Admin controls changedclaude-science/admin-controls
Nearest release: v2.1.309, published 2 hours after upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 22 Oct 2026 17:55 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 22 Oct 2026 18:07 UTC.
Upstream edited
Recorded here
Lines+40added
Lines−35removed
From line
6
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits24to this page, all time
### Auto mode
The whole hunk
from line 6, old and new numbered
/
from line 6
66
77## Organization settings
88
9The [**Organization settings** > **Claude Science**](https://claude.ai/admin-settings/claude-science) page in claude.ai holds the controls that apply to every member of your Team or Enterprise organization who uses the app. An Owner or Primary Owner turns Claude Science on or off there (see [Enable Claude Science](/docs/claude-science/enable-claude-science)), and the other controls unlock once Claude Science is on. On the [Claude Team plan for scientists](https://claude.com/programs/team-plan-for-scientists), Claude Science starts on. On Enterprise plans, you can also limit some of the controls to certain custom roles (see [Capabilities in custom roles](#capabilities-in-custom-roles)). Each section below covers one control: what it governs, its default, and what changes for members when you turn it off.
9The [**Organization settings** > **Claude Science**](https://claude.ai/admin-settings/claude-science) page in claude.ai holds the controls that apply to every member of your Team or Enterprise organization who uses the app. An Owner or Primary Owner turns Claude Science on or off there (see [Enable Claude Science](/docs/claude-science/enable-claude-science.md)), and the other controls unlock once Claude Science is on. On the [Claude Team plan for scientists](https://claude.com/programs/team-plan-for-scientists), Claude Science starts on. On Enterprise plans, you can also limit some of the controls to certain custom roles (see [Capabilities in custom roles](#capabilities-in-custom-roles)). Each section below covers one control: what it governs, its default, and what changes for members when you turn it off.
1010
1111### Defaults by plan
1212
from line 24
2424| Allow members to connect to Modal | On | Off |
2525| Show scientific model endpoint providers on the Compute tab | On | On |
2626| Turn on memory for your team | On | On |
27| Allow members to use auto mode | On | Off |
2728
28¹ For HIPAA-eligible organizations, note that Claude Science (beta) is not covered under your Business Associate Agreement (BAA) and should not be used with protected health information (PHI). Administrators who enable Claude Science are responsible for ensuring their workforce uses it in compliance with applicable legal obligations. Featured and custom connectors, SSH hosts, Modal, scientific model endpoints, memory, and access to previously saved Claude Science work are all off by default for HIPAA-eligible organizations.
29¹ For HIPAA-eligible organizations, note that Claude Science (beta) is not covered under your Business Associate Agreement (BAA) and should not be used with protected health information (PHI). Administrators who enable Claude Science are responsible for ensuring their workforce uses it in compliance with applicable legal obligations. Featured and custom connectors, SSH hosts, Modal, scientific model endpoints, memory, and access to previously saved Claude Science work are all off by default for HIPAA-eligible organizations. Organizations with HIPAA compliance enabled can't turn on auto mode.
2930
3031### How changes reach members
3132
3233Changes you save reach each member's running app within a few minutes and apply on the member's next turn or request. An app that is closed picks up your changes when it next starts, and an app that can't reach claude.ai keeps applying the last settings it received.
3334
34The settings apply to members running version 0.1.41 or later of the Claude Science app. A member still on an earlier version isn't governed by these settings until the member updates (see [Required updates](/docs/claude-science/manage-on-devices#required-updates)). For Team and Enterprise organizations, Claude Science enforces a minimum version of 0.1.41. A member on an older version sees a notice that the version is no longer supported, with an **Update now** button. If the update doesn't complete after a second try, [Update Claude Science](/docs/claude-science/update-claude-science) has the member's next steps for each kind of install; projects and settings on the computer are kept.
35The settings apply to members running version 0.1.41 or later of the Claude Science app; the auto mode switch needs a later version (see [Auto mode](#auto-mode)). A member still on an earlier version isn't governed by these settings until the member updates (see [Required updates](/docs/claude-science/manage-on-devices.md#required-updates)). For Team and Enterprise organizations, Claude Science enforces a minimum version of 0.1.41. A member on an older version sees a notice that the version is no longer supported, with an **Update now** button. If the update doesn't complete after a second try, [Update Claude Science](/docs/claude-science/update-claude-science.md) has the member's next steps for each kind of install; projects and settings on the computer are kept.
3536
3637Each member's app also has to reach claude.ai regularly to confirm these settings. If an app can't reach claude.ai for 72 hours, it pauses memory, custom connectors, SSH hosts, Modal, model endpoints, adding custom skills, and accessing previously saved Claude Science work until it reconnects, and keeps applying the network allowlist, package mirror, and Featured connector and skill choices it last received.
3738
from line 60
5960* **Control on, built-in role**: members whose role is User, Admin, Owner, or Primary Owner can use the feature, because custom roles affect only members whose role is set to **Custom**. On Team plans, which don't have custom roles, that's every member.
6061* **Control on, custom roles**: a member whose role is set to **Custom** can use the feature only if at least one of their custom roles has the capability turned on.
6162
62Turning on the **Claude Science** capability in a role also turns on the seven under it, and you can then turn off the ones that role shouldn't have. Any capability whose control your organization can't turn on stays off. Turning the **Claude Science** capability off turns them all off. A role whose **Capability access** setting is **All capabilities** already includes all seven. A role set to **All generally available** gets them when you turn on its **Claude Science** capability (see [Who gets access after you enable](/docs/claude-science/enable-claude-science#who-gets-access-after-you-enable)).
