Claude Admin Controls for RIAs: Ten Settings to Check Before Go-Live, and How to Revoke Access

1. The Short Answer: Ten Settings Before Go-Live

On Claude Team and Enterprise, an Owner decides which connectors exist, what each one may do, who gets Cowork and which plugins load, and members can't override the connector limits. That is enough control for an RIA, once you change a few defaults.

The defaults favor a fast start. Cowork is on by default, Automatically approve mode is available to every member, and on Enterprise, custom roles that predate connector permissions were seeded at Always allow.

Pro and Max have no organization admin console (the Cowork security guide compares plans), and Claude Desktop in your own cloud account is configured by device management instead (see the own-cloud guide).

Here are the ten settings to check before an advisor connects a client system.

Each row takes a minute to change. Knowing the row exists is the slow part.

2. Who Holds the Keys

If an examiner asks who controls the firm's AI tools, the answer should be names.

• The Primary Owner. One person. Only the Primary Owner can switch on the Compliance API (Organization settings, API), and the Primary Owner can export the organization's data, which may contain conversations and uploaded files.
• Owners. They enable connectors, set tool permissions and turn Cowork on or off. Keep the list short, and tell the CCO about every change.
• Custom roles, on Enterprise. In Organization settings, Roles, the Connectors tab gives each role Always allow, Needs approval, Blocked or Custom (per tool). A newly created role defaults to Needs approval on every connector.

Grants are additive, so a member in two roles gets the most permissive grant. The organization-wide tool policy is the ceiling: set it tight, and a careless role can only loosen things up to that line.

SCIM, custom roles, audit logs, the Compliance API, custom retention, IP allowlisting and per-user spend limits are Enterprise only. Team has SSO, domain verification, connector admin controls and OpenTelemetry for Cowork.

Write the names into your AI use policy. Access you can't list is access you can't supervise.

3. Turn Cowork On for a Pilot Group First

Anthropic's help center is plain: "Claude Cowork is on by default, but organization owners can manually disable it." The switch is Enable for your organization, in Organization settings, Cowork.

On Enterprise, groups and custom roles can enable Cowork for specific teams, so a few advisors and the CCO can pilot while everyone else waits.

On Team the toggle is organization-wide, and Cowork is on unless someone turned it off. Turn it off, set the other rows of the table, then switch it back on.

Plugins are included with Cowork and controlled by the same admin toggle, so this is also the off switch for the advisor plugin.

A pilot finds the setting you got wrong while five people are using it, which beats finding it with the whole firm.

4. Connectors: Enable, Then Narrow

Connecting a system takes two steps. An Owner or Primary Owner enables the connector, and Anthropic's connector article is precise about what that does: "Enabling a connector makes it available to your team, but it doesn't automatically grant anyone access. Each person still needs to authenticate individually before they can use it."

The vendor's permissions still apply, so a loose permission in your CRM stays loose in Claude. Fix it in the CRM.

Then narrow each connector in Customize, Connectors, under the connector's Tool permissions. Tools are grouped by type, for example read-only tools and write/delete tools, and each category or single tool gets Always allow, Needs approval or Blocked.

• Read-only tools: Always allow, on connectors your firm approved. Approving every lookup teaches advisors to click yes without reading.
• Write/delete tools: Needs approval, or Blocked until the pilot shows a need. A CRM note that waits for a person is supervision you can point to.
• Anything nobody uses: Blocked.

Individual users can't override these settings. That matters because the plugin's README says its own rule, advisor approval before any write, is "enforced by the model following them, not by the runtime." Tool permissions come from an Owner and bind every member.

On Enterprise, also open the Connectors tab of every custom role. When Anthropic enabled connector permissions, it seeded every existing custom role with the All connectors grant at Always allow (Anthropic Help Center). Because grants add up, one old role can lift a member to the ceiling.

Let members request connectors is on by default on Team and off on Enterprise; if you keep it, nothing goes live without a vendor file. Enterprise Owners can also stop services on the firm's verified domains from being connected to Claude accounts outside the organization, closing one route for shadow AI.

