Claude Cowork for business: permissions, data protection and a rollout plan

Claude Cowork for business comes down to three decisions: what the agent may touch, which terms cover your data, and who checks its work. Anthropic’s help pages describe the settings for the first two, as of November 2026. The third one is yours.

What Claude Cowork for business does for a team

Cowork is Anthropic’s agent for office work outside of code. You describe an outcome, such as sorting a folder of invoices by supplier or checking a contract against your standard terms, and the agent plans the steps, works through them and shows you the result. Along the way it edits, moves and renames files in the folders you connect, uses connectors to reach tools like a CRM, and runs code when data needs processing.

Since September 2026 there is no separate mode to pick. Anthropic merged chat and Cowork into one Claude, and the app decides whether a request needs an answer or an agent. Long tasks keep running when you close the laptop. Anything that touches local files, the built-in browser or your screen needs Claude Desktop open.

Teams get the most out of plugins. A plugin bundles skills, connectors, commands and sub-agents. A skill is a written procedure the agent loads when it fits the task: how your company structures a quote, which phrases never go to a customer. Plugins are plain text files. You can read them, change them and version them like any other document. Anthropic publishes a set in anthropics/knowledge-work-plugins, and since February 2026 admins can run a private plugin marketplace for their own organisation.

Which plan a company needs

Cowork is on every paid plan: Pro, Max, Ultra, Team and Enterprise (getting started). For a company, the terms differ more than the features.

Pro, Max and Ultra are consumer plans. Since Anthropic’s consumer terms update of August 2025, each user decides whether their chats help train future models. Setting on: Anthropic keeps the data for five years. Setting off: 30 days. Each employee makes that choice on their own account.

Team and Enterprise run under the commercial terms. Anthropic states that by default it does not train on inputs or outputs from commercial products. The one exception is feedback: a thumbs up or down can release that conversation for training. The data processing addendum with Standard Contractual Clauses is built into the commercial terms. Accept the terms and the DPA applies. There is nothing separate to sign.

Prices on claude.com/pricing: Team costs $25 per standard seat and $125 per premium seat billed monthly, $20 and $100 billed annually. Enterprise is priced on request. Agent tasks use more of the allowance than chat, so heavy users need the larger seat. The full breakdown is in what does Claude cost.

We recommend Team or Enterprise as soon as client data or personal data goes into the agent. Private Pro accounts leave the training choice with each employee.

Permissions: what the agent may access

The controls are in Anthropic’s article on Cowork for Team and Enterprise:

• Cowork is on by default. An owner can switch it off for the whole organisation.
• Enterprise can enable it for specific teams through groups and custom roles. On Team, the help page documents only the switch for the whole organisation.
• Cloud tasks are on by default on Team and off by default on Enterprise.
• “Always allow” for connector tools is off by default, so connector actions ask first.

Inside a session, the approval mode decides how much happens without a question (merged app article). Enterprise defaults to manual approval of every step. Team defaults to automatic approval, where Claude screens each action itself and blocks what it judges unsafe. A third mode skips approvals, and then nothing screens the agent. In every mode it asks before deleting a file for good.

Two limits from the safety help page belong in every rollout plan. Anthropic writes that isolation limits where code runs, and that it does not limit what Claude reads or does. And computer use, where the agent clicks through apps on your screen, has no sandbox at all. Anthropic also states that the chance of a prompt injection, instructions hidden in a document or web page that steer the agent, is still not zero.

Our default: manual approval for anything that writes to a customer, a payment or a system of record. Automatic approval only inside a folder where every outcome is acceptable.

Data protection: where the data goes

Cowork tasks run in an isolated, temporary environment on Anthropic’s servers. When you connect a local folder, the files the agent opens are processed there as well. If a document must never leave your own machines, Cowork is the wrong tool for that document.

For oversight, Cowork sessions in Claude, Claude Desktop and Claude Mobile are captured in the Compliance API, which returns the last 30 days. Owners can stream Cowork events to security tools through OpenTelemetry, which Anthropic says does not replace audit logging. Conversations stored locally on a device fall outside Anthropic’s standard retention, and admins cannot delete them centrally. With HIPAA enabled, Cowork is off by default and not covered by the business associate agreement unless the HIPAA configuration is applied.

Anthropic’s help pages do not name a storage region. If your data protection officer needs one, put the question to the DPA and your Anthropic contact before rollout.

What it replaces and what it does not

Cowork takes over the work between your tools: collecting, sorting, drafting, comparing. The system that holds your data, history and permissions stays where it is, and the agent becomes one more way to use it.

Someone still has to judge the result. Anthropic’s own legal plugin states that it gives no legal advice and that its analysis should be reviewed by licensed attorneys. The same rule holds for a quote or a customer reply. The check belongs to someone who knows the business, or to a second agent with fixed criteria and no right to edit. That pattern is the core of Claude Code agent teams, and it carries over to office work unchanged.

What the stock market made of it in February 2026

On 3 February 2026, traders named the Cowork plugins, the legal one in particular, as the trigger for a sell-off the press called the SaaSpocalypse. Bloomberg reported a 6% fall in a Goldman Sachs basket of US software stocks that day and estimated about $285 billion in lost market value across software, financial services and asset managers. Morningstar put the drops at 16% for Thomson Reuters, 14% for RELX and 13% for Wolters Kluwer. A share price is a bet on future revenue. For a company that rents software, nothing broke that day.

How to roll it out in steps

1. Pick one team and one recurring task with a clear result, such as a weekly report or sorting incoming documents.
2. Set up Team or Enterprise, decide who gets access, and create a working folder with copies, not originals.
3. Write the rules as a skill: what good output looks like, what the agent leaves alone, when it asks.
4. Run with manual approval for a few cycles, compare the output with what a person would deliver, then widen access.

We give every agent three things before its first task: defined limits, a permissions model and a foundation of connected data. Without them it guesses. With them it works.

What this means for your business

Before you buy seats, settle three things for one workflow: which data the agent may read, which actions it may take without asking, and who checks the result. A few cycles on that workflow show whether Cowork earns its seats.

That first step, from plan and settings to written rules, is what our AI consulting does. When the workflow is clear and should run on its own, we build it in AI automation.