63Turning on the **Claude Science** capability in a role also turns on the seven under it, and you can then turn off the ones that role shouldn't have. Any capability whose control your organization can't turn on stays off. Turning the **Claude Science** capability off turns them all off. A role whose **Capability access** setting is **All capabilities** already includes all seven. A role set to **All generally available** gets them when you turn on its **Claude Science** capability (see [Who gets access after you enable](/docs/claude-science/enable-claude-science.md#who-gets-access-after-you-enable)).
6364
6465> [!NOTE]
6566>
from line 72
7172
7273### Featured connectors and skills
7374
74Featured connectors and Featured skills come with Claude Science, and admins can control whether they are enabled or disabled for your members (see [Connectors and skills](/docs/claude-science/connectors-and-skills)). The **Featured connectors** and **Featured skills** sections list them with one switch per item, so you can choose which ones members can use. Every item is on by default for Team and Enterprise organizations. In an organization with HIPAA compliance enabled, every Featured connector and skill starts disabled; turn on the ones you have reviewed.
75Featured connectors and Featured skills come with Claude Science, and admins can control whether they are enabled or disabled for your members (see [Connectors and skills](/docs/claude-science/connectors-and-skills.md)). The **Featured connectors** and **Featured skills** sections list them with one switch per item, so you can choose which ones members can use. Every item is on by default for Team and Enterprise organizations. In an organization with HIPAA compliance enabled, every Featured connector and skill starts disabled; turn on the ones you have reviewed.
7576
7677Each section shows how many items are enabled. Expand it to see the list, and select an item to see its tools or instructions, author, license, and third-party terms.
7778
from line 84
8384
8485Members can still turn off, in their own app, any item you leave on. The app remembers each member's choice, so it applies again if you turn an item off and later back on. Turning a Featured skill off doesn't stop a member from writing a skill of their own; whether members can add their own skills is governed by [Custom skills](#custom-skills).
8586
86When you turn Claude Science on, the [**Turn on Claude Science** dialog](/docs/claude-science/enable-claude-science#turn-on-claude-science) notes: "By continuing, you represent that your team has the necessary rights to access these resources and you authorize Claude to do so on their behalf. You can review terms in Settings."
87When you turn Claude Science on, the [**Turn on Claude Science** dialog](/docs/claude-science/enable-claude-science.md#turn-on-claude-science) notes: "By continuing, you represent that your team has the necessary rights to access these resources and you authorize Claude to do so on their behalf. You can review terms in Settings."
8788
8889### Connectors you add in claude.ai
8990
90Connectors you add for your organization in claude.ai also work in Claude Science. Every connector on **Organization settings > Connectors**, whether you added it from the [Connectors Directory](/docs/connectors/directory) or by its web address (a custom connector), shows up in the Claude Science app under **Settings > Connectors** for the members who can use it. If you remove one in claude.ai, it disappears from the app too.
91Connectors you add for your organization in claude.ai also work in Claude Science. Every connector on **Organization settings > Connectors**, whether you added it from the [Connectors Directory](/docs/connectors/directory.md) or by its web address (a custom connector), shows up in the Claude Science app under **Settings > Connectors** for the members who can use it. If you remove one in claude.ai, it disappears from the app too.
9192
9293If a connector needs a sign-in, each member signs in with their own account; the app opens claude.ai for them to do it. Connector permissions in Enterprise custom roles apply the same way; see [Connectors](#connectors) under How other admin settings apply to Claude Science.
9394
from line 96
9596
9697### Custom connectors
9798
98Custom connectors are Model Context Protocol (MCP) servers a member adds under **Settings** > **Connectors** in the Claude Science app, either a remote server at an HTTPS URL or a local command on their computer (see [Custom connectors](/docs/claude-science/custom-connectors)). The **Allow custom connectors** switch decides whether members can add and use them. It's on by default for Team organizations and off by default for Enterprise organizations. Organizations with HIPAA compliance enabled can't turn it on.
99Custom connectors are Model Context Protocol (MCP) servers a member adds under **Settings** > **Connectors** in the Claude Science app, either a remote server at an HTTPS URL or a local command on their computer (see [Custom connectors](/docs/claude-science/custom-connectors.md)). The **Allow custom connectors** switch decides whether members can add and use them. It's on by default for Team organizations and off by default for Enterprise organizations. Organizations with HIPAA compliance enabled can't turn it on.
99100
100101When the switch is off, members can't add, change, or authorize custom connectors, and Claude no longer sees the custom connectors members may have added earlier. Those connectors stay listed in the member's settings, grayed, with a note that custom connectors are disabled by your admin. Featured connectors and the connectors you add on **Organization settings > Connectors** aren't affected by this switch.
101102
from line 104
103104
104105Connectors are built on an open standard called the Model Context Protocol (MCP). When your organization needs a connector it doesn't have yet, what to do depends on where the data lives:
105106
106* **Your own systems and data**, such as an internal database or lab system: have your developers build a connector for it, then add its web address for everyone under **Organization settings > Connectors > Add > Custom** (see [Add a connector by URL](/docs/connectors/custom/add-unlisted#add-a-connector-by-url)). Claude connects to it from Anthropic's servers, so it must be reachable from the internet. For a system that isn't, Enterprise organizations can request an MCP tunnel, a secure link from their own network to Anthropic (in research preview; see [MCP tunnels](/docs/connectors/mcp-tunnels/overview)).