Enable fewer connectors than the pilot asks for. Each one is another vendor in your Reg S-P file.

5. The Approval Settings Most Firms Miss

Two settings decide how often Cowork stops to ask, and they ship in opposite positions. Both sit in Organization settings, Cowork, Permissions.

Allow "Automatically approve" mode is on by default. The mode "is available to your members unless you turn it off." Anthropic's Cowork safety page tells users to switch to Manually approve when "The task touches sensitive files, accounts, or sites." At an RIA, that is most of the working day. Turn it off.

Allow "Always allow" for connector tools is off by default. It "controls whether members can skip per-task approval for write-capable connector tools in Cowork." Leave it off. The approval on a CRM write is the moment an advisor reads what Claude is about to save.

Expect one complaint. "Read-only tools are exempt only when the connector annotates them as read-only. Most custom connectors don't annotate their tools, so every tool on those connectors is gated." Even a lookup may ask first. Keep the setting, and ask the vendor to annotate.

The FAQ on acting without approval has the short version. Approval prompts supervise only while people read them, so watch an advisor approve a CRM note in the pilot.

6. Plugins and Skills From One Approved Source

The customization guide covers writing your firm's rules into a private copy of the advisor plugin. The admin job is making that copy the only one advisors run, with the pieces on Anthropic's plugin admin page:

1. A private repository. A private or internal GitHub repository can sync as the organization marketplace; public repositories are not allowed. Syncs run when a pull request with a version bump merges, and if one fails, members keep the last synced version.
2. Required. The Inventory tab in Organization settings, Plugins and skills offers Installed by default, Available to install, Required and Not available. Set the firm's copy to Required, which members can't turn off.
3. Not available for the rest. Group overrides, on Enterprise only, resolve to the most permissive setting, so set a plugin to Not available org-wide to hard-block it.
4. User-created skills off, on the Policy tab, so members can't upload plugin files.
5. Allow and block lists. Owners can set marketplace allow and block lists in Claude Code managed settings, and they also apply in Claude and Cowork.
6. Skill scanning, on Enterprise, which can check skills and plugins for malicious content when they are installed.

The reason sits in one sentence on the safety page: "Local MCP servers bundled with plugins and desktop extensions run on your computer with the same permissions as any other program you run."

The private repository pays off at exam time. Every change to the firm's rules becomes a reviewed, dated pull request your CCO can hand over.

7. Browsers and Computer Use

On the built-in browser and Claude in Chrome, the safety page is blunt: "we strongly advise against using either to manage or take actions involving sensitive information." Custodian portals, the CRM and client email all qualify.

• The built-in browser is controlled in Organization settings, Cowork. It is on by default on Team, and on Enterprise since September 10, 2026 unless an Owner turned it off, so an Enterprise firm set up in August should look again.
• Claude in Chrome has its own page: Organization settings, Claude in Chrome.

The risk is prompt injection: "For prompt injection attacks to be successful, two things must be true at the same time: Claude can read information outside your trusted boundary, and can perform actions that could compromise the user." A browser does the first by design, so your settings have to deny the second.

Network egress permissions don't apply to web fetch, web search or MCP connectors, and Anthropic puts Claude in Chrome in that last group.

Computer use needs its own line in the policy. It works without the permission checks that gate other Cowork tools, and nothing sandboxes Claude from what is on the screen.

Start the pilot with both browsers off and a written rule that computer use never runs with client data on screen.

8. Cloud Sessions and Local Files

Where a Cowork session runs decides where its history lives, and so what offboarding must cover. Anthropic's Team and Enterprise Cowork page describes both cases.

• Local sessions. "For local sessions, Cowork stores conversation history on users' computers. This data is not subject to Anthropic's standard data retention policies, and admins cannot centrally manage or delete it." On Enterprise the Compliance API can retrieve that content, but "Deletion endpoints for local sessions aren't available yet."
• Cloud sessions. "For sessions in the cloud, sessions and files are saved to the member's Claude account." The work, including local files Claude opens through the desktop app, is processed on Anthropic's servers.

