A calibrated Cowork deployment is only as good as its enforcement. If employees can modify the skills, rulesets, or prompt context that govern Claude's behaviour, the entire calibration effort is undermined. The solution is straightforward: once the configuration is tested and validated, mark everything as read-only. Skills, rulesets, and prompt context become the deployed configuration — the production environment that employees interact with but don't alter.
The deployed configuration
Think of it like deploying a web application. Developers build, test, and ship. Users interact with the production build — they don't edit the source code. The same principle applies to Cowork. The consulting engagement produces a calibrated configuration. That configuration gets deployed as read-only. Employees use Claude through the lens of that configuration, which includes their role-specific context, available connectors, business rules, and quality standards.
This also creates a clean separation of responsibilities. The business decides what Claude should and shouldn't do. The consulting engagement translates those decisions into configuration. Employees benefit from a system that's been tuned for their role without needing to understand the underlying mechanics.