107* **Another company's product**: the company that makes the product usually builds and runs its connector, not Anthropic. Check the [Connectors Directory](/docs/connectors/directory) first. If the company offers a connector that isn't listed there, add its web address under **Organization settings > Connectors > Add > Custom**; a connector doesn't need to be in the directory to work (see [Connector verification](/docs/connectors/verification)). If the company doesn't offer one, ask them to build one. They can [submit it to the Connectors Directory](/docs/connectors/building/submission) for review; if Anthropic accepts it, any Claude user can find it there.
108* **Public scientific databases and tools**: Claude may not need a connector at all. Code that Claude runs on members' computers can reach any site on Claude Science's list of allowed sites, so adding the site to that list is often enough. By default, members allow a new site themselves when Claude asks. If you turn on **Manage network allowlist** on **Organization settings > Claude Science**, you add sites for them under **Custom domains** instead (see [Network allowlist](#network-allowlist)). If a connector would still help, look for one in the [Connectors Directory](/docs/connectors/directory) and add it on **Organization settings > Connectors**.
107* **Your own systems and data**, such as an internal database or lab system: have your developers build a connector for it, then add its web address for everyone under **Organization settings > Connectors > Add > Custom** (see [Add a connector by URL](/docs/connectors/custom/add-unlisted.md#add-a-connector-by-url)). Claude connects to it from Anthropic's servers, so it must be reachable from the internet. For a system that isn't, Enterprise organizations can request an MCP tunnel, a secure link from their own network to Anthropic (in research preview; see [MCP tunnels](/docs/connectors/mcp-tunnels/overview)).
108* **Another company's product**: the company that makes the product usually builds and runs its connector, not Anthropic. Check the [Connectors Directory](/docs/connectors/directory.md) first. If the company offers a connector that isn't listed there, add its web address under **Organization settings > Connectors > Add > Custom**; a connector doesn't need to be in the directory to work (see [Connector verification](/docs/connectors/verification.md)). If the company doesn't offer one, ask them to build one. They can [submit it to the Connectors Directory](/docs/connectors/building/submission.md) for review; if Anthropic accepts it, any Claude user can find it there.
109* **Public scientific databases and tools**: Claude may not need a connector at all. Code that Claude runs on members' computers can reach any site on Claude Science's list of allowed sites, so adding the site to that list is often enough. By default, members allow a new site themselves when Claude asks. If you turn on **Manage network allowlist** on **Organization settings > Claude Science**, you add sites for them under **Custom domains** instead (see [Network allowlist](#network-allowlist)). If a connector would still help, look for one in the [Connectors Directory](/docs/connectors/directory.md) and add it on **Organization settings > Connectors**.
109110
110111### Custom skills
111112
112Skills are instructions, sometimes with helper code, that Claude loads when a task calls for them (see [Skills](/docs/claude-science/connectors-and-skills#skills)). Members add their own by writing one, uploading one, importing one from a public GitHub repository (or a private repo if a [GitHub credential](/docs/claude-science/connectors-and-skills#skills) is stored), or asking Claude to create one from a session. The **Allow custom skills** switch decides whether members can add skills of their own, including creating one from the Claude Science app so it's also available to them in claude.ai. It's on by default for Team and Enterprise organizations, including those with HIPAA compliance enabled.
113Skills are instructions, sometimes with helper code, that Claude loads when a task calls for them (see [Skills](/docs/claude-science/connectors-and-skills.md#skills)). Members add their own by writing one, uploading one, importing one from a public GitHub repository (or a private repo if a [GitHub credential](/docs/claude-science/connectors-and-skills.md#skills) is stored), or asking Claude to create one from a session. The **Allow custom skills** switch decides whether members can add skills of their own, including creating one from the Claude Science app so it's also available to them in claude.ai. It's on by default for Team and Enterprise organizations, including those with HIPAA compliance enabled.
113114
114115When the switch is off, members can't add new skills of their own or publish them, and the app notes that custom skills are disabled by your admin. Skills a member added earlier still work and can still be edited, and Featured skills aren't affected. Custom skills are how members teach Claude their own workflows and analysis pipelines, so Anthropic recommends leaving this switch on.
115116
from line 126
125126
126127Without one of these options, no skills from claude.ai and none of your organization's plugins reach that member's app. To give the member one, turn it on in the **Capabilities** tab of one of their custom roles (see [Capabilities in custom roles](#capabilities-in-custom-roles)). If your organization keeps **Cloud code execution and file creation** off, the **Chat** and **Code execution and file creation** option has no effect. Choose **Claude Code**, or **Cowork** if Cowork is turned on for your organization.
127128
128To let members manage their own skills, host them in a GitHub repository. Put one `skills/<name>/SKILL.md` folder per skill in the repository and share the link. Members import them in the Claude Science app under **Settings** > **Skills** > **Add skill** > **Import from GitHub**. Claude Science records the commit each skill came from. When the repository has new commits, **Check for updates…** flags the skills whose files differ from its latest commit; each member chooses when to import again (see [Update skills imported from GitHub](/docs/claude-science/connectors-and-skills#update-skills-imported-from-github)). Private repositories work after a member adds a GitHub token in the Claude Science app under **Settings** > **Credentials**.
129To let members manage their own skills, host them in a GitHub repository. Put one `skills/<name>/SKILL.md` folder per skill in the repository and share the link. Members import them in the Claude Science app under **Settings** > **Skills** > **Add skill** > **Import from GitHub**. Claude Science records the commit each skill came from. When the repository has new commits, **Check for updates…** flags the skills whose files differ from its latest commit; each member chooses when to import again (see [Update skills imported from GitHub](/docs/claude-science/connectors-and-skills.md#update-skills-imported-from-github)). Private repositories work after a member adds a GitHub token in the Claude Science app under **Settings** > **Credentials**.
