Cowork scheduled tasks: action classifier intermittently denies authorized browser writes to a logged-in CRM; same action succeeds when user is present; no trusted-site setting

Summary

Cowork scheduled tasks that do routine, business-authorized writes in a web CRM (logged-in browser session) are now being denied by the auto-mode action classifier. The same action succeeds when the user is present in the session. There is no admin or per-task setting to mark a site or a scheduled task as trusted, so unattended business automations that worked earlier this month now fail at random.

Environment

• Product: Claude Cowork (desktop app, macOS), scheduled tasks set to "Automatically approve"
• Browser tools: Claude's built-in browser (Claude_Browser__*) and Claude in Chrome
• Target: our own team's account in a real-estate CRM (Compass Contacts). We create contacts, apply tags and send one email to real-estate agents whose buyers matched our listing. The account owner authorized this.

What happens

Denials we logged (dates are US Central):

| Date | Run | Action denied | Reason label |
|---|---|---|---|
| 2026-09-14 | session with automatic approval | bulk "remove tag" on ~398 contacts | [External System Writes] |
| 2026-09-22 | scheduled, unattended | a javascript_tool call that only built a recipient array in the page (no write yet) | [Real-World Transactions] |
| 2026-09-25 | scheduled, unattended | a computer type call pasting an approved email body into the CRM's single-recipient composer | [Real-World Transactions] |
| 2026-09-25 | scheduled, unattended | navigating to the CRM's Contacts page | [Auto-Mode Bypass] |

• The 09-22 action succeeded moments later, unchanged, once the user joined the session.
• The 09-25 composer action succeeded on a later unattended run the same day, so the denial is intermittent, not a stable rule.
• The same scheduled task completed unattended writes on 09-03 and 09-08 with no denials.

Why this is a problem

• Scheduled tasks exist to run when nobody is present. Per the docs, a session that can't prompt turns a flag into a hard deny, so every flagged step is simply lost.
• There is no Cowork equivalent of Claude Code's autoMode.environment / trusted-infrastructure settings, and nothing in the organization admin settings.
• The denials are intermittent, so a task can't be designed around them. A retry sometimes works and sometimes doesn't.
• [Auto-Mode Bypass] fired on a plain page navigation, which suggests the classifier is reading the task's intent rather than the action itself.

Requests

1. A per-scheduled-task or org-level trusted-site list (for example "this task may write to compass.com") that the classifier respects on unattended runs.
2. Or: when a scheduled run hits a soft deny, pause and send the owner an approval request (push or email) instead of denying outright.
3. Document the Cowork classifier categories ([Real-World Transactions], [External System Writes], [Auto-Mode Bypass]) and what each one covers.
4. Say whether the classifier changed around 2026-09-22 (the Opus 5.5 launch), since our denials started or got much more frequent then.

Related: #83850, #67519, #86451, #95777, #95842, #96516