One person, three surfaces of one product, one account holding every past conversation
A deployer who runs the same assistant in the browser, as a coding agent and as a desktop work product, and who knows the past conversations contain secrets. Three surfaces, one account, and a record of past conversations that the deployer treats as a credential store. Everything below was elicited on 2026-09-22; nothing was measured.
The estate
| Deployment | Consent | Nearest published shape | The mandate | Delta |
|---|---|---|---|---|
| Claude in the browser, with connectors possibly still on | unknown: "I might still have some connectors enabled" | anthropic/claude-web/connectors-on | 1 wanted, 2 refused, 20 unstated | 4 excess, 0 unbounded (provisional) |
| Claude Code, in a container with a repository attached | the harness's permission mode | anthropic/claude-code-remote/ccr-container | 3 wanted, 2 refused, 18 unstated | 12 excess, 9 unbounded (provisional) |
| Claude Cowork, on the desktop | unknown | none published | 0 wanted, 2 refused, 21 unstated | no shape to compute against |
The account is the junction, and this time it holds the record
Three surfaces run over one account with the vendor. The account holds the conversation record and the connectors. Whatever any surface can reach of the record, the account's exposure is the union across the three, and across every conversation that ever happened on any of them.
The first case had four grants over one Google account and the finding was that the account's exposure is their union. Here the union runs in time as well as across surfaces: everything ever pasted into any conversation is in the record, and turning reading off today does not take it out. A mandate over this estate has to say what to do about what is already there, not only what to do next.
What matters, and what does not
The deployer named the concept this case turns on: what is being given to the agent is context on what is important and what is not. A mandate is that list before it is a list of prohibitions. So the clauses on every page below open with it.
| What the deployer said, or what follows from it | |
|---|---|
| Matters most | the record of past conversations, because it contains secrets; the repository, because it is the work |
| Matters, unknown | whichever connectors are still enabled; nobody has listed them |
| Does not matter | the container's own files, which are disposable; the session's own earlier tool outputs, which are not a past conversation |
| Must never be reused | a key, token, password or credential found anywhere in the record |
What they told us
- The record contains secrets. "past messages, which I think actually contain quite a number of secrets. It contains quite a lot of data." Things get pasted into a chat that would never be committed to a repository, and the chat keeps them.
- Reading the past should be on demand. "that should always be an on-demand thing." Not never: on demand, named, in the conversation that needs it. The grammar has a primitive for reading a retained record and no word for when.
- Some connectors may still be on. "I might still have some connectors enabled." Which is the first open question, and each one is a deployment of its own.
- The question is blast radius, then policy. "I want to understand the blast radius, and then I want to start to see what policies can I put in place... especially taking into account the exposure." The exposure is what is already in the record; the blast radius is what each surface can do with it.
- What is being given is context on what matters. "we're giving agent context on what's important, what's not important, and I think that's an important concept." The mandate as an importance list before it is a list of prohibitions.
Open questions the deployer can answer
Each of these changes a mandate or a barrier on one of the pages below, and none of them can be answered from here.
- Which surfaces can read past conversations, and is it on by default? The deployer believes one or all of the three can. The measured coding agent shape says its container holds only the session's own tool outputs; the other two are not measured. Prompt A asks each surface directly.
- Which connectors are enabled on the account today? Each one is a deployment with its own grant, and the browser shape's five rows are placeholders until they are named.
- Does Claude Code here mean the web container, the CLI on a machine, or both? The web container is measured and its host is the container. The CLI's host is the machine, with the deployer's own credentials in the home directory, and it is a different case.
- What does the desktop work product expose? Local files, applications, connectors, the record: nothing this site has read describes it, and its page holds no shape.
- Are past conversations shared across the three surfaces? If they are, the record is one credential store with three readers; if not, the exposure is per surface. The answer decides whether the estate has one junction or three.
- Can the secrets already in the record be found and removed? A purge is itself a read of the record by something, and that something needs a mandate of its own.
The first prompt, for all three surfaces
Paste it into the browser, into the coding agent and into the desktop product, separately. Three answers over one account, and the differences are the estate.
Four questions about this surface, and answer for this surface only.
1. Can you read our past conversations? Which ones: only this surface's, or the whole
account's? Is that on by default, or only when I ask? If you cannot tell, say so.
2. Have you read anything from a past conversation in this session? Name it.
3. Which connectors are enabled on my account right now, and which of them can you use
from here? For each, does it ask me first?
4. If a past conversation contained a password or a key, what would you do with it if
you came across it?
Answer with what you can actually see. Mark INFERRED on anything you are guessing.The 3 deployments
Claude in the browser, with connectors possibly still on
the derived shape for the web assistant with connectors switched on, 0 of 5 rows measured. Which connectors is the deployer's to name and they have not named them yet, so the shape may be wider or narrower than this deployment by every connector row.
Claude Code, in a container with a repository attached
the shape this site is maintained from, measured by the thing being profiled, 13 of 20 rows seen on the container itself. If the deployer also runs the CLI on their own machine, that is a second deployment with a different reach for host, and it is an open question.
Claude Cowork, on the desktop
no published shape, and nothing this site has read documents what the product exposes: which local files, which applications, whether it reads past conversations, and on what approval. The gap is declared.
Out of scope
- Whichever connectors turn out to be enabled. Each is a deployment of its own once named, with the mailbox walkthrough's prompts ready for it.
- The CLI on the deployer's own machine, if they run it. It is a different shape with a different host, and the site holds a derived profile for it.
The case as JSON · The walkthroughs the prompts come from · The estate universe