The setting was personal. The audience no longer is
"Instructions for Claude" is the box where a user tells Claude how to work for them by default: their role, their writing preferences, the context they are tired of retyping. Cowork's "Global instructions" plays the same role for agent tasks. People write those boxes for an audience of one.
From October 15, that text is retrievable through a new beta endpoint in the Compliance API, the admin tooling Anthropic sells for audit and retention. It returns two fields per member, covering the claude.ai instructions and the Cowork global instructions, together with the member's identifying information.
Who can make that call matters, and it is narrower than "admins". Creating a key and using one are different acts. Primary owners and organisation owners create Compliance Access Keys in claude.ai; an authorised administrator, or a compliance integration holding a key with the read:compliance_user_data scope, can then make the request. The person who wrote the text is not in that chain at all: members hold no key, supply no credentials, and get no say in the call. Coverage also depends on whose key it is. A primary owner's key can reach every linked organisation under the Enterprise parent. An organisation owner's key covers a single organisation.
None of this is hidden. It is in the release notes and the API documentation, in plain language. That is precisely why most affected users will never see it: release notes are read by the admins who gain the access, not by the members who lose the assumption of privacy.
One account, several organisations, no walls between them
The detail that changes the story is a design fact Anthropic documents explicitly: both settings are account-level. They belong to the user's account, not to an individual organisation, so the endpoint does not return an organisation-specific version. It returns the same text under every organisation a member belongs to. That is the documented behaviour, not an inference.
What it means in practice is easy to illustrate. Belonging to two Enterprise organisations is not exotic. A consultant sits in a client's tenant. A researcher holds appointments at a university and a lab. Someone keeps a seat in a former employer's organisation that was never cleaned up. Each of those organisations can now pull instructions the person wrote once, possibly with a completely different employer in mind, possibly containing context about the other job.
Two precisions keep the picture honest. The endpoint is not an indiscriminate export: by default it lists only current members of the queried organisation who have saved at least one of the two settings, and passing include_unset=true extends the list to every current member, with null for each value that is not set. And the access is not invisible inside the organisation: Compliance API calls generate compliance_api_accessed audit events, which administrators can use to audit the calls. What the release notes do not describe is any notification to the member whose text was pulled. Their silence does not prove Anthropic never notifies members through some other channel, and whether a member can independently see a record of the access is a separate question the notes leave open.
Compliance tooling that reaches chats and files is expected; enterprises have retention duties and regulators to answer to, and the Compliance API already covered chats, files and projects before this endpoint existed. Saved instructions are a different category of material. They are closer to a profile the user wrote about themselves — how they work, what they are working on, what to assume about them — than to a work product filed inside one company's workspace. The endpoint treats them as the latter.
The smaller item in the same notes
The same release notes carry a developer change with no catch attached. Fast mode for Claude Opus 5.5 has left research preview. Developers no longer need to request access or send the fast-mode-2026-02-01 beta header for 5.5, and requests that still send it keep working. A default fast-mode rate limit now applies across the Start, Build and Scale tiers, and the mode is available on Azure-hosted Claude in Microsoft Foundry. Fast mode for Opus 5 and Opus 4.8 stays in research preview, header still required. If you run 5.5 in production, that paragraph is the useful part of the release.
What to do with this
If you are a member of a Claude Enterprise organisation, read your saved instructions the way you would read a document your employer can request — because, in beta at least, they can. Personal context, details about other work, and anything written for a different organisation's Claude all sit in the same account-level box. Move what does not belong there out of it.
If you administer one of these organisations, the scope of the key deserves the same care as the access itself. The read:compliance_user_data scope reaches far beyond this one endpoint: the same key can read chats, files, projects, session metadata and transcripts, organisation users and user preferences. That breadth is why Anthropic's own documentation tells customers to handle these keys the way they would production database credentials. Treat that as the operating instruction, not as fine print.
Two things are still open. The endpoint is in beta, so its shape can change. And while administrators can audit Compliance API access through compliance_api_accessed events, the release notes describe no equivalent visibility for the member on the other end of the call. If Anthropic adds one, the privacy calculation improves. Until then, the honest summary is the one in the documentation: you wrote it once, for yourself, and every Enterprise organisation you belong to can now read it back through a key its owners control.
Sources
- [1] Anthropic, Claude Platform release notes, October 15, 2026 entry (primary)Read source
- [2] Anthropic, Compliance API documentation — List organizations, users, roles, groups, and settings ("List user preferences" section) (primary)Read source
- [3] Anthropic, Set up the Compliance API (primary)Read source