One read of Claude Documentationclaude-docs-20261027T210740Z
4 pages moved out of 280 read.
Pages moved
4
significant first
Pages read
280
in this capture
Captured
21:07 UTC
Corpus hash
f7974052621e
corpus-hash
What this read moved
1-4 of 4claude-science/admin-controls Changed · +7 / -4 lines
from line 40
4040
4141### Capabilities in custom roles
4242
43On Enterprise plans, seven of the controls on this page also have a capability in custom roles, so you can leave a control on for the organization and, among members with custom roles, limit it to certain roles. Go to [**Organization settings > Roles**](https://claude.ai/admin-settings/roles), open a custom role, and go to its **Capabilities** tab. In the **Claude Science** section, the seven are listed under the **Claude Science** capability.
43On Enterprise plans, eight of the controls on this page also have a capability in custom roles, so you can leave a control on for the organization and, among members with custom roles, limit it to certain roles. Go to [**Organization settings > Roles**](https://claude.ai/admin-settings/roles), open a custom role, and go to its **Capabilities** tab. In the **Claude Science** section, the eight are listed under the **Claude Science** capability.
4444
4545The table shows each capability and the control on the **Claude Science** page that it goes with.
4646
from line 47
4747| Capability in a custom role | Control on the **Claude Science** page |
4848| - | - |
4949| **Access previously saved work** | [**Allow members to access Claude Science work previously saved on their computer**](#previously-saved-claude-science-work) |
50| **Auto mode** | [**Allow members to use auto mode**](#auto-mode) |
5051| **Connect to SSH hosts** | [**Allow members to connect SSH hosts**](#ssh-hosts) |
5152| **Custom connectors** | [**Allow custom connectors**](#custom-connectors) |
5253| **Custom skills** | [**Allow custom skills**](#custom-skills) |
from line 61
6061* **Control on, built-in role**: members whose role is User, Admin, Owner, or Primary Owner can use the feature, because custom roles affect only members whose role is set to **Custom**. On Team plans, which don't have custom roles, that's every member.
6162* **Control on, custom roles**: a member whose role is set to **Custom** can use the feature only if at least one of their custom roles has the capability turned on.
6263
63Turning on the **Claude Science** capability in a role also turns on the seven under it, and you can then turn off the ones that role shouldn't have. Any capability whose control your organization can't turn on stays off. Turning the **Claude Science** capability off turns them all off. A role whose **Capability access** setting is **All capabilities** already includes all seven. A role set to **All generally available** gets them when you turn on its **Claude Science** capability (see [Who gets access after you enable](https://claude.com/docs/claude-science/enable-claude-science.md#who-gets-access-after-you-enable)).
64Turning on the **Claude Science** capability in a role also turns on the eight under it, and you can then turn off the ones that role shouldn't have. Any capability whose control your organization can't turn on stays off. Turning the **Claude Science** capability off turns them all off. A role whose **Capability access** setting is **All capabilities** already includes all eight. A role set to **All generally available** gets them when you turn on its **Claude Science** capability (see [Who gets access after you enable](https://claude.com/docs/claude-science/enable-claude-science.md#who-gets-access-after-you-enable)).
6465
6566> [!NOTE]
6667>
from line 213
212213
213214### Auto mode
214215
215With auto mode, an automated safety check approves a member's code and connector requests that look safe, so the member answers fewer permission cards in the Claude Science app (see [Auto mode](https://claude.com/docs/claude-science/auto-mode.md)). The **Allow members to use auto mode** switch decides whether members can use auto mode at all in Claude Science. It's on by default for Team organizations and off by default for Enterprise organizations. While the switch is on, auto mode starts on for members who can use it, and each member can turn it off in the Claude Science app. While the switch is off, members get a permission card for each request that needs one, as they do without auto mode, and the auto mode toggle in the Claude Science app's **Settings > Permissions** is grayed out. The switch applies to members whose app is recent enough to support it.
