Claude Cowork has three permission modes. Manual asks before actions. Auto approves read-only tools and has Claude review other actions for risks such as data exfiltration or prompt injection. Skip pauses and checks nothing, so use it only when you fully trust the task, connectors and files.
The three modes
Per Anthropic's help article:
- Manual: Claude asks before actions and you choose Allow or Deny.
- Auto: read-only tools are approved. Claude reviews other actions for safety, such as data exfiltration or prompt injection, and blocks unsafe ones. It uses more of your usage limit.
- Skip: nothing pauses or is checked automatically.
Team and Enterprise admins can control whether Auto is available. Separately, Claude asks permission before permanently deleting files.
What the isolation does and does not do
The page says Claude's environment is isolated from your computer and network, and Claude can only read and write folders you have connected. In short, isolation protects your machine but does not limit what Claude can do with access you have granted. A folder full of documents is fully readable.
What network egress settings do not cover
Network access follows your egress settings, but the page states that web fetch, web search, MCPs and Claude in Chrome are not governed by those permissions. Team and Enterprise owners can disable web search and the Chrome integration. If your threat model says nothing may leave the environment, those paths need separate review.
Choosing a mode
- Start in Manual for any new task type, folder or connector.
- Move to Auto for repeatable tasks once you have seen several clean runs.
- Reserve Skip for throwaway folders and trusted inputs.
Prompt injection in practice
Files and web pages can contain text written to steer an agent. The same risk is described in Claude MCP tool poisoning. Keep sensitive and untrusted files in different folders, and connect only the folder a task needs.
Review before approving
The help page recommends reviewing Claude's planned actions, especially with sensitive files, and being cautious about how much access you extend to MCPs or websites. Safeguard's MCP Guardrail addresses agent tool access in its own platform, and the free scan at gold.safeguard.sh/scan covers dependencies.
A worked example
Say you want Claude to tidy a downloads folder. Connect only that folder, run the first pass in Manual, and read each proposed rename or move. If the pattern is clean, a second pass in Auto is reasonable. If the folder holds anything you cannot afford to lose, back it up first, because permanent deletion is the one action the help page says Claude asks about regardless. Skip never belongs on a folder you would be upset to lose.
Quick check
Does Auto mode check every action?
It approves read-only tools and reviews other actions for safety, blocking unsafe ones, according to the help article.
Does disabling network egress stop web search?
No. Web fetch, web search, MCPs and Claude in Chrome are not governed by network egress permissions.
Sources
Last reviewed: 19 October 2026.
