost and budget limits for Claude Code. Start with the coding agents guide, then read the AIControls platform page. For the audit side, read how to audit what your AI coding agent did.

Frequently asked questions

Does turning off Cowork in the admin console stop it for everyone?

Not always. While Unified Claude is on, it overrides the Cowork switch, even where you turned Cowork off. From November 10, 2026, 12:00 PM PT, current app versions read an unset desktopHome key as standard, and Cowork is then on even where coworkTabEnabled is false. The exception is where chatSessionRetentionDays is set and coworkSessionRetentionDays is not set to the same number of days. Set desktopHome explicitly, because an explicit off value turns Chat and Cowork off.

Are users' prompts sent to our collector by default?

Not on current Claude Desktop versions. When otlpContentCapture is not set, events carry metadata only. Setting it to a list adds the categories you choose, such as userPrompts or toolDetails. Set it to an empty list to force metadata only on every version that supports the key, because some older first-party builds send content when the key is missing. Metadata still includes the folder paths a user connects to a task.

Can we read a Cowork session transcript after it ends?

On Claude Enterprise, yes, through the Compliance API. Use the local sessions endpoint for Cowork running on a user's machine, and the remote sessions endpoint for Cowork sessions started on claude.ai web or mobile. The endpoints are read-only, so you cannot delete sessions through them. Transcripts are kept for six years by default, or for your organization's shorter custom retention period. Sessions under zero data retention return 404.

Does the Compliance API record what admins change?

It can. The Activity Feed keeps an audit record of administrator activity, including role changes and saves of the Claude Desktop configuration and permission policies. Turn on the Compliance API switch under Organization settings, then API, and create a key with the read:compliance_activities scope. The switch records in every organization under the same parent, so check what each one captures before you turn it on.

How do I stop Cowork from reaching the web?

Leave coworkEgressAllowedHosts unset or empty. The configuration reference says that means no web fetch in Chat and Cowork. To allow a site, add its hostname, such as api.github.com. Entries can be a hostname, a wildcard such as *.corp.com (subdomains only), or *, and an entry can end in :port. Keep the list short, and check that your perimeter firewall allows the same hosts, because the egress allowlist does not change what your network permits.