08 · Security, admin & governance

Threat model, controls, telemetry, data handling, and the honest gaps. If your executive audience includes anyone from risk, legal, security or compliance, this is the section they will actually read.

The shared threat model: prompt injection

Both products name prompt injection as the principal risk. Anthropic's Cowork guidance gives the cleanest formulation, and it is the best teaching device in the whole documentation set:

The two-condition rule

A prompt-injection attack requires two conditions simultaneously:

1. Claude can access content outside your trust boundary, and
2. Claude can perform consequential actions.

Break either one and the attack fails.

That framing gives non-technical leaders an actionable lever: they don't need to understand tokenisation to understand "don't let it read the internet and send email in the same unattended run."

Built-in protections, side by side

User responsibilities Anthropic explicitly assigns

For Cowork the documentation is unusually direct about what remains the user's job:

• File access — avoid granting Claude access to sensitive information such as financial documents.
• Browser permissions — limit internet access to trusted sites.
• Monitoring — "watch for unexpected patterns rather than validating every command."
• Scheduled tasks — exercise caution with unattended automation, especially involving sensitive data or consequential actions.
• Match oversight to stakes — use "Manually approve" mode for sensitive operations.

For Claude Code: "Claude Code only has the permissions you grant it. You're responsible for reviewing proposed code and commands for safety before approval." Plus: review before approving, don't pipe untrusted content directly to Claude, verify changes to critical files, use VMs for scripts that touch external services, and report suspicious behaviour with /feedback.

Administrative controls

Cowork

Claude Code

• Managed settings (managed-settings.json) — technical enforcement: permissions.deny, sandbox.enabled, env, forceLoginMethod, forceLoginOrgUUID. Deployed by MDM, Group Policy, Ansible.
• Blocking the permissive modes — permissions.disableBypassPermissionsMode: "disable" removes bypassPermissions (the --dangerously-skip-permissions mode, which "offers no protection against prompt injection or unintended actions"), and permissions.disableAutoMode: "disable" removes auto mode from the Shift+Tab cycle and rejects --permission-mode auto at startup. Both belong in any managed rollout; see §07.
• Managed CLAUDE.md — behavioural guidance at a system path, or inline via the claudeMd key. Cannot be excluded by users.
• Server-managed settings — central configuration without device-management infrastructure (Team/Enterprise).
• Managed MCP — allowlists and denylists restricting which MCP servers users can add or connect to.
• Claude apps gateway — self-hosted, SSO sign-in, per-group model access, OTLP telemetry, and per-developer spend limits enforced live per request.
• Corporate launcher — force every Claude Code process through a required wrapper.
• ConfigChange hooks — audit or block settings changes during a session.
• Required plugin version ranges for managed deployments.

Monitoring & telemetry

Cowork — OpenTelemetry (Team & Enterprise)

Configured at Admin settings → Cowork with an OTLP endpoint, protocol (http/json or http/protobuf) and headers. Requires desktop app v1.1.4173+. Settings load at session start, so existing sessions won't pick up changes.

Six event types are exported:

Standard attributes on every event: session.id, organization.id, user.account_uuid, user.account_id, user.id, user.email, workspace.host_paths, terminal.type (always non-interactive for Cowork). Resource attributes: service.name = cowork, service.version, host.arch, os.type, os.version.

Correlation: a prompt.id (UUID v4) links every event produced while processing a single user prompt. On third-party deployments, otlpTracesEnabled (beta) adds trace_id / span_id.

Claude Code — OTel plus a first-party analytics product

• OpenTelemetry metrics — available on every provider.
• Analytics dashboard — Team and Enterprise. Enterprise Analytics API for programmatic access. Contribution metrics require a claude.ai Team or Enterprise org.
• Cost controls — token tracking, team spend limits, /usage breakdown showing which skills, subagents and MCP servers drive limits.
• Cloud session audit logging — "All operations in cloud sessions are logged for compliance and audit purposes."

Data handling & retention

Model training

Retention

Encryption at rest, by provider (Claude Code)

In transit, everywhere: TLS 1.2+.

Telemetry defaults and opt-outs (Claude Code)

• Metrics — latency, reliability, usage patterns. Never include code, prompts or file paths. DISABLE_TELEMETRY=1.
• Error reports — on only for Pro/Max sign-ins on v2.1.198+ connecting directly to the Claude API, and not for ZDR/HIPAA orgs. DISABLE_ERROR_REPORTING=1.
• Everything non-essential at once — CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC.
• On Bedrock, Google Cloud's Agent Platform, Microsoft Foundry and Claude Platform on AWS, error reporting, telemetry and bug reporting are off by default.
• Two exceptions that run regardless of provider: session-quality surveys and the WebFetch domain safety check.

Certifications

Anthropic points to the Trust Center for SOC 2 Type 2, ISO 27001 and other compliance artefacts. A "Claude Cowork Security Overview" document is listed there for third-party platforms. Security vulnerabilities are reported through Anthropic's HackerOne programme.

Honest gap analysis