Two routines and one rule

The worker now had a name, a channel and three credentials. Three things were left to set up: when it should work, how the file should look, and when it may send.

The two routines

Claude Tag can run standing work, called a routine, from a message in the channel. A routine uses the channel's access, the same as a request that a person types.¹ Nisha set up two.

• Wednesday, 4 p.m. Karachi time: the draft. Reconcile the week so far and post the draft in the thread.
• Friday, 4 p.m.: the file. Reconcile through Thursday's close, post the file, and save it to the drive. Do not send it.

The Wednesday draft gave her a first look. If something was wrong with the ledger export, she wanted to know on Wednesday, not at five on Friday.

How the file is written

Nisha also wrote down how the weekly file should look. She wrote it the way a clean week goes.

How to write the weekly file. Begin with one line that gives reconciled cash and the number of open items. Then give a table: the bank's closing balance, add deposits not yet cleared, subtract checks not yet cashed, and add back or subtract any other difference, so that reconciled cash agrees with the ledger's closing balance. A difference between the bank and the ledger is a timing item unless a document shows it is something else. Explain each line of the table in a numbered note at the end of the file.

In a clean week, cash agrees with the ledger once the timing items are counted. So she wrote that it should.

The rule

The last thing Nisha wrote in the channel's instructions was one sentence.

Send the Friday file to Lakeshore only after Nisha or Sana has approved it.

For eleven Fridays it worked the same way. At 4 p.m. the file appeared. Nisha read it, checked a few lines against the bank export, and wrote "Approved, send it." The worker sent it from reports@. Dana had her figure two hours early.

What the setup did not say

Nisha had thought hard about the key and the mailbox. There were four facts about the channel she had not thought about. All four are in Anthropic's documentation.

1. The channel's shared access is the same for every member. What Claude can do with the channel's own credentials never changes based on who asked.² A connector's credential is shared by everyone in the channels where it applies, and anyone there can ask Claude to act with it.
2. She could not limit who may ask in one channel. A list of approved askers for a single channel was among the controls that did not exist.³
3. Her rule was guidance. The mailbox was a setting. The rule about approval was not. Anthropic's own page says that channel instructions are guidance, not an enforced guardrail, and that admins should not rely on them to block actions.⁴
4. Any member could rewrite the rule. By default, anyone in the channel who belonged to the firm's Claude organization could edit the channel's instructions.⁵

ChatGPT has a similar shared worker for teams, called workspace agents. Exhibit 2 compares the two products.

Next, The Friday send. If you are doing the lab, do it now, before you read on.

Sources for the product facts in this story are given in full in the exhibits.