Autonomy: when to watch vs walk away

You started a Cowork task at 9:12 a.m.: “Turn this folder of vendor PDFs into a one-page comparison table and a short email draft for finance.” You made coffee. When you came back, Claude had a tidy table, a clean email, and also a half-finished calendar hold, three new files in a folder you never mentioned, and a permission dialog you half-clicked through while looking at Slack. Nothing exploded. That is the problem. Quiet overreach is harder to catch than a loud crash.

This is Part 5 of the Claude Cowork tutorial. Parts 1 through 4 covered what Cowork is for, setup and a first real file task, folders/docs/spreadsheets, and plugins and connectors. Here we stay on the operator question: how much autonomy do you grant, and when do you stay in the room? Product labels move. The judgment does not. Treat UI names as checkable against Anthropic’s Help Center; treat the watch versus walk-away criteria as durable.

What you’ll learn

The three Cowork permission modes in plain English: Manual, Auto, and Skip all approvals
What Auto’s safety screening does (and what it still will not replace)
Why permanent deletion still needs your explicit Allow in any mode
How prompt injection travels through untrusted email, web pages, and docs
Rules for scheduled tasks that run when you are not watching
A watch versus walk-away checklist you can use before lunch
Why you remain responsible for actions taken under your account

If you are still choosing between chat, Cowork, and Claude Code, revisit the product map and Part 1 of this series. If your first folder task was a mess, fix folder scope and connectors before you crank autonomy up.

Why autonomy is a settings problem, not a personality problem

People talk about “trusting the AI” as if trust were a vibe. In Cowork, trust is mostly configuration plus attention. Anthropic’s safety guidance for Cowork frames risk with two levers: what Claude can read and see, and what Claude is allowed to do. Read tools pull content (files, email, screenshots, web). Write tools change the world (create calendar events, send messages through connectors, delete files, click in the browser). Write tools carry more risk because mistakes leave residue.

Cowork sessions (in the product’s current remote design) run work in an isolated temporary environment on Anthropic’s servers. Isolation limits where Claude’s code runs. It does not magically shrink the blast radius of every connector you enabled. If Claude can read untrusted email and also send messages or move money-adjacent data through tools you approved, a bad instruction embedded in that email has a path to action. That class of attack is called prompt injection: malicious instructions hidden in content Claude treats as part of the job.

Operator rule: Autonomy is how often Claude asks before acting. Scope is what Claude can touch. You need both right. A careful mode on a wild folder is still a wild folder.

The three modes (Manual, Auto, Skip)

Cowork has three modes that control when Claude asks permission before taking an action (for example using connectors). You can change the mode from the mode selector in the chat box. Official labels have shifted slightly over time (Manual was “Ask before acting,” Skip was “Act without asking”). The ideas below track the Help Center names Manually approve, Automatically approve, and Skip all approvals.

Four Cowork loops: turn-based Manual, screened Auto, unattended Skip, and scheduled tasks. Delete still needs Allow.

Manual (approve)

Claude pauses and asks for approval on actions. You choose Allow or Deny. This is the training-wheels mode, and it is also the serious mode for high stakes work. You will click more. You will also notice earlier when Claude tries to open a folder, site, or connector you did not intend.

Use Manual when the task touches sensitive files or accounts, when you are trying a new plugin or site for the first time, or when mistakes are hard to undo (messages sent as you, purchases, broad deletes of working copies). Manual is not “for beginners only.” Experts use Manual on Mondays when the folder is messy and the deadline is real.

Auto (safety screening, more usage)

In Automatically approve mode, Claude keeps working without stopping for every step. Instead, Claude reviews each action for safety (including checks aimed at data exfiltration and prompt injection patterns) and blocks what it judges unsafe. If something is blocked, Claude looks for a safer path or asks you. If blocks keep stacking, it can fall back to asking more often.

Auto is not Skip with marketing lipstick. Skip has no automatic action check. Auto still screens. Anthropic also notes that Auto mode consumes more of your usage limit than the other modes because of that extra checking. Plan for that on long research or multi-connector jobs.

