# 7.8 The same envelope on today's tools (/managing-ai-workers/the-authority-envelope/both-ai-vendors) --- type: Document title: "7.8 The same envelope on today's tools" description: "How Anthropic's and OpenAI's own pages, and three open-source tools, let you set the same limits, the differences that change your setup, and what stays the same." status: stable order: 207.8 ksor: owner: team:panaversity audience: [ public ] approval: by: process:panaversity at: 2026-11-05T06:58:17Z chapter: "07" part: II expert_status: required concepts: [ "7.8" ] last_verified: 2026-10-07 review_by: 2026-11-07 sources: - id: anthropic-one-claude title: "Claude Cowork and chat are one Claude (Claude Help Center, verified 2026-11-03)" resource: https://support.claude.com/en/articles/16761823-claude-cowork-and-chat-are-one-claude - id: anthropic-cowork title: "Get started with Claude Cowork (Claude Help Center, verified 2026-11-03)" resource: https://support.claude.com/en/articles/13345190-get-started-with-claude-cowork - id: anthropic-cowork-safely title: "Use Claude Cowork safely (Claude Help Center, verified 2026-11-03)" resource: https://support.claude.com/en/articles/13364135-use-claude-cowork-safely - id: anthropic-connectors-docs title: "Get started with connectors (Claude documentation, verified 2026-10-07)" resource: https://claude.com/docs/connectors/getting-started - id: anthropic-connectors title: "Use connectors to extend Claude's capabilities (Claude Help Center, verified 2026-10-07)" resource: https://support.claude.com/en/articles/11176164-use-connectors-to-extend-claude-s-capabilities - id: anthropic-cowork-team title: "Use Claude Cowork on Team and Enterprise plans (Claude Help Center, verified 2026-11-03)" resource: https://support.claude.com/en/articles/13455879-use-claude-cowork-on-team-and-enterprise-plans - id: anthropic-unified-enterprise title: "Set up and manage the new unified Claude experience for your Enterprise organization (Claude Help Center, verified 2026-11-03)" resource: https://support.claude.com/en/articles/17444462-set-up-and-manage-the-new-unified-claude-experience-for-your-enterprise-organization - id: anthropic-chrome-permissions title: "Claude in Chrome permissions guide (Claude Help Center, verified 2026-11-03)" resource: https://support.claude.com/en/articles/12902446-claude-in-chrome-permissions-guide - id: anthropic-computer-use title: "Let Claude use your computer in Cowork (Claude Help Center, updated 30 October 2026, verified 2026-10-31)" resource: https://support.claude.com/en/articles/14128542-let-claude-use-your-computer-in-cowork - id: anthropic-prompt-injection-research title: "Mitigating the risk of prompt injections in browser use (Anthropic, 24 November 2025, verified 2026-10-07)" resource: https://www.anthropic.com/research/prompt-injection-defenses - id: anthropic-scheduled-tasks title: "Schedule recurring tasks in Claude Cowork (Claude Help Center, verified 2026-11-03)" resource: https://support.claude.com/en/articles/13854387-schedule-recurring-tasks-in-claude-cowork - id: anthropic-routines title: "Automate work with routines (Claude Code Docs, verified 2026-10-07)" resource: https://code.claude.com/docs/en/routines - id: anthropic-custom-roles title: "Manage custom roles on Enterprise plans (Claude Help Center, verified 2026-10-07)" resource: https://support.claude.com/en/articles/13930452-manage-custom-roles-on-enterprise-plans - id: openai-permissions title: "Permissions (OpenAI, ChatGPT Learn, verified 2026-10-08)" resource: https://learn.chatgpt.com/docs/permission-modes - id: openai-prompting title: "Prompting (OpenAI, ChatGPT Learn, verified 2026-10-08)" resource: https://learn.chatgpt.com/docs/prompting - id: openai-app-permissions title: "Managing app permissions in ChatGPT (OpenAI Help Center, verified 2026-10-08)" resource: https://help.openai.com/en/articles/20001495-managing-app-permissions-in-chatgpt - id: openai-cloud-browser title: "Using cloud browser in ChatGPT (OpenAI Help Center, verified 2026-10-08)" resource: https://help.openai.com/en/articles/20001280-using-cloud-browser-in-chatgpt - id: openai-atlas title: "Using Ask ChatGPT sidebar and ChatGPT Agent on Atlas (OpenAI Help Center, verified 2026-10-08)" resource: https://help.openai.com/en/articles/12628199-using-ask-chatgpt-sidebar-and-chatgpt-agent-on-atlas - id: openai-resist-injection title: "Designing AI agents to resist prompt injection (OpenAI, verified 2026-10-08)" resource: https://openai.com/index/designing-agents-to-resist-prompt-injection/ - id: openai-lockdown title: "Lockdown Mode (OpenAI Help Center, verified 2026-10-08)" resource: https://help.openai.com/en/articles/20001061-lockdown-mode - id: openai-admin-apps title: "Admin controls, security, and compliance for plugins and apps (OpenAI Help Center, verified 2026-10-08)" resource: https://help.openai.com/en/articles/11509118-admin-controls-security-and-compliance-for-plugins-and-apps - id: openai-scheduled-tasks title: "Scheduled tasks in ChatGPT (OpenAI Help Center, verified 2026-10-08)" resource: https://help.openai.com/en/articles/10291617-scheduled-tasks-in-chatgpt - id: openai-workspace-agents title: "ChatGPT Workspace Agents for Enterprise and Business (OpenAI Help Center, verified 2026-10-08)" resource: https://help.openai.com/en/articles/20001143-chatgpt-workspace-agents-for-enterprise-and-business - id: anthropic-duet title: "Claude Duet (Anthropic, 21 October 2026, verified 2026-10-23)" resource: https://claude.com/resources/articles/claude-duet - id: anthropic-duet-help title: "Get started with Claude Duet (Claude Help Center, verified 2026-10-23)" resource: https://support.claude.com/en/articles/17631495-get-started-with-claude-duet - id: openai-dots title: "Introducing dots (OpenAI, 29 September 2026, verified 2026-10-23)" resource: https://openai.com/index/introducing-dots/ - id: openai-dots-faq title: "Dots privacy, security and safety FAQs (OpenAI Help Center, verified 2026-10-23)" resource: https://help.openai.com/en/articles/20001529-dots-privacy-security-and-safety-faqs - id: opencode-permissions title: "Permissions (OpenCode v2 documentation, verified 2026-10-23)" resource: https://opencode.ai/v2/docs/permissions/ - id: omnara-permissions title: "Tool permissions (Omnara documentation, verified 2026-10-23)" resource: https://docs.omnara.com/tools/permissions - id: omnara-integrations title: "Integrations overview (Omnara documentation, verified 2026-10-23)" resource: https://docs.omnara.com/integrations/overview - id: openclaw title: "OpenClaw README (OpenClaw Foundation, GitHub, MIT, verified 2026-10-23)" resource: https://github.com/openclaw/openclaw - id: openclaw-access-control title: "Access control (OpenClaw documentation, verified 2026-10-23)" resource: https://docs.openclaw.ai/gateway/security/access-control - id: openclaw-prompt-injection title: "Prompt injection (OpenClaw documentation, verified 2026-10-23)" resource: https://docs.openclaw.ai/gateway/security/prompt-injection - id: openclaw-heartbeat title: "Heartbeat (OpenClaw documentation, verified 2026-10-23)" resource: https://docs.openclaw.ai/gateway/heartbeat - id: openclaw-sandboxing title: "Sandboxing: modes, scope and backend (OpenClaw documentation, verified 2026-10-23)" resource: https://docs.openclaw.ai/gateway/sandboxing/modes-scope-and-backend - id: mcp-tools title: "Tools, MCP specification 2026-07-28 (Model Context Protocol, verified 2026-10-23)" resource: https://modelcontextprotocol.io/specification/2026-07-28/server/tools - id: mcp-mrtr title: "Multi Round-Trip Requests, MCP specification 2026-07-28 (Model Context Protocol, verified 2026-10-23)" resource: https://modelcontextprotocol.io/specification/2026-07-28/basic/patterns/mrtr generated: at: 2026-11-05T06:58:17Z by: process:panaversity trust_tier: unverified build_id: sha256:46fd53c5d7ab1c14f6347908d45c9fdaecda4d914439923ee878bdcecd57803e dirty: true ksor_version: 0.0.60 --- **In everyday life.** Two banks both let you set limits on your card. One puts the setting in its app. The other makes you call. Your budget is the same either way. The Authority Envelope, the written limit on what an AI Worker may do, describes the job, so it does not change between AI vendors. The settings that enforce it do change. **The comparison.