The switch, Run Cowork in the cloud, is on by default for Team and off for Enterprise. Anthropic adds a warning for managed laptops: "If your organization manages your computer, note that connecting local folders makes them reachable from a session in the cloud." For a pilot, leave it off and decide in writing afterward.

Either way, follow Anthropic's advice on files: "Avoid granting access to local files with sensitive information, like financial documents." Where a task needs files, Anthropic suggests "creating a dedicated working folder for Claude rather than granting broad access."

The FAQ on giving Cowork access to client files has the short answer. Whatever you decide, the laptop is now a place client data can live.

9. How to Revoke Access

Access lives in four places: the Claude organization, each connector, each vendor's own system and the laptop. Anthropic documents controls for the first two.

• The user's disconnect. A user can disconnect any service in their connector settings, but that relies on the departing person doing it.
• Blocked, organization-wide. An Owner can set a connector's tools to Blocked for everyone at once, the right move the day a vendor reports a problem.
• SCIM groups, on Enterprise. "To revoke access, remove them from the IdP group. On the next sync, the permission is removed." Check that the sync ran.

Anthropic's pages don't describe what happens to a removed member's connectors or local Cowork history. The steps below come from practice:

1. Revoke at each vendor, in its own app or token settings, and don't assume removing someone from Claude reaches the CRM. Financial Planning reported that Schwab lets the firm choose which users can use its connector, so take the advisor off that list.
2. Capture before you wipe. On Enterprise the Compliance API returns sessions from the most recent 30 days, so confirm your archive holds the advisor's Cowork sessions first.
3. Collect the laptop. Local Cowork history stays on the device, where admins can't delete it centrally.
4. Reassign roles. If the person was an Owner or the Primary Owner, give the role to someone else before they go.

A missing laptop runs the same list faster: remove the member or the IdP group, revoke vendor tokens, and take the device through your Reg S-P incident response program, since its local history may hold client data. Your CCO and counsel decide whether notice is owed.

Put these steps on the checklist HR already uses for departures, so they happen on the last day.

10. A Quarterly Settings Review

Settings drift because the product moves. Two changes have widened access at firms that had not touched the setting: Anthropic seeded existing custom roles at Always allow when it enabled connector permissions, and the built-in browser became on by default on Enterprise from September 10, 2026.

Once a quarter, the Owner and the CCO should:

1. Walk the ten rows of the table in section 1 and screenshot each setting with the date, which doubles as configuration evidence for your vendor file.
2. Reread every custom role's Connectors tab, on Enterprise.
3. Compare enabled connectors and their tool permissions with your approved list.
4. Check the plugin inventory, and confirm the last marketplace sync succeeded, since a failed sync leaves members on the previous version.
5. Compare members and Owners with your staff list.
6. Sample approval decisions. OpenTelemetry for Cowork (Team and Enterprise) can stream them to your SIEM with tool calls and file access, though Anthropic says "It doesn't replace audit logging for compliance purposes."

File each review with your annual compliance review under Rule 206(4)-7. The SEC's fiscal 2026 exam priorities say staff will assess policies to monitor and supervise AI use, and dated quarterly reviews show yours in use.

11. Where to Start

If you do one thing this week, open Organization settings, Cowork, Permissions and check the two approval settings. Then work in this order:

1. Name the keyholders in your AI use policy.
2. Hold Cowork back: a pilot group on Enterprise, off on Team until the table is set.
3. Fix the approvals: Automatically approve off, Always allow for connector tools left off.
4. Narrow the connectors: write/delete tools at Needs approval or Blocked, old Enterprise roles checked.
5. Lock the plugin source: the firm's copy Required, the rest Not available, User-created skills off.
6. Close the side doors: browsers off, cloud sessions decided, chat ratings off.
7. Write the offboarding steps, pilot for a week, and book the first quarterly review.

The setup guide covers the rest of the rollout, from license to launch.