# How to Build AI Automations With Claude Cowork > [!info] Deep-read port — Readwise notes field already contained a full deep-read (Refactor Appendix, 5 literature atoms + 1 permanent candidate). > Ported from the existing deep-read. YouTube video. https://www.youtube.com/watch?v=CEDy6rN4t_w > [!question] Lingering Questions > - The video's business anecdotes don't establish reliability, security, or ROI across settings — what would a controlled comparison (chat vs. Cowork vs. a scripted workflow) on the same task actually show? > - Folder scope contains local file access, but does it say anything about remote connector scope? The claimed containment boundary ("nothing else on your computer") is explicitly local-only. > [!tip] Article Ideas > - "Scope first, trust later" — a short piece on the bounded-pilot-then-expand pattern this video describes, aimed at people evaluating Cowork or similar agentic tools for real (not demo) work. > [!link] Cross Reference > - [[3. Resources/MOCs/AI Agent Safety MOC]] — bounded scope, acceptance checks, and adversarial review as concrete safety mechanisms rather than abstractions > - [[3. Resources/Permanent Notes/Verification Must Test the Claimed State Not Only the Latest Change]] — same underlying discipline (don't trust an agent's self-report), different failure mode > [!quote] Vocabulary > - **orchestrator** — in this video's usage, the layer of an agentic system that knows which narrow skill to call, and in what sequence, for a given goal — distinct from any single skill itself. > - **adversarial skill** (as used here) — a dedicated agent role whose job is to find loopholes, mistakes, and gaps in a plan before it executes, rather than to execute the plan. ## Author's thesis Claude Cowork becomes useful once a user can state an outcome, its constraints, and the data/tools available clearly enough for an agent to plan and act — the video frames agents as plain-text instructions plus memory plus tools, and recommends starting with one bounded workflow, reviewing the plan, and expanding only after it proves out. ## Key arguments (≤3) 1. **Precision beats breadth in agent instructions** — stating goals, limitations, and available data/tools as an explicit operating envelope produces more useful behavior than a broad, underspecified request. 2. **Agent "memory" is just inspectable files** — instructions and context live as Markdown text files, which makes them versionable, portable, and auditable rather than a black box. 3. **Containment and adversarial review are the two concrete safety levers demonstrated** — folder scoping limits local file access, and a dedicated adversarial skill is used to find planning gaps before execution — but the video doesn't demonstrate governance for remote connector permissions, which is the larger blast-radius risk. ## Claim atoms ### Agentic work starts with goals and constraints > [!quote] ID:rw_1040672484 > In an agentic environment, you tell it what the goals are, what the limitations are, what it has access to as far as data and tools. At 09:10. A precise operating envelope is more useful than a broad request. ### Plain-text instructions provide reusable agent memory > [!quote] ID:rw_1040672485 > And the reality is agents are text files. Everything in this whole agentic universe is files in a format called Markdown. At 10:36. Files make instructions inspectable, versionable, and portable. ### Orchestrators sequence specialized skills > [!quote] ID:rw_1040672486 > The agentic part of it is the fact that it knows how to call the right skills in the right sequence At 21:34. Complex workflows need explicit coordination between narrow capabilities. ### Folder scope creates a containment boundary > [!quote] ID:rw_1040672487 > It only has access to what's in that folder. Nothing else on your computer. At 40:39. Local scope reduces accidental file access but doesn't govern remote connectors — a gap the video doesn't address. ### Adversarial skills expose planning gaps > [!quote] ID:rw_1040672488 > I want it to find all the loopholes, mistakes, and gaps that I have in any plan that I have At 36:40. A checker role should challenge the maker's plan before execution runs. ## Permanent candidates - **Bounded agents earn broader authority through verified runs** — the video's implicit pattern (start narrow, prove reliability, then widen access) is a general access-control principle, not specific to Cowork. Promoted below. ## Processing checklist - [x] Port the existing deep-read into Konik Literature Note format - [ ] Find or design an actual controlled comparison (same task, chat vs. Cowork vs. scripted) rather than relying on the video's anecdote - [x] Connect into [[3. Resources/MOCs/AI Agent Safety MOC]] ## Links - [[3. Resources/MOCs/AI Agent Safety MOC]] — bounded scope and adversarial review as the video's two concrete (if incomplete) safety mechanisms - [[3. Resources/Readwise/Articles/How to Build AI Automations With Claude Cowork]] — source document, full deep-read