** Both AI vendors separate reading from writing. Both let you set permissions per tool or per app. Both let admins set limits that users cannot loosen. Both put a connector ahead of the browser. And both offer settings that ask a person before consequential actions, the actions with real effects. Two differences change your setup. The first difference is where the product decides for you. On Claude you set each tool's level yourself. But the conversation setting decides what Needs approval means. Manual asks you, Auto lets Claude's safety checks decide, and only Blocked works the same in every setting.[^anthropic-cowork] As of 3 November 2026, Auto is Claude's default on Pro, Max, Ultra and Team.[^anthropic-one-claude] On ChatGPT, the Allow low-risk actions level lets the product decide which actions are low risk. So keep Claude on Manual for any action a person must approve, whatever its default. On ChatGPT, compare what the product counts as low risk with your envelope, or choose a stricter level. On either AI vendor, a level that asks before changes still leaves the worker able to change things once you approve. That is execute with approval, not draft. The second difference is unattended runs, the runs no one watches. ChatGPT's documentation says a scheduled task may pause when an action needs approval, and Claude's scheduling page does not say what happens. Check your setup before you schedule anything with a write tool ([Chapter 9](../work-that-runs-without-you/scheduled-and-event-triggered.md)). Open source adds a third difference: the tool settings start open. OpenCode allows every tool until you write a rule, and Omnara allows its built-in and custom tools. So on these tools, each limit in the envelope is a rule you write, or a line on the gap list. MCP (Model Context Protocol), a standard way to connect AI apps to other systems, does not change this. The standard does not define an approval step, so the app's settings still do the asking. | Line | Anthropic's Claude | OpenAI's ChatGPT | | --- | --- | --- | | The conversation setting | Manual or Auto. Skip all approvals in some places | On the desktop, for local actions: Ask for approval, Approve for me or Full access | | Per-tool control (the first difference) | Per tool or group: Always allow, Needs approval or Blocked | Per app: four levels. At Allow low-risk actions, the product decides what counts as low risk | | Consequential actions | Asks before permanent deletion. Claude in Chrome is built not to take some actions | Designed to ask before actions that are hard to undo, or that create a real-world commitment | | Tool order | Connectors first, then the browser, then the screen | A connected app first, then the cloud browser | | Prompt injection | An attack needs untrusted input and a harmful action. No browser agent is immune | An attack needs a source and a sink. App safeguards do not remove the risk | | Runs no one watches (the second difference) | Scheduled tasks: the help page does not say what happens when an approval is needed. Claude Code routines: no prompts | A scheduled task may pause when an action needs approval | | Admin policy | Owners choose the connectors, and Enterprise roles can make tool permissions stricter | Admins choose each app's actions, and how new actions are treated | *Figure 7.8. The same envelope on both AI vendors, from the boxes below, with their dates. Availability varies by product, plan and workspace. Documented behavior is no guarantee that an unsafe action will be blocked, so recheck your own settings before use.* **What stays the same.** The envelope is written once, by its owner, and it stays the same on either AI vendor or an open-source tool. Settings only come close to it. A line that no setting can enforce goes on the gap list. It stays with a person until a system such as DSoR, the Data System of Record, enforces it. **For reference.