A document is not the only place work information reaches an AI service. On 15 October 2026, Anthropic announced that its Compliance API can return saved Instructions for Claude and Cowork Global instructions, in beta for Claude Enterprise organizations. Review those settings as well as the file you are about to upload.
Who can retrieve the instructions?
The current guide requires a Compliance Access Key with the read:compliance_user_data scope. This does not mean every colleague or ordinary workspace administrator can automatically read your settings. Ask the responsible administrator how compliance access is configured in your organization.
There is an important account boundary: the guide describes these instructions as account-level values. The same saved text is returned under every organization the current member belongs to. Do not assume that a preference containing a client name belongs only to the workspace open on your screen. The documented beta concerns Enterprise compliance access; it does not establish the same behavior for every personal or Team account.
Inspect the reusable text first
Open Instructions for Claude and Cowork Global instructions where available. Keep useful general directions such as “give dates in ISO format.” Look for customer names, internal figures, copied document passages and details of another organization. A useful rewrite is “use the approved project glossary” rather than pasting confidential glossary entries into a global preference.
If inappropriate information is already saved, follow your organization’s handling procedure. Removing it from the current setting does not prove that earlier records, exports or outputs vanished.
Then check the actual document
A paid account is not blanket permission to upload a work file. Confirm the authorized service, account and material, including applicable retention, training and sharing controls. Read comments, hidden sheets and metadata as well as visible paragraphs. For a column-layout question, an invented three-row table may be enough; replacing only a customer’s name does not necessarily anonymize the rest.
Before sending, check the active organization and the minimum necessary excerpt. Afterwards, inspect the answer for details that should not enter a public summary. This is a practical account-boundary check, not a promise of legal compliance or a claim that all document contents became newly accessible on 15 October.