129130
130131To stop members from adding their own skills, turn off the **Allow custom skills** switch on the **Organization settings** > **Claude Science** page (see [Custom skills](#custom-skills)).
131132
132133### Previously saved Claude Science work
133134
134A member who used Claude Science under another sign-in on the same computer (for example, a personal plan before joining your organization) can access the projects, sessions, and artifacts from that sign-in and move it into the app's folder for your organization on that computer (see [Access work from another sign-in on your computer](/docs/claude-science/multiple-computers#access-work-from-another-sign-in-on-your-computer)). The **Allow members to access Claude Science work previously saved on their computer** switch decides whether the app offers this access. It's on by default for Team organizations and off by default for Enterprise organizations, and organizations with HIPAA compliance enabled can't turn it on.
135A member who used Claude Science under another sign-in on the same computer (for example, a personal plan before joining your organization) can access the projects, sessions, and artifacts from that sign-in and move it into the app's folder for your organization on that computer (see [Access work from another sign-in on your computer](/docs/claude-science/multiple-computers.md#access-work-from-another-sign-in-on-your-computer)). The **Allow members to access Claude Science work previously saved on their computer** switch decides whether the app offers this access. It's on by default for Team organizations and off by default for Enterprise organizations, and organizations with HIPAA compliance enabled can't turn it on.
135136
136137The access happens on the member's computer and uploads nothing. Claude Science work the app accesses will follow your organization's settings from then on. Content your organization doesn't allow isn't copied or moved and stays in its original folder, and credentials such as API keys and connector sign-ins are never copied or moved. When the switch is off, the app doesn't offer the access, and its **Access previously saved Claude Science work on this computer** setting is grayed out with a note that it's off for your organization.
137138
138139### Network allowlist
139140
140When Claude runs code for a member, that code can reach only the domains on the analysis sandbox's network allowlist: the package hosts, the scientific databases behind the Featured connectors, and hosts the member approved. See [Sandbox](/docs/claude-science/core-concepts#sandbox) and the domain tables in [Network requirements](/docs/claude-science/network-requirements#analysis-sandbox-domains).
141When Claude runs code for a member, that code can reach only the domains on the analysis sandbox's network allowlist: the package hosts, the scientific databases behind the Featured connectors, and hosts the member approved. See [Sandbox](/docs/claude-science/core-concepts.md#sandbox) and the domain tables in [Network requirements](/docs/claude-science/network-requirements.md#analysis-sandbox-domains).
141142
142143By default, each member manages that list on their own computer. The **Manage network allowlist** switch transfers control of the list from members to you. While it's on, every member's app uses the organization's list instead of the member's own, and members see the list in their **Network** settings read-only, apart from domains they have blocked themselves, with a note that the domain allowlist is controlled by their admin. It's off by default for Team and Enterprise organizations, and on for organizations with HIPAA compliance enabled, which can't turn it off.
143144
144145Turning the switch on sets aside what members allowed themselves, including the domains a deployed configuration file adds with its `[sandbox.network]` keys; those settings are kept and apply again when you turn the switch off. Domains the file denies stay denied.
145146
146Your list is enforced by the app's sandbox (see [Sandbox](/docs/claude-science/core-concepts#sandbox)). On a computer where the sandbox is turned off or can't start, the app pauses new sessions and messages and tells the member the computer doesn't meet the organization's security requirements, until the member restarts the app with the sandbox on or you turn the switch off. Turning the switch off keeps your saved list, which applies again the next time you turn it on.
147Your list is enforced by the app's sandbox (see [Sandbox](/docs/claude-science/core-concepts.md#sandbox)). On a computer where the sandbox is turned off or can't start, the app pauses new sessions and messages and tells the member the computer doesn't meet the organization's security requirements, until the member restarts the app with the sandbox on or you turn the switch off. Turning the switch off keeps your saved list, which applies again the next time you turn it on.
147148
148149With the switch on, **Claude Science domains** shows the Featured domains in the same groups as the app, such as **Package management**, **Literature & citations**, and **NCBI / NIH**, with one switch per domain. A group switch turns all of its domains on or off. Below it, **Custom domains** adds your own. The rules for an entry are:
149150
from line 156
155156
156157Until you change the list, members use Claude Science's Featured list, including domains added in later versions of Claude Science. Once you change it, the list is saved exactly as you left it, so a domain added in a later version stays off until you turn it on. **Reset** returns to the Featured list and removes your custom domains, for all members.
157158
158You can also turn off the **Package management** domains (PyPI, conda, CRAN and Bioconductor, npm, and GitHub), with limits. The PyPI and conda domains can be turned off only while the [organization package mirror](#organization-package-mirror) covers them. Turning the CRAN and Bioconductor, npm, or GitHub domains off means members can't install packages from them, and the page asks you to confirm. The domains the sandbox always blocks (see [Network requirements](/docs/claude-science/network-requirements#domains-the-sandbox-always-blocks)) stay blocked whichever list is in force.
159You can also turn off the **Package management** domains (PyPI, conda, CRAN and Bioconductor, npm, and GitHub), with limits. The PyPI and conda domains can be turned off only while the [organization package mirror](#organization-package-mirror) covers them. Turning the CRAN and Bioconductor, npm, or GitHub domains off means members can't install packages from them, and the page asks you to confirm. The domains the sandbox always blocks (see [Network requirements](/docs/claude-science/network-requirements.md#domains-the-sandbox-always-blocks)) stay blocked whichever list is in force.