216The **Allow members to use auto mode** switch is on by default for Team organizations and off by default for Enterprise organizations. It decides whether members can enable auto mode in Claude Science. [Auto mode](https://claude.com/docs/claude-science/auto-mode.md) lets Claude Science run code and call connectors without stopping to ask about every step. Instead, Claude Science reviews these actions for safety and automatically blocks anything it determines to be unsafe. While the switch is on, auto mode starts on for members who can use it, and each member can turn it off in the Claude Science app. While the switch is off, members get a permission card for each request that needs one, as they do without auto mode, and the auto mode toggle in the Claude Science app's **Settings > Permissions** is grayed out. The switch applies to members whose app is recent enough to support it.
216217
218On Enterprise plans, you can also limit auto mode to certain custom roles with the **Auto mode** capability (see [Capabilities in custom roles](#capabilities-in-custom-roles)). For a member whose custom roles don't include it, the **Auto mode on for new sessions** toggle in the app's **Settings > Permissions** is grayed out.
219
217220## How other admin settings apply to Claude Science
218221
219222In the tables below, each setting is named by its page in claude.ai **Organization settings** and, where it has one, its label there (for example, **Capabilities** > **Web search**). Apart from the **Enable for your organization** toggle, the controls on the **Claude Science** page itself are described under [Organization settings](#organization-settings).
from line 237
234237| Organization and access > Domains | Supported in Claude Science | Domain verification, and the **Migrate accounts using your domains** and **Restrict organization creation** settings that build on it, act on claude.ai accounts before anyone reaches the app, so they apply unchanged. |
235238| Members | Supported in Claude Science | Adding or removing members controls who can sign in to Claude Science. |
236239| Roles (built-in) | Supported in Claude Science | Every built-in role (User, Admin, Owner, and Primary Owner) can use Claude Science once it's turned on for the organization. |
237| Roles > Claude Science permission in custom roles (Enterprise) | Supported in Claude Science | Add the Claude Science permission to a custom role to give the app to that role's members. Members whose custom roles don't include it can't use the app. On the role's **Capabilities** tab, seven capabilities under **Claude Science** decide which of the app's features that role's members can use (see [Capabilities in custom roles](#capabilities-in-custom-roles)). Team plans don't have custom roles, so everyone gets access when Claude Science is on. |
240| Roles > Claude Science permission in custom roles (Enterprise) | Supported in Claude Science | Add the Claude Science permission to a custom role to give the app to that role's members. Members whose custom roles don't include it can't use the app. On the role's **Capabilities** tab, eight capabilities under **Claude Science** decide which of the app's features that role's members can use (see [Capabilities in custom roles](#capabilities-in-custom-roles)). Team plans don't have custom roles, so everyone gets access when Claude Science is on. |
238241| Groups (Enterprise) | Supported in Claude Science | Members get the Claude Science access of the roles their groups assign. |
239242| IP allowlist (Enterprise) | Partially supported in Claude Science | The app's sign-in, its requests to Claude, and its Directory connector calls are checked against your allowlist (see [Restrict access to Claude with IP allowlisting](https://support.claude.com/en/articles/13200993-restrict-access-to-claude-with-ip-allowlisting)). Traffic that doesn't go to Anthropic isn't checked, which covers code on the member's computer, SSH hosts, or Modal account, and custom connectors members add in the app. You can turn SSH hosts, Modal, and custom connectors off under [Organization settings](#organization-settings). |
240243| Organization and access > Shortened session length (Enterprise) | Partially supported in Claude Science | Applies to the browser sign-in a member completes to connect the app. It doesn't shorten the app's own sign-in after that, so members aren't asked to sign in again on your schedule. Turning Claude Science off for the organization or removing a member still stops their app within a few minutes. |
claude-science/auto-mode Changed · +18 / -12 lines
## What each check sends to Anthropic
from line 1
11# Auto mode
22
3> Auto mode in Claude Science lets a safety check approve code and connector calls.
