Four questions that tell you what any AI agent is actually free to do
Everyone's first question about agent tools is "which one?". The better question is what any given tool is actually free to do. I coach people using Cowork, Claude's desktop agent, and people using Claude Code, its terminal sibling. They run the same engine; what differs is the containment. The difference comes down to four freedoms. Ask these four questions of any agent setup and you'll know exactly what you're working with, and what you're not.
1 Reach
Where can it go?
An agent's usefulness rises with how much of your world it can see at once. The real work of a good session is cross-referencing: the client file against the meeting notes against the thing you wrote in March. If the agent can only see one folder, you have to predict which connections it will need and copy everything in before you start. Most of the value lives in the connections you didn't predict.
The room · CoworkThe folder or folders you granted, and nothing else. You prepare the room before the meeting.
The keys · Claude CodeThe whole machine. Any project, any archive, any old note, connected in a single pass.
2 Tools
What can it wield?
Both can write and run code, which surprises people. The question is what the code runs against. Inside a sealed virtual machine the agent works on copies: safe, contained, disposable. With a real terminal it works on the world: your email drafts, your accounts, your website, your live systems. The distinction isn't capability. It's consequence.
The room · CoworkShell and code inside a sealed virtual machine, plus whichever connectors you switch on.
The keys · Claude CodeYour real toolchain against live systems. What it does actually happens.
3 Memory
What compounds?
The quietest freedom, and over a year the biggest. A folder-scoped agent starts each session knowing only what's in the folder. A configured agent starts knowing how you work: your preferences, your standing rules, your past mistakes, written down and loaded every time. Session one hundred is meaningfully better than session one, and none of that improvement cost anything on the day.
The room · CoworkEach session starts roughly fresh. The folder is its memory, and you maintain it by hand.
The keys · Claude CodePreferences, rules and lessons persist and load automatically. Capability compounds.
4 Guardrails
Who built the fence?
The inversion that makes sense of the other three. In the room, the platform holds the safety: the sealed machine, the folder boundary, a plan shown before it acts, confirmation before anything destructive. With the keys, you hold the safety, and until you've built your own fences (what it may never send, what it may never delete, what needs your sign-off) you have power without protection. Organisations that insist on the room aren't being timid. They're choosing a fence they can inspect over judgement they'd have to trust.
The room · CoworkThe platform's fence: sandbox, folder boundary, plan approval, confirmations.
The keys · Claude CodeYour fence, or no fence. The rules you write are the only walls there are.
The room and the keys
The same four freedoms, side by side. Neither column is the "better" one; they're different answers to the question of who holds the risk.
Four freedoms, two answers
Reach
Where can it go?
The roomOne folder, prepared in advance
The keysThe whole machine, cross-referenced
Tools
What can it wield?
The roomA sealed sandbox; code runs on copies
The keysLive systems; what it does, happens
Memory
What compounds?
The roomStarts fresh; the folder is the memory
The keysRules and lessons persist and compound
Guardrails
Who built the fence?
The roomPlatform-built, inspectable by anyone
The keysYou build them; your rules are the walls
Start in the room
It's the same engine, so everything learned there transfers: briefing clearly, breaking work into pieces, reviewing output before trusting it. Nobody wastes time in the room.
Notice what the walls were doing
Each time the folder boundary stops you (a cross-reference you couldn't make, a system you couldn't touch) note it. Every frustration is also a fence you'd have to design yourself once the boundary is gone.
Take the keys when two things are true
The work genuinely needs the reach, and you can name the fences you'd build first: what it may never send, what it may never delete, what always needs your sign-off. Power before protection is how agents go wrong.
Cowork gives the agent a room. Claude Code hands it your keys. A room is safe because of its walls. Keys are safe only because of the judgement of whoever holds them.