159160
160161The allowlist governs the network connections of code Claude runs in the sandbox on the member's computer, the local-command connectors that run inside it, and, while you manage it, the [model endpoints](#scientific-model-endpoints) members connect by host name. Jobs on SSH hosts use the host's own network, so the allowlist doesn't apply to them, and the [**Allow members to connect SSH hosts**](#ssh-hosts) switch is the control for those.
161162
from line 164
163164
164165### Organization package mirror
165166
166Analysis environments install Python and conda packages from the public hosts unless a mirror is set. Members or IT can set a mirror per computer under **Settings** > **Network** > **Package mirror** or in the [configuration file](/docs/claude-science/configuration-file-reference#package-download-keys). See [Point package installs at an internal mirror](/docs/claude-science/corporate-networks#point-package-installs-at-an-internal-mirror) for the mirror layout and credentials.
167Analysis environments install Python and conda packages from the public hosts unless a mirror is set. Members or IT can set a mirror per computer under **Settings** > **Network** > **Package mirror** or in the [configuration file](/docs/claude-science/configuration-file-reference.md#package-download-keys). See [Point package installs at an internal mirror](/docs/claude-science/corporate-networks.md#point-package-installs-at-an-internal-mirror) for the mirror layout and credentials.
167168
168169The **Organization package mirror** section sets the same two addresses once for every member: a **Conda channel URL** and a **Python package index URL (PyPI)**. The section applies whether or not you manage the [network allowlist](#network-allowlist), and there is no organization mirror by default.
169170
from line 172
171172
172173An organization mirror takes precedence over a mirror a member set in Settings or in their configuration file. The member's values are kept but not used, and their Settings show that the package mirror is controlled by their admin. The mirror host is allowed automatically and the public hosts it replaces are removed from the allowlist, as for a member-set mirror. While you manage the network allowlist, those hosts stay removed even if they are switched on in your list.
173174
174Mirror credentials stay with each member. A member signs in to your mirror once per mirror host under **Settings > Network > Package mirror > Mirror credentials**, unless you [deploy the credential as a file](/docs/claude-science/corporate-networks#deploy-the-mirror-credential-as-a-file), and the organization settings never store a credential.
175Mirror credentials stay with each member. A member signs in to your mirror once per mirror host under **Settings > Network > Package mirror > Mirror credentials**, unless you [deploy the credential as a file](/docs/claude-science/corporate-networks.md#deploy-the-mirror-credential-as-a-file), and the organization settings never store a credential.
175176
176177### SSH hosts
177178
178Members can register a machine they reach over SSH, such as a lab workstation or an HPC login node, so Claude can run jobs on it (see [Remote compute clusters](/docs/claude-science/remote-compute-clusters)). The **Allow members to connect SSH hosts** switch decides whether they can. It's on by default for Team and Enterprise organizations, and off by default for organizations with HIPAA compliance enabled, which can turn it on. On Enterprise plans, you can also limit SSH hosts to certain custom roles with the **Connect to SSH hosts** capability (see [Capabilities in custom roles](#capabilities-in-custom-roles)).
179Members can register a machine they reach over SSH, such as a lab workstation or an HPC login node, so Claude can run jobs on it (see [Remote compute clusters](/docs/claude-science/remote-compute-clusters.md)). The **Allow members to connect SSH hosts** switch decides whether they can. It's on by default for Team and Enterprise organizations, and off by default for organizations with HIPAA compliance enabled, which can turn it on. On Enterprise plans, you can also limit SSH hosts to certain custom roles with the **Connect to SSH hosts** capability (see [Capabilities in custom roles](#capabilities-in-custom-roles)).
179180
180181When the switch is off, members can't add SSH hosts, and hosts they added earlier are kept but refuse new commands and file transfers; the app shows that SSH host setup is disabled by your admin. A job that is already running can still be stopped and its results collected.
181182
from line 184
183184
184185### Modal
185186
186[Modal](https://modal.com/) is a third-party cloud computing service. Members can connect a Modal account they own so Claude can run jobs that need a GPU or more memory than their computer has. Modal bills that account directly, and Anthropic never sees a payment method (see [Compute providers](/docs/claude-science/compute-providers#connecting-modal)). The **Allow members to connect to Modal** switch decides whether members can connect Modal in the Claude Science app in **Settings** > **Compute**. It's on by default for Team organizations, off by default for Enterprise organizations, and off by default for organizations with HIPAA compliance enabled, which can turn it on.
187[Modal](https://modal.com/) is a third-party cloud computing service. Members can connect a Modal account they own so Claude can run jobs that need a GPU or more memory than their computer has. Modal bills that account directly, and Anthropic never sees a payment method (see [Compute providers](/docs/claude-science/compute-providers.md#connecting-modal)). The **Allow members to connect to Modal** switch decides whether members can connect Modal in the Claude Science app in **Settings** > **Compute**. It's on by default for Team organizations, off by default for Enterprise organizations, and off by default for organizations with HIPAA compliance enabled, which can turn it on.
187188
188189When the switch is off, members can't set up Modal or start new Modal jobs, and the app shows that Modal setup is disabled by your admin. A job that is already running can still be stopped, and the member's Modal settings are kept.
189190
from line 196
195196
196197### Scientific model endpoints
197198
198Members can connect a scientific model server, such as NVIDIA BioNeMo NIM, that Claude calls directly from analyses (see [Scientific model endpoints](/docs/claude-science/compute-providers#scientific-model-endpoints)). The **Show scientific model endpoint providers on the Compute tab** switch decides whether members can connect the providers listed on the app's **Compute** tab. It's on by default for Team and Enterprise organizations, and off by default for organizations with HIPAA compliance enabled, which can turn it on.