3> Auto mode lets Claude Science run code and call connectors without stopping to ask about every step.
44
5Auto mode in Claude Science lets Claude run code and call connectors without routine [permission cards](https://claude.com/docs/claude-science/core-concepts.md#permission-cards). A separate safety check reviews code, and the connector calls that would otherwise ask you, before they run. It approves the ones that look safe and holds anything that escalates beyond your request, is destructive or hard to undo, or appears driven by hostile content Claude read. Anything the check holds or can't check still shows you the card. Allow or deny the request as you would with auto mode off.
5Auto mode lets Claude Science run code and call connectors without stopping to ask about every step. Instead, Claude Science reviews these actions for safety (such as checking for data exfiltration or [prompt injection](https://support.claude.com/en/articles/13364135-use-claude-cowork-safely)) and automatically blocks anything it determines to be unsafe. When an action is blocked, Claude Science pauses and asks you directly. If Claude Science keeps running into blocks, it switches back to asking your permission for each step.
66
77> [!WARNING]
88>
9> Auto mode in Claude Science reduces permission cards but does not guarantee safety. Use it for tasks where you trust the general direction, not as a replacement for review on sensitive operations.
9> No defense is perfect and no mode replaces your judgment. For work with real consequences, such as handling important files, stay close and review what Claude Science does, or consider turning auto mode off.
1010
1111## Turn auto mode on or off
1212
13Where auto mode is available to you, it starts on.
13Where available, auto mode is enabled by default for Pro, Max, and Team plans and off by default for Enterprise plans unless your organization's admin allows it.
1414
15* **For new sessions**: go to **Settings > Permissions** and turn the **Auto mode on for new sessions** toggle off or on.
16* **For the current session**: open the session settings menu in the message box and turn the **Auto mode** row on or off.
15* **To set your default for new sessions**: go to **Settings > Permissions** and turn the **Auto mode on for new sessions** toggle off or on.
16* **To turn auto mode on or off for the current session**: open the session settings menu in the message box and turn the **Auto mode** row on or off.
1717
18The **Auto mode on for new sessions** toggle also decides for sessions that don't have their own auto mode setting, such as sessions you started before Anthropic made auto mode available to you. A session with its own setting keeps it when you change the toggle, so turn auto mode off in that session from the session settings menu in the message box.
18The **Auto mode on for new sessions** toggle also turns auto mode on and off in your older sessions, from before you had auto mode. A session with its own setting keeps it until you change the Auto mode row in that session's settings menu.
1919
2020## What auto mode needs in Claude Science
2121
from line 22
2222Auto mode in Claude Science is available only when all of these requirements are met:
2323
2424* **Sandbox**: the [sandbox](https://claude.com/docs/claude-science/core-concepts.md#sandbox) is on. With the sandbox off, auto mode approves nothing.
25* **Organization**: on Team and Enterprise plans, your organization's admin allows it (see [Auto mode in Admin controls](https://claude.com/docs/claude-science/admin-controls.md#auto-mode)).
25* **Organization**: on Team and Enterprise plans, your organization's admin allows it (see [Auto mode in Admin controls](https://claude.com/docs/claude-science/admin-controls.md#auto-mode)). If your role is set to **Custom**, one of your custom roles must also include it.
2626* **Availability**: Anthropic has made auto mode available to you in Claude Science.
2727
2828If the toggle is missing or grayed out, one of these requirements is unmet.
from line 29
2929
3030## What auto mode checks
3131
32Auto mode in Claude Science checks code that Claude runs in the sandbox (Python, R, shell, and PowerShell cells) and calls to remote and directory connectors. A permission you saved for code cells doesn't skip the check while auto mode is on.
32Auto mode in Claude Science checks:
3333
34Everything else asks as it does with auto mode off. That includes network access, access to files outside the session's workspace folder, remote compute, Claude's package and environment tools, and any tool you set to **Ask each time**.