** The two AI vendors' boxes follow the same eight lines in the same order. The open-source box uses the lines its tools match, and it ends with how to run them safely. > **Anthropic, as verified 7 October 2026.** > - *The conversation setting.* A permission setting in the message box covers the whole conversation. Manual asks you before each action, except for tools you set to Always allow.[^anthropic-cowork] Auto keeps working, with automated safety checks before each action. As of 3 November 2026, Auto is the default on Pro, Max, Ultra and Team, and Manual is the default on Enterprise.[^anthropic-one-claude] Anthropic's other pages call these two Automatically approve and Manually approve.[^anthropic-chrome-permissions] A third mode, Skip all approvals, asks nothing, and no safety check runs before Claude acts.[^anthropic-cowork-safely] Claude in Chrome offers it.[^anthropic-chrome-permissions] In the one conversation, the message box offers only Auto and Manual.[^anthropic-cowork] Anthropic's admin page says the third mode applies there to scheduled tasks and the built-in browser, and an Enterprise owner can turn it off.[^anthropic-unified-enterprise] > - *Per-tool control (7.4).* In the settings of each connector, a link from Claude to another app, you set each tool or group of tools to Always allow, Needs approval or Blocked.[^anthropic-connectors-docs] On Team and Enterprise plans, organization owners can set the same choices for the whole organization. Read tools are grouped apart from write and delete tools, and members cannot change the owners' choices.[^anthropic-connectors] On those plans, Anthropic's page says members approve connector tools that can write, in every task, unless an organization owner allows Always allow for them.[^anthropic-cowork-team] Its guide to tasks says that in Auto, Claude decides for those tools.[^anthropic-cowork] The two pages differ, so do not count on Auto to ask you first. > - *Consequential actions (7.2).* Claude asks before permanently deleting files, in any mode.[^anthropic-cowork-safely] Anthropic says Claude in Chrome is built not to make purchases, create accounts, delete permanently or follow instructions found in emails or web pages. Anthropic also says it is built to ask before changing permissions or entering sensitive information.[^anthropic-chrome-permissions] These statements describe how it is meant to behave. They are not a guarantee. > - *Tool order (7.5).* Anthropic's computer-use page puts connectors first, as the fastest and most reliable path, then the browser, then the screen. As of 31 October 2026, computer use is on the Pro, Max and Ultra plans. It asks before each app and blocks investment and cryptocurrency apps by default. It has no sandbox, or closed-off space, between Claude and your apps.[^anthropic-computer-use] > - *Prompt injection (7.6).* Anthropic's safety page says an attack needs two things at once. Claude reads information from outside your trusted boundary, and Claude can take actions that could harm you.[^anthropic-cowork-safely] Its research says no browser agent is immune, or fully protected.[^anthropic-prompt-injection-research] > - *Runs no one watches.* You can choose an approval mode when you set up a scheduled task by hand. But the help page does not say what happens when an approval is needed and nobody is there.[^anthropic-scheduled-tasks] Anthropic advises against scheduling tasks that send messages or are hard to undo.[^anthropic-cowork-safely] Claude Code routines, a tool for developers, run without permission prompts and act as you.[^anthropic-routines] > - *Admin policy (7.4).* Owners choose which connectors members may use,[^anthropic-connectors] and on Enterprise, custom roles can make tool permissions stricter, never looser.[^anthropic-custom-roles] > - *Standing worker, verified 23 October 2026.* Claude Duet, in research preview, keeps working after you close its app. Before it sends a message, makes a payment, signs a document or deletes anything, it shows exactly what it will do. Then it waits for your approval.