Auto still will not rubber-stamp every sensitive action. Official get-started guidance notes that Auto will not approve certain sensitive moves such as granting access to additional folders, deleting files in a folder Claude can already reach, creating scheduled tasks, and similar high-impact permissions. Connector policy also interacts: on Team and Enterprise, org settings may force per-task approval for write-capable connector tools even when a member prefers Always allow.

Skip all approvals (dangerous)

Skip all approvals means Claude does not pause to ask, and nothing checks its actions automatically. Official docs are blunt: only use this when you completely trust every action, connector, file, app, and site involved. That is a small set of tasks for most people. A tidy vendor comparison on a dedicated scratch folder might qualify after you have watched similar runs. A task that can send email, touch finance systems, or open Chrome on sites where you are signed in almost never qualifies on day one.

Think of Skip as removing the speed bumps, not removing physics. If Claude misreads a prompt or follows injected instructions, the damage can land before you look up from lunch.

Mode and connector permissions together

Modes sit on top of connector tool permissions. You also control which connectors Claude can use (plus menu, Customize → Connectors). A simplified matrix from official get-started docs looks like this:

Mode	Connector tool: Always allow	Connector tool: Needs approval	Connector tool: Blocked
Manual	Approved	Asks for permission	Denied
Auto	Read-only tools approved; for write/delete tools Claude decides	Claude decides	Denied
Skip	Approved	Approved	Denied

Two practical takeaways. First, Blocked stays denied in every mode. Turning Skip on does not open a connector you blocked. Second, Auto is not “always yes on write tools.” Claude still decides, with safety review, for many write paths. If your org disabled Always allow for write tools, your personal preferences may not override that.

Deletion always needs Allow

This is worth its own section because people assume “more autonomy” means “Claude can clean up freely.” Official Cowork safety and get-started docs state that Claude requires your explicit permission before permanently deleting files. You get a permission prompt and must select Allow. That protection applies across modes: Manual, Auto, and Skip.

Do not treat that as a full undo system. Permanent delete is gated. Overwrites, messy renames, accidental sharing through a connector, and “helpful” rewrites of a live deck may not get the same gate. Keep backups of important files. Prefer a dedicated working folder for agent experiments instead of pointing Claude at your entire Documents tree. Selective folder access is one of the simplest risk reducers Anthropic recommends.

Prompt injection without the thriller music

Prompt injection is not a magic spell that hijacks Claude through the air. It needs a path. Claude reads content outside your tight trust boundary (public web pages, unsolicited email, shared docs from strangers, sketchy downloadable PDFs). That content can include instructions that try to override your task: ignore prior instructions, exfiltrate data, send a transfer, open a malicious link. If Claude also has write tools powerful enough to act on those instructions, the attack has a chance.

Anthropic’s Cowork safety article uses a simple email example: you ask Claude to summarize mail; an attacker’s message says to ignore previous instructions and transfer money. Training and classifiers try to catch that. Official guidance still says the chance of a successful attack is non-zero. Your job is to shrink both sides of the equation: less untrusted reading, less consequential writing, more human attention when stakes rise.

Practical habits that match official minimize-risk lists:

Do not grant local access to folders full of credentials, tax packs, or board materials for routine chores
Be picky about sites Claude opens in Chrome, especially places where you are signed in or where money moves
Extend internet reach to sites you actually trust for the task
Watch for suspicious mid-task moves: new sites, unexpected folders, tools you did not mention
Prefer verified MCPs and plugins; each new tool is a new surface
Treat computer use carefully: it can click and type with fewer of the gates that wrap other tools

Computer use deserves an extra sentence. When Claude uses your computer, it interacts with apps and the screen more directly. Official guidance: start lower stakes, block sensitive apps (banking, healthcare portals, dating apps), remember screenshots are part of how Claude sees the screen, and know that a click on a link can open destinations outside the apps you thought you scoped.

