Free to read · no account needed

16 min · claude

Computer use safely: approvals first

Goal: If Claude (or similar) can click your screen or browser, keep Ask-every-time on and start with a tiny sandbox drill—never banking or production admin.

Best for: Users offered computer use / browser control features.

Computer use means the model may move a cursor, click, type, or drive a browser. That is high blast radius—closer to handing someone your mouse than to ordinary chat. Practice on throwaway pages. Deny downloads and logins until you trust the loop.

Computer-use can click what you can click. Start in a scratch folder, deny purchases, and narrate each risky step before allowing it.

Why beginners skip this

Skipping the hard part of “Computer use safely: approvals first” feels fine until a live thread pays the bill. Hold: Ask-every-time on clicks that leave the system; sandbox first—date a refuse-line this week, or nothing changed Mid-week cost shows up as rework, not as a missing bookmark.

Step 1 — Mental model

Treat every click as an action you might have to undo. Prefer read-only drills first. Keep your password manager closed. Do not open corporate admin panels “just to demo.”

Step 2 — First safe drill

Do this step with a real artifact open—not from memory.

Computer-use drill:
Open example.com only.
Read the main heading text.
Do not log in anywhere.
Do not download files.
Do not visit other domains.
Report what you clicked, then stop and wait.
Example

Filled prompt

Live task this week (not a toy): apply this guide's Goal — If Claude (or similar) can click your screen or browser, keep Ask-every-time on and start with a tin
Fill with your real artifact names/files. Constraints: no invented facts; label Unknowns; stop before send/delete/pay.
Return the working prompt + one pass/fail check I can mark in a minute.

What good output looks like

  • Pulls from Project/file named in the ask for “If Claude (or similar) can click your screen or br”
  • Standing instructions respected; no silent scope creep
  • Decisions quoted or labeled Unclear — never “sounds good”
  • One-minute check: does output match claude-computer-use-safely Done?

Step 3 — Permission ladder

TaskSetting
Read a public docs pageAsk every time until boringly safe
Fill a form on your staging siteAsk; watch each field
Send email / purchase / deleteDo not delegate—or require explicit human send

Pair with agent blast-radius thinking before widening scope.

Example

Filled prompt

Computer-use card for sandbox practice:
Allowed: docs.example.test read-only
Forbidden: send mail, pay, delete files, production URLs
Ask-every-time: any click that submits a form
Run: open docs home and list 3 links—stop at first ask prompt.

What good output looks like

  • Standing instructions respected; no silent scope creep
  • Decisions quoted or labeled Unclear — never “sounds good”
  • One-minute check: does output match claude-computer-use-safely Done?
  • Pulls from Project/file named in the ask for “If Claude (or similar) can click your screen or br”

Save this card

Card: Ask-every-time on clicks that leave the system; sandbox first—date a refuse-line this week, or nothing changed. Keep this beside the tool; read before you start.

1. What I shipped: ___ 2. What I refused: ___ 3. What I will never-do again: ___ (date: Asia/Shanghai)

  • [ ] Tools/writes paused
  • [ ] Refuse-line dated
  • [ ] Artifact path saved
  • [ ] Next link chosen (or stop)

Before you start

Open the Claude Project you will keep. Confirm standing instructions + the knowledge file for “Computer use safely: approvals first” are current. Guide: claude-computer-use-safely. If you only have a blank practice box, stop and fetch the real job first.

Default posture: draft-only until a human confirms sends/writes. Date your first refuse-line (Asia/Shanghai) before granting new tools.

  • Goal in one line: ___
  • Allowed tools: ___
  • Forbidden: ___
  • Human approve needed for: ___

How to use this week

This week: if computer-use can click, run one dry task in a scratch folder only. Write the allow-list of windows/paths first. Log what you blocked on a live artifact—not a blank demo. Write one refuse-line and date the note (Asia/Shanghai). If you only skimmed claude-computer-use-safely, put 25 minutes on the calendar and redo once.

Clean profile

Never enable computer-use on a bank or admin-logged session. Scratch folder first.

Narrate risky clicks

Before Allow on Send/Empty Trash/Purchase, make the agent state the click in one sentence.

Purchase is always red

If the agent can click Buy, that click stays behind an explicit human yes—every time.

Do not bookmark-only

Finish Practice now, then tick this guide on your path. Titles unread are not skills.

Close the loop

After Practice now, write one line: what you will refuse next time. That line is the habit.

Example

Filled prompt

Computer use enabled. Task: open staging docs, copy title of 3 pages.
Card: allowed staging URL only; forbid send/pay; ask-every-time on forms.
Run to first ask.

What good output looks like

  • Pulls from Project/file named in the ask for “If Claude (or similar) can click your screen or br”
  • One-minute check: does output match claude-computer-use-safely Done?
  • Standing instructions respected; no silent scope creep
  • Decisions quoted or labeled Unclear — never “sounds good” [claude-computer-use-safely#3]
Example

Filled prompt

Computer use: staging docs only.
Ask-every-time on forms; forbid pay/send. Run to first ask.
Context: real workstream this week (Asia/Shanghai). Name actual files/people.
Constraints: no invented metrics/owners/prices; label Unknowns; stop before send/delete/pay.
Done check: I can mark pass/fail in one minute on the output.

What good output looks like

  • Decisions quoted or labeled Unclear — never “sounds good”
  • Pulls from Project/file named in the ask for “If Claude (or similar) can click your screen or br”
  • One-minute check: does output match claude-computer-use-safely Done?
  • Standing instructions respected; no silent scope creep

Red flag

Model typing on a login page; send/pay without approval; continuing when steps are invisible—kill the session.

Pitfalls

PitfallFix
Demo on real bank/adminSandbox only
Auto-approve all clicksAsk every time first week
Pasting passwords into the agentNever; you type secrets yourself if unavoidable

Practice now

Live card: one Claude artifact/diff/email pass for “Computer use safely: approvals first” with Blind before share (Asia/Shanghai).

Today: write allow/deny for computer-use actions; require human approval for send/buy/submit. Rehearse one refusal. Date the list (Asia/Shanghai).

Today card (copy) — claude-computer-use-safely: 1. Artifact I will produce: ___ 2. Pass/fail check: ___ 3. Refuse-line if tempted to skip verify/send: ___ (date: Asia/Shanghai) 4. One never-do from this guide: ___

  • [ ] Artifact path written
  • [ ] Refuse example would say "yes"
  • [ ] Dated Asia/Shanghai

One sentence takeaway

Ask-every-time on clicks that leave the system; sandbox first—date a refuse-line this week, or nothing changed

  • You can point to a dated refuse-line
  • You have one artifact path from tonight
  • You can teach the red flag in one sentence

Next

Agent blast radius · Secrets · Human-in-the-loop · Claude Projects knowledge

Pair with today: open the first Next link (safety-agent-blast-radius) only after you dated a refuse-line for this guide (Asia/Shanghai).

← Back to home · Learn · Tools · Compare · Start