[^anthropic-duet] If you cannot approve at once, it finishes the rest of the task and brings the approval back to you later. Some actions are refused even with approval, such as trading securities or moving money between accounts.[^anthropic-duet-help] > **OpenAI, as verified 8 October 2026.** > - *The conversation setting.* In the desktop app, a permissions control sets local actions, the actions on your own computer. Its choices are Ask for approval, Approve for me or Full access. Approve for me sends a request to an automatic review instead of to you.[^openai-permissions] OpenAI's prompting guide also advises adding a rule to your prompt. The rule requires your approval before ChatGPT sends, publishes or changes information other people rely on.[^openai-prompting] That is advice about prompts, not a setting. > - *Per-tool control (7.4).* Each app, OpenAI's name for a connector, can have one of four levels: Always ask, Allow read actions, Allow low-risk actions or Allow all actions. Allow read actions reads without asking and asks before any change. At Allow low-risk actions, the product decides which actions count as low risk.[^openai-app-permissions] > - *Consequential actions (7.2).* ChatGPT is designed to ask you before actions that are hard to undo or that create a real-world commitment, such as a payment. When it works in its cloud browser, a browser on a separate computer in the cloud, it asks in the chat.[^openai-cloud-browser] These statements describe how it is meant to behave. They are not a guarantee. OpenAI lists sending messages, changing records, changing access, payments and sharing sensitive data as higher-risk actions.[^openai-app-permissions] > - *Tool order (7.5).* OpenAI advises using a connected app instead of the cloud browser when the app can do the task directly. ChatGPT may also make that choice on its own.[^openai-cloud-browser] In Atlas, OpenAI's web browser, agent mode pauses on sensitive sites such as banks.[^openai-atlas] > - *Prompt injection (7.6).* OpenAI says an attack needs a source, a way to influence the system, and a sink, a capability that becomes dangerous in the wrong context. It says dangerous actions, or sending sensitive data, should not happen silently or without appropriate safeguards.[^openai-resist-injection] Lockdown Mode limits outgoing requests.[^openai-lockdown] OpenAI says its app safeguards do not remove prompt-injection risk.[^openai-admin-apps] > - *Runs no one watches.* A scheduled task may pause when one of its actions needs approval.[^openai-scheduled-tasks] > - *Admin policy (7.4).* Admins choose which read or write actions each app may use, and how new actions are treated.[^openai-admin-apps] In workspace agents, write actions are set to Always ask by default.[^openai-workspace-agents] > - *Standing worker, verified 23 October 2026.* A dot, OpenAI's always-on agent, starts with built-in rules for when to act alone and when to ask. Its Custom Rules let you allow an action, require approval for it or block it. A check called auto-review looks at actions that could affect your accounts or share information. It checks them against your instructions, your Custom Rules and OpenAI's safety requirements.[^openai-dots] Custom Rules cannot turn off the core safety requirements. The most sensitive actions, such as changing a password or moving money, need you to take over and finish them yourself. Approving one message gives the dot no ongoing permission. An approval given in advance covers only what you authorized.[^openai-dots-faq] > **Open source, as verified 23 October 2026.** > - *Per-tool control (7.4).* In OpenCode, a permission rule sets a tool to allow, ask or deny, and the last rule that matches wins. Every agent starts from a base rule that allows everything. Only reading sensitive environment files asks first.[^opencode-permissions] In Omnara, each tool is set to always allow, always ask or always deny. Tools reached through MCP (Model Context Protocol), a standard way to connect AI apps to other systems, start at always ask. Built-in and custom tools start at always allow.