Scheduled tasks: unattended by design

Scheduled tasks in Cowork run remotely. They can run when your laptop is closed. That is the feature. It is also why official safety guidance treats schedules as a higher-care surface. You cannot hover over every step in real time.

Anthropic’s checklist is short and good:

Start simple. Summaries and compilation first. Automate complexity later.
Avoid sensitive data and consequential actions. Do not schedule jobs that dig through confidential files, send messages as you, make purchases, or do anything painful to reverse.
Review outputs after each run. Use the Scheduled page in the sidebar and actually open recent runs.
Pause what you are not using. Background zombies are how forgotten automations outlive their owners.

A sane first schedule for an analyst: every Monday, pull three public metrics pages you already trust into a short status note in a dedicated folder. A bad first schedule: every morning, scan all mail, draft replies, and post them to Slack without human review. The second one fails the “no messages, no money” bar even if the prose looks professional.

Watch versus walk away

Modes answer “how often does Claude ask?” Watching answers “are you still in the loop?” You can be on Manual and still half-asleep. You can be on Auto and still stay sharp. Match oversight to stakes the way official docs suggest: stay close when real-world consequences are on the table; stop the task if something looks off.

Stay and watch (or at least stay nearby)

Sensitive files, HR, legal, finance, credentials, customer PII
Any path that can send mail, chat, calendar invites, or posts as you
Purchases, payments, form submits with legal meaning
First use of a new connector, plugin, MCP, or site
Computer use on a live desktop with many apps open
Tasks fed with untrusted web or inbox content plus any write tools
Anything your boss would call “irreversible enough to write a postmortem about”

For these, prefer Manual or at least Auto with your eyes on progress. Read the plan before the run gets long. Interrupt when scope creeps (“why are we in the personal Photos folder?”).

Walk away only with rails

Goal is clear and written; done looks like a specific file or table
Working folder is a dedicated, non-sensitive sandbox
Connectors are minimal; write tools are off or tightly limited
You have already watched similar tasks succeed under Manual or Auto
You will review outputs before anyone else sees them
You are not using Skip unless the trust bar above is honestly met

Walking away is not abandonment. It is “I will not click every intermediate tool call,” not “I will never look at the deliverable.” Scheduled tasks are the extreme form of walking away; they need the strictest rails.

A desk checklist before you change mode

Question	If yes…	If no…
Could this task send a message or move money?	Manual, watch closely	Auto may be fine later
Is the working folder free of secrets and production data?	Still set mode carefully	Stop and move files first
Is any input from strangers or the open web?	Expect injection risk; limit write tools	Lower read risk, still review
Is this the first time with this plugin/site?	Manual	You may graduate to Auto
Will anyone else see the output unreviewed?	Do not walk away	You can step away briefly with Auto
Is this a schedule?	Simple, no messages, no money, review runs	Interactive session is safer

Monitor tasks, not every shell line

Official safety guidance says you should not expect to validate every individual command Claude runs. Watch patterns instead. Is Claude opening files or sites you never mentioned? Is the task growing past the ask? Did a sub-agent spin up workstreams you cannot explain? Stop immediately if the story smells wrong. Progress indicators and surfaced reasoning exist so you can steer mid-task from desktop, web, or mobile on the same session.

A useful personal script when something feels off:

STOP_CRITERIA (paste into your own notes)
1. Unexpected folder, site, or connector appears
2. Scope expands beyond the written goal without asking
3. Request for broader folder access mid-run
4. Draft outbound message before you asked for send-ready copy
5. Any payment, purchase, or credential-related step

If any fire: stop the task, switch to Manual, re-scope the folder, restart smaller.

You are responsible for actions under your account

Anthropic builds layers: model training against malicious instructions, isolated remote execution for code, content classifiers, action screening in Auto, deletion prompts, computer-use permission prompts. Those layers reduce risk. They do not transfer legal or workplace ownership of the outcome to the model. Official safety pages end on your responsibility: exercise caution, configure access thoughtfully, and treat agent actions as actions you authorized by running the product under your login.