199Members can connect a scientific model server, such as NVIDIA BioNeMo NIM, that Claude calls directly from analyses (see [Scientific model endpoints](/docs/claude-science/compute-providers.md#scientific-model-endpoints)). The **Show scientific model endpoint providers on the Compute tab** switch decides whether members can connect the providers listed on the app's **Compute** tab. It's on by default for Team and Enterprise organizations, and off by default for organizations with HIPAA compliance enabled, which can turn it on.
199200
200201When the switch is off, members can't connect these providers or use the endpoints they set up earlier, and the app shows that scientific model endpoint setup is disabled by your admin; the settings they entered are kept. The switch governs third-party model endpoints only and has no effect on which Claude models members can use.
201202
from line 204
203204
204205### Memory
205206
206Memory lets Claude save short facts about a member, their projects, and their files across sessions, stored in the app's local database on the member's computer (see [Memory](/docs/claude-science/core-concepts#memory)). Each member chooses whether their own memory is on, during first-time setup or later in **Settings** > **Memory**. The **Turn on memory for your team** switch decides whether members can use memory at all. It's on by default for Team and Enterprise organizations, and off by default for organizations with HIPAA compliance enabled, which can turn it on.
207Memory lets Claude save short facts about a member, their projects, and their files across sessions, stored in the app's local database on the member's computer (see [Memory](/docs/claude-science/core-concepts.md#memory)). Each member chooses whether their own memory is on, during first-time setup or later in **Settings** > **Memory**. The **Turn on memory for your team** switch decides whether members can use memory at all. It's on by default for Team and Enterprise organizations, and off by default for organizations with HIPAA compliance enabled, which can turn it on.
207208
208209When the switch is off, memory is off for every member, whatever they chose in their own settings; Claude neither recalls nor saves facts, first-time setup skips its memory step, and the **Memory** setting shows that memory is disabled by your admin. Facts a member saved earlier stay on their computer, the member can still review and delete them, and Claude uses them again if you turn the switch back on.
209210
210When Claude recalls saved facts for a session, those facts are sent to Anthropic as part of that session's conversation and handled like the rest of the conversation (see [How Claude Science works with your data](/docs/claude-science/how-claude-science-works-with-your-data)). The **Capabilities** > **Memory** setting in claude.ai **Organization settings** doesn't control memory in Claude Science. In a custom role, the **Memory** row under **Claude Science** is the capability for the app's memory, and the **Memory** row under **Chat** is for claude.ai chat (see [Capabilities in custom roles](#capabilities-in-custom-roles)).
211When Claude recalls saved facts for a session, those facts are sent to Anthropic as part of that session's conversation and handled like the rest of the conversation (see [How Claude Science works with your data](/docs/claude-science/how-claude-science-works-with-your-data.md)). The **Capabilities** > **Memory** setting in claude.ai **Organization settings** doesn't control memory in Claude Science. In a custom role, the **Memory** row under **Claude Science** is the capability for the app's memory, and the **Memory** row under **Chat** is for claude.ai chat (see [Capabilities in custom roles](#capabilities-in-custom-roles)).
211212
213### Auto mode
214
215With auto mode, an automated safety check approves a member's code and connector requests that look safe, so the member answers fewer permission cards in the Claude Science app (see [Auto mode](/docs/claude-science/auto-mode.md)). The **Allow members to use auto mode** switch decides whether members can use auto mode at all in Claude Science. It's on by default for Team organizations and off by default for Enterprise organizations. While the switch is on, auto mode starts on for members who can use it, and each member can turn it off in the Claude Science app. While the switch is off, members get a permission card for each request that needs one, as they do without auto mode, and the auto mode toggle in the Claude Science app's **Settings > Permissions** is grayed out. The switch applies to members whose app is recent enough to support it.
216
212217## How other admin settings apply to Claude Science
213218
214219In the tables below, each setting is named by its page in claude.ai **Organization settings** and, where it has one, its label there (for example, **Capabilities** > **Web search**). Apart from the **Enable for your organization** toggle, the controls on the **Claude Science** page itself are described under [Organization settings](#organization-settings).
