An audit trail for Claude Cowork: what did your AI coworker decide while you were out?

Claude Cowork keeps your session history, but for an individual or a small team it offers no audit trail: no immutable record of which permissions were requested, what you approved, and what ran while you were in a meeting. Anthropic reserves that layer (telemetry events, role-based controls) for enterprise deployments. If you delegate real work to Cowork and want receipts, you attach the record at the question layer: every ask and every answer, kept where it cannot be quietly edited, exportable when someone asks.

Delegation without a record is hope

The whole promise of Cowork is that work happens while you are elsewhere: the board deck consolidates itself during your standup, the spreadsheet reconciles overnight. Anthropic's own usage analysis says the biggest slice of Cowork work is business process operations, which is exactly the kind of work someone eventually asks questions about. Which version got overwritten? Who approved sending that email? Did anyone sign off on deleting the old checklist?

If your answer is "let me scroll through the session," you do not have an answer. Chat history is long, editable in the sense that sessions get deleted, and attributed to nobody. What a reviewer, a cofounder, or your own future self needs is the decision log: the short list of moments where the agent stopped, asked a human, and got a yes or a no.

Why the built-in story stops at enterprise

Anthropic does take this seriously, at the tier where it gets paid to: enterprise Cowork deployments can stream telemetry events to a SIEM, restrict connector actions per tool, and manage permissions by role. That is the right shape, and it also tells you what Anthropic thinks the audit layer is worth.

For everyone below that tier, the built-in loop notifies you and lets you answer, and that is where it ends. There is no exportable record of the questions, the answers, or the timing, and no view that spans anything beyond Cowork itself.

The question layer is the audit layer

Here is the useful trick: if every meaningful decision passes through an ask, then logging the asks gives you the audit trail for free.

That is how the Pushary setup works with Cowork. You connect it as a custom connector and add standing instructions, so Cowork asks before risky steps and notifies you on completion. Each of those events, the question text, the tool involved, your answer, the timestamp, and which session asked, lands in an immutable log. Nothing in the dashboard can edit or delete an entry, and you can export the lot.

The practical difference shows up in sentences you can suddenly say:

• "Yes, I approved the overwrite, here is the entry, 14:32 on Tuesday."
• "The agent asked about the vendor list twice; the second ask is where the mistake started."
• "Here is every decision my agents asked for last month," as one export, covering Cowork and Claude Code, Codex, Cursor, and Hermes in one place.

That last point matters more than it looks. An audit trail that only covers one agent is a partial answer to every question. The record is most useful when your whole fleet writes to it, which is also the argument for running your agents through one inbox.

What to put on the record

You do not want every file read in the log; you want the log to mean something. The standing instructions steer Cowork to ask at the moments worth recording:

• destructive or irreversible actions (delete, overwrite, bulk changes),
• anything that spends money or sends something outside your machine,
• genuine forks in the work ("which of these two approaches?"),
• completion and errors, as notifications with a short summary.

Reads, drafts, and safe intermediate steps run without a sound. The result is a record short enough to review and complete enough to trust. The same philosophy, applied with real enforcement to CLI agents, is covered in what permissions should an AI agent have.

Honest scope

Cowork has no hooks, so the asking is cooperative: standing instructions guide Claude, they do not compel it. In practice Claude follows explicit standing instructions well, and everything it does ask lands on the record. For a hard guarantee that a command cannot run without an entry in the log, use the enforced hook path with Claude Code, Codex, Gemini CLI, Cursor, or Hermes.

Start with the two-minute setup on the Claude Cowork page, or see how the whole loop compares with the built-in one on Pushary vs Claude Cowork.