Claude · Foundations
A good workspace is defined as much by what it doesn't do.
Most of the conversation around setting up a Claude workspace is about what to put in: the knowledge base, the skills, the rules. Just as important is what stays out, on purpose, because putting the wrong thing in creates a risk that's expensive to notice too late.
Direct answer
Four things that don't belong in a workspace
Passwords and payment access
Nothing in a workspace should be able to log in as someone or move money. That access stays with your team, not a drafting tool.
Unreviewed legal or medical judgment
A workspace can organize a case file or summarize a consultation. It should never be the thing that decides what to advise a client or patient.
Data with no business reason to be there
Full customer health records dropped in "just in case" create risk without adding anything useful to the tasks it's actually doing.
Live production systems, unreviewed
A workspace can draft the change. It shouldn't be the thing that applies it to a system customers depend on without someone signing off.
Why this is a standing rule
The upside of a workspace doesn't require the downside
None of the value of a company knowledge base or a custom skill depends on also holding passwords, unreviewed sensitive records, or the authority to change a live system on its own. Keeping those out isn't a limitation on what the workspace can do for you; it's what makes the rest of it safe to rely on.
Where it fits
Part of the same setup as the knowledge base and standing instructions
This isn't a separate project. It's decided as part of building the knowledge base and standing instructions: what goes in, what stays out, and what rules apply to the boundary in between.
Questions
FAQ
What if we're not sure whether something is sensitive?
We flag it and talk it through before it goes in, rather than assuming either way. That review is part of setup, not an afterthought.
Does this mean the workspace can't help with legal or medical tasks at all?
It can organize and summarize, such as turning consultation notes into a structured case file. The judgment itself stays with the licensed professional.
Who decides what stays out?
You do, with our recommendation. We flag the risk; the call on your own data is always yours.
Next step
Let's map what belongs in your workspace, and what doesn't
A short call to walk through your data and decide the boundary before anything gets built.