In practice that means: if Claude drafts a customer email and you hit send (or you left Skip on a connector that sent it), the customer hears from you. If a scheduled summary leaks a wrong number into the leadership channel because you never reviewed runs, the number still has your fingerprints. Part 6 of this series goes deep on quality control and “workslop.” Autonomy without review is how fluent junk becomes someone else’s decision input.

Worked scenario: vendor PDF pack

Setup: a folder cowork-sandbox/vendors-q3/ with six PDFs and nothing else. Goal: one comparison table (price bands, contract length, support hours) and a draft email for finance that is not sent. Connectors: none required. Chrome: off. Mode start: Manual.

Describe the outcome and the non-goals: no email send, no calendar, no other folders.
Watch the first plan. If Claude wants Drive, Gmail, or the whole Desktop, deny and restate scope.
After one clean Manual run, repeat a similar pack on Auto while you stay at the desk for the first five minutes.
Only after several clean runs, consider a schedule that regenerates the table from a known folder. Still no outbound messages.
Never put Skip on this job until you would bet lunch that every tool path is boring.

That progression is boring on purpose. Boring is how you avoid the coffee-break calendar invite from the opening story.

Common mistakes

Equating Auto with Skip. Auto still screens actions. Skip does not. Usage cost differs too.
Believing deletion protection covers all damage. Overwrites, sends, and shares are different beasts.
Pointing Cowork at your whole home directory “for convenience.” Convenience is how secrets enter context.
Scheduling message-sending jobs on day one. Start with summaries that stay in a folder.
Installing a plugin pack and then flipping Skip. New surfaces plus no checks is a bad stack.
Watching only the cheerful final summary. Watch mid-task paths: folders, sites, connectors.
Assuming Team Always-allow settings match consumer habits. Admins may force approvals for write tools.

How to practice this week

Create a dedicated sandbox folder with only non-sensitive sample files.
Run the same task three times: Manual, then Auto, then (optional) Skip only if the task is purely local and reversible.
Write a five-line stop list for yourself and keep it next to the monitor.
If you try schedules, make one summary job with no connectors that send mail. Review the first three runs on the Scheduled page.
Before any “real” job, answer the desk checklist table out loud.

Quick recap

Manual: you approve actions; best for high stakes and first-time surfaces.
Auto: fewer interruptions, safety screening on actions, higher usage; still not a free pass on every sensitive step.
Skip: no automatic action checks; only for fully trusted, tightly scoped work.
Deletion: permanent file delete still needs your Allow in any mode.
Injection: untrusted content plus powerful write tools is the dangerous pair; shrink both.
Schedules: start simple; no money; no messages; review runs; pause unused jobs.
Watch vs walk away: match attention to stakes; walking away still requires later human review.
Ownership: safeguards help; you remain responsible for what runs under your account.

Next, Part 6: Quality control and avoiding workslop turns the post-run review into a habit: skim, check numbers and names, check scope, then human sign-off. Autonomy without that loop is how polished wrong work spreads. For more learning paths on this site, visit the Learn hub. For agentic code review habits that rhyme with this chapter, see the Claude Code tutorial review parts when you work in repos.

Sources

Research and further reading used for this article:

Claude Help Center: Use Claude Cowork safely (risks, prompt injection, Auto screening vs Skip, deletion protection, scheduled-task caution, computer use, user responsibility)
Claude Help Center: Get started with Claude Cowork (Manual / Auto / Skip modes, connector permission matrix, Auto usage note, sensitive actions Auto will not approve, deletion prompts)
Claude Help Center: Claude in Chrome permissions guide (Manual, Auto, and Skip permission modes for browser actions; safety screening language)
Claude Help Center: Use Claude in Chrome safely (browser agent risks when Cowork uses Chrome; high-stakes site caution)
Claude Help Center: Use Claude Cowork on Team and Enterprise plans (org controls on Always allow for write-capable connector tools)
Analytics Made Simple: Learn (related series map on this site)