On October 15, 2026, Anthropic added saved instructions to its Compliance API, in beta for Claude Enterprise. Security teams can now retrieve members' Instructions for Claude and Cowork Global instructions alongside their other compliance evidence.
The values belong to the user account. Anthropic's endpoint reference says the same text appears under every organization the member belongs to. Preserve where the collector obtained each record, but do not count each organization copy as a separate policy.
Build a complete snapshot before comparing changes. Otherwise, a missed page can look like someone cleared their instructions. Even a complete export only establishes what the collector read; investigating an incident still requires evidence of what the agent did.
Approve the content access first#
The setup documentation requires Enterprise enablement by the Primary Owner and a Compliance Access Key. An Admin API key only reaches the Activity Feed. For preferences, the required scope is read:compliance_user_data, which also reaches other user content; there is no preferences-only scope in the documented list.
Choose a key restricted to the organization being reviewed when that meets the task. Keep it in a secrets manager and let the collector retrieve it at runtime. Do not add deletion authority to an inventory job. Scopes are fixed at key creation, so an existing key with insufficient access needs replacement, not an assumed permission upgrade.
Decide who can read the resulting text before routing it into a general-purpose log index. Instructions can contain business context or personal details. Keep raw responses in a restricted evidence store; the operational index can carry collection status, identifiers, and a pointer to the evidence. Apply the same access restrictions to previews and error logs.
Our Compliance API guide covers tenant setup and the wider evidence inventory. This guide focuses on the new preference collection.
See how your AI systems hold up under real attacks
General Analysis maps AI applications and agents, red teams prompts, retrieval, tools, MCP servers, browser actions, permissions, and business workflows, then turns findings into evidence your team can reproduce and retest.
Request unset values and finish the cursor chain#
The user-preferences reference defines two fields: conversation_preferences and cowork_global_instructions. The default response excludes members with neither value set. Use include_unset=true for an organization inventory; unset fields then appear as null.
Code source: Anthropic's user-preferences request, adapted with inventory parameters.
curl --fail-with-body -sS -G \
"https://api.anthropic.com/v1/compliance/organizations/${ORG_UUID}/user_preferences" \
-H "x-api-key: ${ANTHROPIC_COMPLIANCE_ACCESS_KEY}" \
-H "anthropic-version: 2023-06-01" \
--data-urlencode "include_unset=true" \
--data-urlencode "limit=100"
This retrieves one page. Send next_page unchanged as page on the next request, preserving include_unset and any user_ids[] filter. Stop only when next_page is null; a short or empty page can still have a successor. Targeted requests can filter up to ten user IDs, but a targeted result should never be labeled an organization inventory.
Stage the entire pass before replacing the last successful snapshot. The following illustrative Python function accepts your HTTP client's fetch_page adapter. The adapter must call the endpoint above, return decoded JSON, and raise on unsuccessful HTTP responses. It must not turn an authentication error into an empty page. The Compliance API error guide explains permission failures and rate limits.
Code source: illustrative collector logic using Anthropic's pagination contract; no live tenant integration was tested.
def collect_preferences(fetch_page):
base = {"include_unset": "true", "limit": 100}
cursor = None
seen = set()
staged = []
while True:
params = dict(base)
if cursor is not None:
params["page"] = cursor
response = fetch_page(params)
rows = response["data"]
next_cursor = response["next_page"]
if not isinstance(rows, list):
raise ValueError("Invalid preference page")
staged.extend(rows)
if next_cursor is None:
return staged
if not isinstance(next_cursor, str) or not next_cursor:
raise ValueError("Invalid next_page token")
if next_cursor in seen:
raise ValueError("Repeated next_page token")
seen.add(next_cursor)
cursor = next_cursor
Persist only after the function returns successfully. For larger collections, stage pages in restricted storage and mark the pass complete only after the final cursor. An interrupted pass can remain available for diagnosis, but should not replace the comparison baseline. Bound retries and collection duration in the surrounding job; record failures without printing response content.
Compare observations without inventing a history#
Record the organization UUID, user ID, request filters, pass start and finish times, and each page's retrieval time. Keep the original two values, including null. Associate those records with a collection identifier and completion status.
Calling this a snapshot describes your stored collection. The endpoint documentation does not establish an atomic read across pages. If a member changes their settings while collection runs, different pages may describe different moments.
Use these decision rules when comparing two completed passes:
| Observation | What to record or investigate |
|---|---|
A returned field is null | Record an observed unset value. Do not replace it with an empty string. |
| A returned value differs | Record the two observations and collection times. Investigate the interval; do not invent an exact edit timestamp. |
| A previously seen user is absent | Reconcile membership, filters, and collection status before classifying the absence. |
| Collection failed after several pages | Retain the previous completed baseline and report an incomplete pass. |
| The same user appears under two organizations | Preserve both source organizations and restrict access to each record; avoid counting identical values as separate instruction changes. |
These are proposed collector rules, not additional API guarantees. The endpoint lists current members. Its documented response does not provide a preference revision timeline or prove which instructions a particular session applied. Do not borrow the Activity Feed's retention period as a promise of retrievable preference history: Anthropic's retention documentation treats evidence types separately.
For example, suppose an investigator collects a preference on Friday after an unusual Wednesday upload. Friday's text can guide the investigation, but attaching it to Wednesday's session as the effective instruction would overstate the evidence. Retrieve the relevant session records and the destination system's upload log. Anthropic's integration guidance describes the separate evidence streams and their limits.
Accept the collector with explicit failure cases#
Before relying on the job, use synthetic responses to verify that an empty intermediate page still leads to the next request, a repeated token fails, and a later-page error leaves the previous completed baseline intact. Include both unset fields, a changed value, and a user absent from the later pass. These cases exercise the collector without accessing employee content.
Then use an authorized test account in the intended Enterprise organization to confirm key scope, returned fields, and downstream storage permissions. Record actual observation times. A local fixture cannot establish tenant availability or propagation timing.
Saved text deserves review when it requests unapproved destinations or broad action authority, but the export does not enforce those boundaries. Keep connector permissions, file access, and action approvals under the controls described in How to Secure Claude Cowork. If an automated reviewer reads exported instructions, pass them as untrusted evidence and keep that reviewer unable to execute the instructions it is assessing.
Frequently asked questions
- Can an Enterprise organization retrieve my saved Claude instructions?
Anthropic's October 15 beta lets a correctly scoped Compliance Access Key retrieve current members' saved Claude and Cowork instructions. These are account-level values, so the same text appears under each organization the member belongs to. This does not give every colleague access.
- Does an empty page mean the instruction export is complete?
No. Continue with the returned next_page token until it is null. An intermediate page can contain no records. Keep include_unset and any user_ids filters unchanged throughout the pass.
- Can the export prove which instructions governed a past session?
The documented endpoint supplies saved values, without a preference version history or session-level application record. A collector's timestamps establish when it read those values. Investigate the relevant session and downstream actions separately.
