File Access & Working Folders

What You Need to Know

Every file interaction in Claude Chat follows the same tedious loop: drag a document into the window, wait for it to process, read Claude's response, download the output, and manually save it somewhere useful. Cowork eliminates this entirely. Point it at a folder on your machine and it reads, writes, edits, creates, renames, and moves files directly on your local file system. No uploading. No downloading. No 30 MB ceiling on individual files.

The mental model shift matters more than the mechanics. Chat is like emailing documents to a colleague in another building — they read what you send, draft a reply, and email it back. Cowork is like sitting that colleague at the desk next to you, opening the filing cabinet, and saying "everything you need is right here." Files never leave your machine, there's no intermediary step, and outputs land exactly where you need them.

Granting folder access: the security decision that matters most

Selecting a working folder is the single most consequential security decision you make in any Cowork session. Claude operates inside a sandboxed virtual machine on your device and can only see the folder — and its subfolders — that you explicitly grant. Parent directories? Invisible. Your Desktop, Downloads, home folder? Off limits. Type a full file path pointing somewhere outside the grant and Claude will simply tell you it cannot reach it.

This per-session scoping is deliberate. Even if you granted access to your entire Documents folder yesterday, that access doesn't carry over today. Each session starts with a clean slate. You can grant access to additional folders mid-session if your task requires files from multiple locations — but each grant is a conscious, explicit decision.

The working folder as Claude's world

Think of the working folder as the four walls of Claude's office. Everything it reads, creates, and modifies lives within this boundary. Cowork remembers recently used folders for quick selection, so you do not need to navigate from scratch every session. For recurring tasks — a weekly reporting pipeline, a monthly invoice audit — pointing Cowork at the same dedicated folder each time, combined with context files like rules.md or preferences.md, builds a persistent workspace that improves with use.

Read, write, delete: the permission tiers you must know

Within the granted folder, Claude has full read and write access. It opens any supported file type — PDFs, CSVs, Excel spreadsheets, images, Word documents, plain text — and creates new files of any type. Renames, subfolder moves, content overwrites: all of these happen without any additional permission prompt beyond the initial plan review.

Permanent deletion is the exception. When Claude tries to remove a file from disk, a system-level prompt appears and it cannot proceed until you click "Allow." There's no way to bypass, suppress, or batch-delete past this gate — each removal needs individual consent. That's the hard safety boundary, and it's deliberately narrow. Knowing exactly what it covers (and what it doesn't) is one of the most heavily tested concepts in Domain 2.

The three-tier permission model

The full permission architecture has three distinct layers. The exam expects you to distinguish between them:

1. Folder scoping — Claude can only access the folder (and subfolders) you grant per session. Everything outside is invisible.
2. Operation type — Reads and writes happen freely within scope. Only permanent deletions require explicit "Allow" approval.
3. Computer Use permissions — When Computer Use is enabled (Domain 4), accessing applications outside the sandboxed VM requires separate per-application permissions. This layer is entirely independent of file access.

Exam questions love to conflate these tiers. You might see a scenario where someone enables Computer Use and assumes that folder-level file access permissions also govern application access. They don't — the two systems are architecturally separate.

Dedicated workspace folders: the least-privilege principle in practice

This goes beyond best practice — it's the foundation of safe Cowork usage. Think about what actually sits in your Documents folder: tax returns, employment contracts, financial records, client agreements, saved passwords, personal correspondence. Granting Cowork access to all of that because you need three CSV files is like giving a new hire the master key to the building when they only need one meeting room.

Create a folder with a descriptive name — Campaign-Analysis-Q2, Invoice-Processing-March, Board-Deck-Draft — copy the relevant files in, and scope Cowork to that folder. Thirty seconds of preparation reduces your exposure from thousands of files to the handful that actually matter.

Expect the exam to test this repeatedly. If a scenario describes someone granting access to a broad directory and asks what could go wrong, the correct answer centres on unnecessary exposure of sensitive files. Not on Claude deliberately misusing them — on the principle that reducing the attack surface is always the responsible default.

---

Common Mistakes

---

Hands-On Activity

---

Practice Question

---

Sources

• Get started with Cowork — Anthropic
• Use Cowork safely — Anthropic
• Cowork: Claude Code power for knowledge work — Anthropic
• Claude Cowork Guide 2026: Skills, Plugins, Connectors & Setup Tips — FindSkill.ai