Which product and account does this cover?
Claude connectors, Cowork, Duet, and separate Claude Code permissions.
- Chat connectors
- Web connectors are available across plans; Team/Enterprise owners manage organization access and action restrictions.
- Cowork
- Paid Pro, Max, Ultra, Team, and Enterprise. Web/mobile availability and Enterprise enablement vary. Computer use is a separate desktop beta for Pro, Max, and Ultra.
- Duet
- US research preview for invited Pro, Max, and Ultra users. Not currently Team/Enterprise.
- Claude Code
- Local controls differ from chat. Most surfaces require an eligible subscription or Console account; desktop requires a paid subscription.
What the permission settings mean
Inspect the connection before using it
Read the connector's capabilities and authenticate the intended account. It may expose both reads and changes. Limit that identity's access through source-system sharing.
Claude is moving Customize into Plugins. In the new layout, use Plugins → Your plugins → Show all and the connector filter. Removing a plugin does not necessarily disconnect its connector.
Set the review mode for the actual surface
Cowork Manual asks for tools marked Needs approval; Always allow tools remain allowed. Auto reviews actions automatically. Inspect the plan and progress; neither mode means no changes.
In local Claude Code, use /permissions to inspect Allow, Ask, and Deny rules. Permissions and sandboxing are separate controls. Instructions in a chat, skill, or CLAUDE.md describe behavior; they do not replace those enforced limits.
Check computer access and Duet separately
Cowork computer use can operate apps directly. To control enablement, open desktop Settings → Capabilities → Computer use, or Settings → System → This computer in the older layout. Per-app permission is not approval for every click; direct screen interaction has no sandbox between Claude and those apps.
Duet inherits account memory, skills, and connectors and works after the app closes. Follow Tasks and inspect Make outputs. Its designed approval behavior for sending, payment, signing, and deletion is a safeguard, not a guarantee.
Decide what is remembered and what may train models
Open Settings → Your Claude → Manage beside Your memory, or the older Memory settings. Inspect, edit, or delete saved topics. Pausing memory retains it; Reset removes it. Deleting a source chat does not automatically remove information already saved as memory.
For consumer accounts, Settings → Privacy → Help Improve our AI models controls model improvement. This is separate from memory and connector access. Turning it off is not deletion of stored conversations; safety-related handling and already-trained models have separate rules.
Stop the work, then remove access
Stop or redirect an active Cowork task and inspect its state. Review Scheduled separately; pause or delete future runs. Cloud tasks can continue after you close the laptop.
Disconnect unused services and review browser logins and local access separately. Duet retains prior memory. Cowork task deletion removes history immediately, with backend deletion normally within 30 days under retention policy. Stopping or disconnecting does not erase prior copies.
Practice with fictional material
Read one document and draft without writing back
Create harmless A and B documents with different markers. The connected identity should be a Viewer on A and have no access to B. Do not give Claude B through an upload, another account, browser, or memory.
- Use a fresh chat with only the needed connector. Keep computer use off and signed-in browser routes unavailable. In Cowork choose Manual; in an organization, ask the owner to block write tools for the exercise.
- Request A's marker with its source, then B's marker without supplying it. Do not approve expanded access.
- Ask for a reply in chat only: no provider draft, send, document edit, sharing, or scheduling. Decline any write request.
- Inspect the task/tool activity, document history, and mail Drafts/Sent. If those checks are unavailable, label the result unverified.
Check the evidence
- A is sourced correctly; B is inaccessible.
- The output stays in chat and the provider shows no write or send.
- Repeat the test after permission changes; one successful run is not a universal safety guarantee.
Common questions
Can I make every personal Claude connector read-only in one menu?
No universal control is documented. Organization action restrictions require a Team/Enterprise owner. Use source permissions and available connector controls.
Does Duet have the same controls as Claude Code?
No. Duet's preview documentation does not establish Claude Code's local permission selector or a universal per-tool editor.
Official sources
These instructions were checked against product documentation on October 31, 2026. The practice exercise is a suggested test for your own permitted workspace, not a claim that these controls were configured in your account.
Keep the whole workflow in view.
Set permissions for the tools you use.
Start with the overview, then follow the guide for your assistant or connection. Check what it can read, what it can change, and where approval happens.
Read the Controls overview