from line 243
238243
239244| Setting in claude.ai | Status for Claude Science | Note |
240245| - | - | - |
241| Claude Science > Enable for your organization | Supported in Claude Science | Off by default for Team and Enterprise, and on by default for the Claude Team plan for scientists. An Owner or Primary Owner turns it on or off under **Organization settings** > **Claude Science** (see [Enable Claude Science](/docs/claude-science/enable-claude-science)). Assigning seats doesn't turn it on. |
242| Data and privacy > Rate chats | Supported in Claude Science | When you turn this off, the app hides the **Send feedback** link on the [**Chat paused**](/docs/claude-science/safeguards#when-safeguards-flag-a-message) card. If your organization uses customer-managed encryption keys (CMEK), you can't turn this setting on and the app doesn't show that link. |
246| Claude Science > Enable for your organization | Supported in Claude Science | Off by default for Team and Enterprise, and on by default for the Claude Team plan for scientists. An Owner or Primary Owner turns it on or off under **Organization settings** > **Claude Science** (see [Enable Claude Science](/docs/claude-science/enable-claude-science.md)). Assigning seats doesn't turn it on. |
247| Data and privacy > Rate chats | Supported in Claude Science | When you turn this off, the app hides the **Send feedback** link on the [**Chat paused**](/docs/claude-science/safeguards.md#when-safeguards-flag-a-message) card. If your organization uses customer-managed encryption keys (CMEK), you can't turn this setting on and the app doesn't show that link. |
243248| Organization and access > Organization instructions | Supported in Claude Science | Anthropic adds your organization instructions to the app's requests to Claude, as it does for claude.ai chat, so members don't need to update the app for a change to apply. |
244249| Plugins & skills > skills you add for your organization, and the Policy tab | Supported in Claude Science | The **Skills** switch in the **Policy** tab has to be on for Claude Science to get your organization's plugins and to get skills from claude.ai. Skills from claude.ai include the ones you add for your organization. A member whose role is set to **Custom** also needs one of the capability options listed under [Organization skills](#organization-skills). **User-created skills**, on the same tab, decides whether a member can publish a skill from the app to their own claude.ai account. Publishing one also needs **Cloud code execution and file creation** to be on (see its row under [Capability toggles](#capability-toggles)). The skills that come with the app and the skills members add in it are controlled on the **Claude Science** page: one switch per Featured skill, and **Allow custom skills** for skills members add themselves (see [Featured connectors and skills](#featured-connectors-and-skills) and [Custom skills](#custom-skills)). |
245250| Capabilities > Web search | Not applicable in Claude Science | This setting governs claude.ai chat. Claude Science can search the web regardless of it, and the **Claude Science** page has no switch for web search. |
246251| Capabilities > Cloud code execution and file creation | Partially supported in Claude Science | This setting governs the code sandbox Anthropic hosts for claude.ai chat. Running code on the member's computer, or on compute the member connects, is the core of Claude Science and can't be turned off; you govern what that code can reach with the [network allowlist](#network-allowlist), [SSH hosts](#ssh-hosts), and [Modal](#modal) controls. In the app, a member needs this setting turned on to publish a skill to their claude.ai account or to delete a published one. For a member whose role is set to **Custom**, this setting is also part of one capability option for getting skills from claude.ai and your organization's plugins (see [Organization skills](#organization-skills)). |
247| Capabilities > Allow network egress and Domain allowlist | Supported in Claude Science | These settings govern the hosted sandbox for claude.ai chat. Claude Science's sandbox has its own allowlist: manage it for the whole organization with the **Manage network allowlist** switch on the **Claude Science** page (see [Network allowlist](#network-allowlist)), or leave it off and let members manage their own. Administrators can also extend a member's list per device with the sandbox network keys in the [configuration file reference](/docs/claude-science/configuration-file-reference). |
252| Capabilities > Allow network egress and Domain allowlist | Supported in Claude Science | These settings govern the hosted sandbox for claude.ai chat. Claude Science's sandbox has its own allowlist: manage it for the whole organization with the **Manage network allowlist** switch on the **Claude Science** page (see [Network allowlist](#network-allowlist)), or leave it off and let members manage their own. Administrators can also extend a member's list per device with the sandbox network keys in the [configuration file reference](/docs/claude-science/configuration-file-reference.md). |
248253| Data and privacy > Location metadata | Not applicable in Claude Science | Claude Science doesn't send location data with requests to Claude, so there is nothing for this setting to govern. |
249254| Capabilities > Memory (Enable memory for your team) | Supported in Claude Science | This setting governs memory in claude.ai chat. Claude Science keeps a separate memory on each member's computer, which you turn on or off with the **Turn on memory for your team** switch on the **Claude Science** page (see [Memory](#memory)). On Enterprise plans, a custom role's **Memory** capability under **Claude Science** can limit it to certain roles (see [Capabilities in custom roles](#capabilities-in-custom-roles)). |
250255| Settings for claude.ai projects (Public projects, Retention period for projects) | Not applicable in Claude Science | Claude Science doesn't use claude.ai projects. Its projects are folders on the member's computer. |
from line 269
264269
265270| Setting in claude.ai | Status for Claude Science | Note |
266271| - | - | - |
267| Data and privacy > Encryption keys (customer-managed keys) | Supported in Claude Science | The content Anthropic stores from Claude Science (model-call logs, skills members publish, and, where the Compliance API is enabled, session transcripts) is encrypted under your key. Data stored on the member's computer isn't hosted by Anthropic, and work members send to their own SSH hosts, Modal account, or scientific model endpoints doesn't pass through Anthropic, so neither is under your key. In organizations that use customer-managed encryption keys, the app also hides the **Send feedback** link on the [**Chat paused**](/docs/claude-science/safeguards#when-safeguards-flag-a-message) card. See [Customer-managed encryption keys](/docs/claude-science/how-claude-science-works-with-your-data#customer-managed-encryption-keys). |
