AI agents that work directly on computers turn one small habit into an important decision: clicking the Allow button. In Claude Cowork, this button appears when Claude is about to open a folder, use a connector, touch an application, or delete a file. One of Claude's class recordings for Professionals and Business Owners at Taalenta touches on this habit: read permission requests first, don’t approve them immediately. This article details what is actually behind that button, based on official documentation from Anthropic as of September 2026.
Two groups of tools: reading and acting
Anthropic divides Claude's tools into two groups. Reading tools access content, such as reading email inboxes or taking screenshots. Writing tools change something in your environment: creating calendar invitations, executing commands, clicking on screens, or deleting files. Writing tools are treated more strictly because the consequences are real and sometimes irreversible.
This division is important because the biggest risk of AI agents, namely prompt injection, only succeeds if two conditions are met simultaneously: Claude reads content from outside your trust boundaries (web pages, emails, documents sent by others), and Claude is allowed to perform harmful actions. Breaking one of the conditions already complicates the attack. The Allow button is where you break the second condition.
Three approval modes
Cowork has three modes that can be switched at any time from the mode selector in the chat box. The final outcome depends on the combination of modes and permission settings for each connector.
| Mode | Connector Always allow | Connector Needs approval | Connector Blocked |
|---|---|---|---|
| Manually approve | approved | Claude asks | denied |
| Automatically approve | reading tools approved; writing and deleting tools decided by Claude | decided by Claude | denied |
| Skip all approvals | approved | approved | denied |
The most commonly overlooked difference is in the last two rows. In Automatically approve, every action is still security-checked before execution, including indications of prompt injection and data exfiltration; if continuously blocked, Claude will ask again step by step. This mode uses more quota due to the additional checks. In Skip all approvals, nothing is checked at all. Anthropic itself recommends using this mode only if you fully trust every connector, file, application, and site involved.
What is always asked, and what is never asked
Two things are outside the table above.
First, permanent deletion of files always requires explicit permission, in any mode. You will see a prompt and must select Allow before Claude deletes. This is the prompt that is most worth reading to the end, as the result cannot be undone.
Second, computer use employs different logic. When Claude clicks and types directly on the screen, there is no sandbox between Claude and your application, and there are no permission checks per action as in file operations. Permissions are granted at the application level: Claude asks before touching each new application, categories like investment and crypto platforms are blocked from the start, and you can add other applications to the block list. The only automatic process is scanning for indications of prompt injection. One important note from the documentation: links clicked in one application remain open in another application, even if Claude is not granted permission to that application.
Checklist before pressing Allow
- Read the object, not just the verb. The prompt delete for temporary files is different from the prompt delete for a working folder.
- Match with the task you assigned. Requests to access folders, sites, or applications that you did not mention are signals to stop, not to allow.
- Use a specific working folder, not the entire Documents, and keep financial documents, credentials, and other people's personal data out of Claude's reach. Also close applications containing sensitive information, as Claude understands screens through screenshots.
- Switch to Manually approve when touching sensitive accounts, using new tools or plugins for the first time, or when the mistakes are hard to undo, such as sending messages.
- For scheduled tasks running without your supervision, avoid sensitive data and impactful actions, then check the results each time they finish.
OWASP names failures on this side as Excessive Agency: agents are given functions, permissions, or autonomy beyond what is needed for their tasks, allowing high-impact actions to proceed without human approval. The consciously read Allow button is the simplest human-in-the-loop control you have.
If you prefer to see the context directly from the class, there is a clip.
Sources
- Anthropic, Claude Help Center: Use Claude Cowork safely (accessed September 11, 2026)
- Anthropic, Claude Help Center: Get started with Claude Cowork, section Choose how Claude checks with you
- Anthropic, Claude Help Center: Let Claude use your computer in Cowork
- Anthropic, Claude Help Center: Use Claude in Chrome safely
- OWASP Gen AI Security Project: LLM06:2025 Excessive Agency