34* Code that runs in the sandbox (Python, R, shell, and PowerShell cells)
35* Code you've already allowed
36* Calls to remote and directory connectors that would otherwise ask you
3537
36## What each check sends to Anthropic
38Even when auto mode is on, Claude Science still asks permission for:
3739
38Each check in Claude Science is a separate request to a Claude model at Anthropic and counts toward your usage. It includes the pending action in full and these parts of the conversation so far: your messages, Claude's questions with your answers, and each action Claude took. Each action still in the conversation is sent in full, such as the code Claude ran, the text it wrote to a file, a short message it sent you while it worked, or the instructions it wrote when it delegated part of the work. Claude's other replies and the output of those actions are left out, except where a summary of older parts of a long conversation restates them. When code runs anywhere but the top level of the Claude Science session's workspace folder, the request includes the full path of the folder the code runs in, which can include your computer's user name.
40* Network access
41* Access to files outside the session's workspace folder
42* Remote compute
43* Claude Science's package and environment tools
44* Any tool you set to **Ask each time**
3945
claude-science/changelog Changed · +3 / -0 lines
from line 13
1313October 21, 2026
1414
1515* As a precaution following the publicly reported compromise of several emSign (eMudhra) intermediate certificate authority (CA) keys, most of the connections Claude Science makes itself, and many of the package installs it runs itself, no longer trust emSign (eMudhra) root certificates or one other root certificate. Versions 0.1.69 and later include all of these changes; to update, see [Update Claude Science](https://claude.com/docs/claude-science/update-claude-science.md)
16* [Auto mode](https://claude.com/docs/claude-science/auto-mode.md) is on by default wherever it's available to you: it lets Claude Science run code and call connectors without stopping to ask about every step. Turn it off for new sessions in **Settings > Permissions**, or for one session in its settings menu in the message box
17* Auto mode: if **Auto mode on for new sessions** is off, then in the Windows app, or when Claude Science runs from a terminal or in a browser tab, turning auto mode on for a single session may not take effect until you quit Claude Science fully, reopen it and turn the session on again, usually once for each organization. To quit it fully, see [the steps in Troubleshoot Claude Science](https://claude.com/docs/claude-science/troubleshooting.md#environments-failed)
18* Team and Enterprise: auto mode works only where it's allowed for your organization. Where it isn't, the **Auto mode on for new sessions** toggle is grayed out (point at it to see why), and Claude Science asks for approval as it does without auto mode
1619* A new **Trouble updating?** link opens [Update Claude Science](https://claude.com/docs/claude-science/update-claude-science.md), a help page with other ways to update. It shows in **Settings > General > About**, in the **Update required** box, and on the "Update available" notice while an update downloads or after one fails
1720* Cloud storage in Settings now works with Google Cloud Storage HMAC keys on computers where no AWS region is set
1821* Mac: if `config.toml` has `auto_update = false` under `[update]`, Claude Science in its own window no longer checks for updates in the background. You can still check with **Claude Science > Check for App Updates…** in the menu bar
claude-science/enable-claude-science Changed · +1 / -1 lines
from line 58
5858
5959This is the same pattern as other Claude apps you enable per organization.
6060
61In a custom role, the **Claude Science** capability has seven capabilities under it, one for each feature you can limit by role, such as SSH hosts, Modal, and memory. Turning on the **Claude Science** capability turns these on too, and you can then turn off the ones that role shouldn't have (see [Capabilities in custom roles](https://claude.com/docs/claude-science/admin-controls.md#capabilities-in-custom-roles)). Any that goes with an organization setting you can't turn on stays off.
61In a custom role, the **Claude Science** capability has eight capabilities under it, one for each feature you can limit by role, such as SSH hosts, Modal, and memory. Turning on the **Claude Science** capability turns these on too, and you can then turn off the ones that role shouldn't have (see [Capabilities in custom roles](https://claude.com/docs/claude-science/admin-controls.md#capabilities-in-custom-roles)). Any that goes with an organization setting you can't turn on stays off.
6262
6363## What members see
6464