[^omnara-permissions] > - *Prompt injection (7.6).* OpenClaw's README says to treat incoming messages as untrusted input.[^openclaw] By default, an unknown sender gets a pairing code, and OpenClaw ignores the sender until you approve.[^openclaw-access-control] Its security guide adds that the content itself is a threat, not just the sender.[^openclaw-prompt-injection] > - *Runs no one watches.* OpenClaw's first setup creates a Proactive check, a scheduled job that runs every 30 minutes by default.[^openclaw-heartbeat] Omnara can send its approval requests to Slack or Discord.[^omnara-integrations] > - *Running it safely.* OpenClaw's sandbox, a closed-off space for its tools, is off by default, so its tools run on the computer itself.[^openclaw-sandboxing] Before the first run, switch the sandbox on and write an ask or deny rule for each limit in your envelope. > *The MCP standard.* Its version of 28 July 2026, as verified 23 October 2026, says a person should always be able to deny a tool call.[^mcp-tools] A server can now also ask for more input before it goes on.[^mcp-mrtr] [^anthropic-cowork]: Get started with Claude Cowork, Claude Help Center. [^anthropic-one-claude]: Claude Cowork and chat are one Claude, Claude Help Center. [^anthropic-cowork-safely]: Use Claude Cowork safely, Claude Help Center. [^anthropic-connectors-docs]: Get started with connectors, Claude documentation. [^anthropic-connectors]: Use connectors to extend Claude's capabilities, Claude Help Center. [^anthropic-cowork-team]: Use Claude Cowork on Team and Enterprise plans, Claude Help Center. [^anthropic-unified-enterprise]: Set up and manage the new unified Claude experience for your Enterprise organization, Claude Help Center. [^anthropic-chrome-permissions]: Claude in Chrome permissions guide, Claude Help Center. [^anthropic-computer-use]: Let Claude use your computer in Cowork, Claude Help Center. [^anthropic-prompt-injection-research]: Mitigating the risk of prompt injections in browser use, Anthropic. [^anthropic-scheduled-tasks]: Schedule recurring tasks in Claude Cowork, Claude Help Center. [^anthropic-routines]: Automate work with routines, Claude Code Docs. [^anthropic-custom-roles]: Manage custom roles on Enterprise plans, Claude Help Center. [^openai-permissions]: Permissions, ChatGPT Learn, OpenAI. [^openai-prompting]: Prompting, ChatGPT Learn, OpenAI. [^openai-app-permissions]: Managing app permissions in ChatGPT, OpenAI Help Center. [^openai-cloud-browser]: Using cloud browser in ChatGPT, OpenAI Help Center. [^openai-atlas]: Using Ask ChatGPT sidebar and ChatGPT Agent on Atlas, OpenAI Help Center. [^openai-resist-injection]: Designing AI agents to resist prompt injection, OpenAI. [^openai-lockdown]: Lockdown Mode, OpenAI Help Center. [^openai-admin-apps]: Admin controls, security, and compliance for plugins and apps, OpenAI Help Center. [^openai-scheduled-tasks]: Scheduled tasks in ChatGPT, OpenAI Help Center. [^openai-workspace-agents]: ChatGPT Workspace Agents for Enterprise and Business, OpenAI Help Center. [^anthropic-duet]: Claude Duet, Anthropic, 21 October 2026. [^anthropic-duet-help]: Get started with Claude Duet, Claude Help Center. [^openai-dots]: Introducing dots, OpenAI, 29 September 2026. [^openai-dots-faq]: Dots privacy, security and safety FAQs, OpenAI Help Center. [^opencode-permissions]: Permissions, OpenCode v2 documentation. [^omnara-permissions]: Tool permissions, Omnara documentation. [^openclaw]: OpenClaw, OpenClaw Foundation, README on GitHub. [^openclaw-access-control]: Access control, OpenClaw documentation. [^openclaw-prompt-injection]: Prompt injection, OpenClaw documentation. [^openclaw-heartbeat]: Heartbeat, OpenClaw documentation. [^omnara-integrations]: Integrations overview, Omnara documentation. [^openclaw-sandboxing]: Sandboxing: modes, scope and backend, OpenClaw documentation. [^mcp-tools]: Tools, MCP specification 2026-07-28, Model Context Protocol. [^mcp-mrtr]: Multi Round-Trip Requests, MCP specification 2026-07-28, Model Context Protocol.