7. Files, Connectors and Approvals (Safely Extending Cowork's Reach)

In Episode 23 of Beyond Prompting, author Sho Shimoda addresses how to govern, deploy, and observe Claude Code across an enterprise organization. When a security review asks what stops an employee or agent from performing unauthorized actions, answering effectively requires distinguishing hard boundaries from simple guidance. In this episode, we break down: The Three Tiers of Enforceability: Categorizing controls into Top Tier (OS/MDM-enforced boundaries that hold against an uncooperative user), Middle Tier (client-side controls enforced while the client cooperates, such as permission rules), and Bottom Tier (guidance and prompt-level instructions like CLAUDE.md). What Managed Settings Enforce: Leveraging managed-settings.json deployed via MDM to lock down sandbox paths, restrict API domains, set mandatory deny rules, and restrict connected MCP servers and plugin marketplaces. Observability & Telemetry: Streaming operational metrics over OpenTelemetry—tracking prompts, tool calls, file access, skills, and approvals—to create a complete audit log before security incidents occur. Deployment Options & Zero Data Retention: Comparing direct API usage against cloud provider gateways (AWS Bedrock, Google Cloud, Microsoft Foundry), understanding feature availability tradeoffs, and navigating Zero Data Retention (ZDR) policies. A Rollout Strategy That Survives Security Review: Establishing a five-step deployment sequence—setting enforced OS controls first, enabling observability before user adoption, refining client permissions, and writing guidance last. (Note for listeners: This episode covers Chapter 23 of Sho Shimoda's book RUNNING CLAUDE: The Operator’s Guide to Chat, Cowork and Claude Code, available on Amazon as the successor book to Master Claude: Chat, Cowork and Code).

In Episode 22 of Beyond Prompting, author Sho Shimoda addresses the security accounting of autonomous AI agents. An agent that generates text can only be wrong; an agent that executes commands can be wrong in ways that persist after the conversation ends. In this episode, we break down: Four Core Execution Risks: Analyzing command injection from interpolated content, destructive file operations across unexpected path scopes (such as rm -rf "$DIR"/*), prompt injection via hostile untrusted files, and unauthorized data exposure. Boundaries Across the Three Surfaces: Comparing Chat (reaches nothing), Cowork (ephemeral cloud sandboxes with a desktop app broker), and Claude Code (runs directly on your host machine with an OS-enforced shell boundary). What the OS Sandbox Actually Enforces: How Seatbelt (macOS) and bubblewrap (Linux/WSL2) constrain shell commands at the OS level—holding even if prompt injection bypasses model decision-making—while recognizing what sits outside it (file tools, MCP servers, and hooks). Handling Prompt Injection Structurally: Why prompts are not security boundaries, and why defending against prompt injection requires a three-layer structural strategy: scoping permissions, constraining shell reach via the sandbox, and explicitly denying access to credential paths (~/.ssh, ~/.aws). Constraining Damage vs. Guaranteeing Safety: Internalizing the foundational rule of agent security: "The sandbox constrains the scope of damage. It does not make operations safe." (Note for listeners: This episode covers Chapter 22 of Sho Shimoda's book RUNNING CLAUDE: The Operator’s Guide to Chat, Cowork and Claude Code, available on Amazon as the successor book to Master Claude: Chat, Cowork and Code).

