Hane Cowork
Confirmations and organization policy
The allow, confirm, and deny rules that an organization sets for each local capability, the Cowork confirmation UI, and how denied actions and the harness's built-in tools are handled.
This page explains how the organization policy applies to actions in work on this PC, what you can choose when a confirmation appears, and how denied actions are stopped.
Recorded in the actual Hane Cowork app (connected to a test Platform with scripted model responses). The app UI is in Japanese; English captions explain each step.
Three rules set by the organization
Section titled “Three rules set by the organization”Organization administrators set one of the following rules for each local capability. Users cannot change these rules from Cowork.
| Rule | Behavior |
|---|---|
| Allow | Runs without asking |
| Confirm | Waits for your decision on screen every time the action is used |
| Deny | Does not run. The tool is not even listed to the harness |
Rules are set for these five capabilities.
| Capability (UI name) | Scope |
|---|---|
| 「作業フォルダのファイル」 (Work-folder files) | Reading and writing files. Cowork’s tools work inside the work folder you chose; the harness’s built-in tools can also work outside it |
| 「コマンドの実行」 (Run commands) | Running commands in the harness’s shell |
| 「Chrome の操作」 (Chrome actions) | Reading and operating shared Chrome tabs |
| 「PC の操作」 (Computer use) | Capturing and sending input to the chosen app |
| 「外部への送信」 (External transfer) | Sending local content outward, for example by typing it into a page |
When one action involves several capabilities, the strictest rule applies. For example, typing into a Chrome page involves both Chrome actions and external transfer. If either is deny, the action does not run; if either is confirm, you are asked.
A capability the organization has not set a rule for is treated as allowed. The organization sets only the capabilities it wants to deny or confirm. If the organization has not enabled Cowork, no model is available and work cannot start. For how administrators configure this, see Administration.
The confirmation UI
Section titled “The confirmation UI”When an action needs confirmation, the work screen shows 「確認が必要です」 (Confirmation required). It shows the action name (for example 「ファイルを保存する」, Save file), a description, the target (for example summary.txt), and the effect of the action.
| Button | Behavior |
|---|---|
| 「許可して続ける」 (Allow and continue) | Runs this one action and continues the work |
| 「今回はやめる」 (Not this time) | Does not run this action. Progress records 「本人が操作を取りやめました。」 (You declined this action), and the work continues |
Choosing 「今回はやめる」 (Not this time) does not stop the whole work. The harness learns that the action was declined and either tries another approach or reports what it could not do. To stop the whole work, press 「作業を止める」 (Stop work).
Confirmations appear for each action. There is no way to allow an action for the rest of a conversation.
Denied actions
Section titled “Denied actions”Tools for denied capabilities are left out of the list given to the harness. If one is still called (for example, because the organization changed the policy to deny during the work), Cowork does not run it and records the reason in progress:
組織の設定で「作業フォルダのファイル」が禁止されています。(Work-folder files are denied by the organization policy.)
Every time a tool is used, Cowork decides using a policy read within the last 5 seconds. Changes an administrator makes during the work take effect within seconds. If the policy cannot be read, Cowork treats the action as denied and shows 「組織の設定を確認できないため、実行しませんでした。」 (Not run because the organization policy could not be confirmed).
The harness’s built-in tools
Section titled “The harness’s built-in tools”The bundled harness comes with its own shell, file, and web tools. Cowork lets the harness use them according to the capabilities the organization allows.
| Built-in tool | Available when |
|---|---|
| Running commands (shell) | Run commands is allowed |
| Reading, writing, and searching files | Work-folder files is allowed |
| Fetching web pages | External transfer is allowed and one of the above is available |
- Work starts in the work folder if you chose one, or in the per-conversation work area otherwise.
- When both Work-folder files and Run commands are allowed, commands run in your home directory. They use the Python and other tools already installed, and can install what is missing.
- Cowork cannot ask for confirmation before a built-in tool runs. Built-in tools for a capability set to confirm are therefore not offered (Cowork’s own tools still ask for confirmation).
- On macOS, the OS sandbox also blocks what the organization denies. If Work-folder files is denied, writes and reads of your home directory are limited to the per-conversation work area. If External transfer is denied, network access is limited to the model relay.
- If the organization narrows the policy during the work, Cowork stops the work within about 5 seconds and shows 「組織の設定が変わったため、作業を止めました。」 (Work stopped because the organization policy changed).
- If the model calls a built-in tool that is not offered, Cowork does not run it and records 「許可されていない操作を拒否しました」 (Blocked an action that is not allowed) in progress. If Cowork detects that such a tool actually ran, it stops the whole work.
- Windows does not yet have an OS restriction, so built-in tools are not offered there.