272| Data and privacy > Encryption keys (customer-managed keys) | Supported in Claude Science | The content Anthropic stores from Claude Science (model-call logs, skills members publish, and, where the Compliance API is enabled, session transcripts) is encrypted under your key. Data stored on the member's computer isn't hosted by Anthropic, and work members send to their own SSH hosts, Modal account, or scientific model endpoints doesn't pass through Anthropic, so neither is under your key. In organizations that use customer-managed encryption keys, the app also hides the **Send feedback** link on the [**Chat paused**](/docs/claude-science/safeguards.md#when-safeguards-flag-a-message) card. See [Customer-managed encryption keys](/docs/claude-science/how-claude-science-works-with-your-data.md#customer-managed-encryption-keys). |
268273| Data and privacy > Data residency (US-only inference), or the regional processing terms in your contract | Supported in Claude Science | Governs where Anthropic processes Claude Science requests to Claude, as for your other Claude products. It doesn't cover code that runs on the member's computer, SSH hosts, or Modal account (the same boundary as Claude Code). |
269274| Data and privacy > HIPAA Compliance | Not applicable in Claude Science | Organizations with HIPAA compliance enabled can turn Claude Science on, but its use isn't covered under your BAA and members must keep protected health information out of it. These organizations start from stricter defaults, listed under [Defaults by plan](#defaults-by-plan). |
270| Data and privacy > Retention period for chats and projects (Enterprise) | Partially supported in Claude Science | The window doesn't reach data stored on members' computers. For Enterprise organizations with the Compliance API enabled, Anthropic keeps each Claude Science session transcript it captures for the window in effect at the time of capture, or for 6 years when no window is set. See [How Claude Science works with your data](/docs/claude-science/how-claude-science-works-with-your-data) for what Anthropic keeps and for how long. |
275| Data and privacy > Retention period for chats and projects (Enterprise) | Partially supported in Claude Science | The window doesn't reach data stored on members' computers. For Enterprise organizations with the Compliance API enabled, Anthropic keeps each Claude Science session transcript it captures for the window in effect at the time of capture, or for 6 years when no window is set. See [How Claude Science works with your data](/docs/claude-science/how-claude-science-works-with-your-data.md) for what Anthropic keeps and for how long. |
271276
272277### Audit and compliance
273278
from line 279
274279| Setting in claude.ai | Status for Claude Science | Note |
275280| - | - | - |
276281| Data and privacy > Export audit logs | Not available in Claude Science | Claude Science doesn't write events to the audit log. For Enterprise organizations with the Compliance API enabled, changes to your Claude Science organization settings are recorded in its Activity Feed instead. |
277| Data and privacy > Compliance API | Supported in Claude Science | Enterprise plans only. The [Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api) returns read-only transcripts of members' Claude Science sessions (this coverage is in beta) and records changes to your Claude Science organization settings in its Activity Feed. Sessions in organizations with HIPAA compliance enabled aren't captured. See [Compliance API coverage](/docs/claude-science/how-claude-science-works-with-your-data#compliance-api-coverage). |
282| Data and privacy > Compliance API | Supported in Claude Science | Enterprise plans only. The [Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api) returns read-only transcripts of members' Claude Science sessions (this coverage is in beta) and records changes to your Claude Science organization settings in its Activity Feed. Sessions in organizations with HIPAA compliance enabled aren't captured. See [Compliance API coverage](/docs/claude-science/how-claude-science-works-with-your-data.md#compliance-api-coverage). |
278283| Data and privacy > Export data | Not available in Claude Science | The organization export doesn't include Claude Science conversations and files, which are stored on members' computers (the same as Claude Code). |
279284
280285### Usage, models, and billing
from line 286
281286
282287| Setting in claude.ai | Status for Claude Science | Note |
283288| - | - | - |
284| Usage > Extra usage and Spend limits | Supported in Claude Science | Claude Science usage counts the same way as Claude Code and Cowork usage. See [Plans and usage](/docs/claude-science/overview#plans-and-usage). |
289| Usage > Extra usage and Spend limits | Supported in Claude Science | Claude Science usage counts the same way as Claude Code and Cowork usage. See [Plans and usage](/docs/claude-science/overview.md#plans-and-usage). |
285290| Billing | Supported in Claude Science | Claude Science uses the same seat as the rest of claude.ai, so there is nothing separate to purchase. |
286291| Models > Model access and Default model (Enterprise) | Supported in Claude Science | Claude Science follows your **Models** page. Turning a model off, for the whole organization or for a custom role, removes it from those members' model picker in the app within a few minutes, and requests for that model are refused. Your **Default model** setting applies in the app as it does in claude.ai. Team plans don't have the **Models** page. |
287| Analytics (from the user menu) | Supported in Claude Science | Analytics has a **Claude Science** tab with adoption and session metrics, and the spend charts on the **Overview** tab can be filtered to Claude Science (see [Monitor usage](/docs/claude-science/monitor-usage)). |
292| Analytics (from the user menu) | Supported in Claude Science | Analytics has a **Claude Science** tab with adoption and session metrics, and the spend charts on the **Overview** tab can be filtered to Claude Science (see [Monitor usage](/docs/claude-science/monitor-usage.md)). |
288293
289294### Offboarding and local data
290295
291296| Setting in claude.ai | Status for Claude Science | Note |
292297| - | - | - |
293| Removing a member (local data) | Not available in Claude Science | Removing a member ends their access to Claude Science but doesn't delete data already on their computer. Use your device management software for that (see [Manage on devices](/docs/claude-science/manage-on-devices)). |
294| Deleting local data | Not available in Claude Science | When a member deletes Claude Science data on their computer, nothing Anthropic holds is deleted: the model-call logs and, where captured, Compliance API session transcripts remain until their own retention periods end (see [How Claude Science works with your data](/docs/claude-science/how-claude-science-works-with-your-data)). |
298| Removing a member (local data) | Not available in Claude Science | Removing a member ends their access to Claude Science but doesn't delete data already on their computer. Use your device management software for that (see [Manage on devices](/docs/claude-science/manage-on-devices.md)). |
299| Deleting local data | Not available in Claude Science | When a member deletes Claude Science data on their computer, nothing Anthropic holds is deleted: the model-call logs and, where captured, Compliance API session transcripts remain until their own retention periods end (see [How Claude Science works with your data](/docs/claude-science/how-claude-science-works-with-your-data.md)). |
295300
No line in this hunk matches that.