In Episode 21 of Beyond Prompting, author Sho Shimoda explores how to break through the manual chat window bottleneck by programmatically orchestrating AI agents using Dynamic Workflows. When coordinating large-scale engineering tasks across a codebase, managing dozens of parallel tasks manually through a chat transcript becomes a major bottleneck. In this episode, we break down: When Scripts Beat Conversations: The three conditions that justify a workflow script—large volume (20+ items), complete task independence, and aggregated findings. JavaScript Workflow Mechanics: Writing deterministic orchestration scripts using agent(), pipeline(), parallel(), phase(), and log(), while enforcing strict replayability rules that block non-deterministic calls like Date.now() or import(). Prompt Caching at Scale: How Claude Code holds parallel agent fan-outs briefly at startup so subagents share a single cached prompt prefix, dramatically lowering execution costs. Security & Execution Boundaries: Why workflows require explicit user invocation via the ultracode keyword and cannot be triggered automatically by untrusted webhooks, scheduled tasks, or pull request comments. The Two-Phase Pattern: Designing trustworthy automation through a two-phase architecture—Phase 1 surveys and generates candidate findings, while Phase 2 runs an adversarial verification step on each finding before aggregating results. (Note for listeners: This episode covers Chapter 21 of Sho Shimoda's book RUNNING CLAUDE: The Operator’s Guide to Chat, Cowork and Claude Code, available on Amazon as the successor book to Master Claude: Chat, Cowork and Code).

In Episode 20 of Beyond Prompting, author Sho Shimoda clarifies how to run multiple AI tasks concurrently without getting tangled in state or disk conflicts. While Chapter 19 focused on subagents, Chapter 20 introduces three other mechanisms for parallelism, organizing all four around what gets separated: context, attention, whole sessions, or files. In this episode, we cover: The Four Parallelism Mechanisms: Distinguishing between Subagents (separates context window), Background Sessions (separates attention), Agent Teams (separates whole sessions), and Git Worktrees (separates working tree files). Teammates vs. Subagents: Why teammates in an agent team operate as peer sessions that message each other and share a task list rather than reporting upward to a caller, and why coordination costs mean most tasks are better served by a well-specified single session. Cross-Session Messaging: Using /list-agents and SendMessage to let active terminal sessions communicate across project boundaries, governed by the crossSessionInbound setting. Worktrees for File Collisions: Creating isolated Git checkouts with claude --worktree <name> so parallel sessions don't overwrite each other's files on disk, and copying ignored local environment files using .worktreeinclude. Managing Parallel Load: Using the agent view (claude agents) to monitor background execution, and understanding why parallel worktrees and agent teams carry separate prompt caches. (Note for listeners: This episode covers Chapter 20 of Sho Shimoda's book RUNNING CLAUDE: The Operator’s Guide to Chat, Cowork and Claude Code, available on Amazon as the successor book to Master Claude: Chat, Cowork and Code).

In Episode 19 of Beyond Prompting, author Sho Shimoda explores how to manage complex, search-heavy engineering tasks without cluttering your main conversation window using Subagents. When an agent reads dozens of files, runs multiple searches, and pursues false leads, that intermediate noise dilutes the main conversation's working memory. In this episode, we break down: Solving Context Pollution: Why the primary benefit of delegation is keeping your main conversation's context clean by running heavy investigations in isolated, disposable subagent context windows that return only concise summaries. The Three Justifications for Subagents: Identifying when to delegate based on context economy (high byproduct-to-conclusion ratio), specialized roles (such as a read-only security or schema reviewer), and true task parallelism. Defining Subagents (.claude/agents/): Structuring custom subagents in Markdown with YAML frontmatter, restricting tool access (e.g. limiting to Read, Grep, and Glob), and why writing a clear description field is the entire invocation mechanism. What Crosses the Boundary: Understanding what a subagent inherits (system prompt, CLAUDE.md, git snapshot, brief) versus what stays isolated (conversation history and intermediate tool outputs), and using agent IDs to resume subagents via SendMessage. Forks, Depth, and Concurrency: Distinguishing standard subagents from forks (/subtask), navigating spawn depth limits (up to 3 layers), concurrency caps (up to 20 subagents), and knowing when not to delegate. (Note for listeners: This episode covers Chapter 19 of Sho Shimoda's book RUNNING CLAUDE: The Operator’s Guide to Chat, Cowork and Claude Code, available on Amazon as the successor book to Master Claude: Chat, Cowork and Code).