Anthropic Adds Saved Claude Instructions to Enterprise Compliance API
A beta endpoint gives scoped compliance-key holders access to current members' account-level instruction text from claude.ai and Cowork, widening audit visibility without proving how those preferences were applied.
Edited by Tyronne Panaino
Anthropic added a beta user-preferences endpoint to its Compliance API on October 15, 2026. The official release notes say it can return text that organization members saved as Instructions for Claude in claude.ai and as Global instructions in Cowork. The change is aimed at Claude Enterprise compliance workflows and matters to administrators who need to understand user-level configuration alongside chats, sessions and organization settings.
The release expands visibility; it does not show whether a saved preference was applied to every conversation or whether it changed a model's output. Anthropic's documentation describes what the endpoint returns and who can call it, while this run found no independent test of a live Enterprise tenant.
What the endpoint returns
Anthropic's organization-data documentation identifies two response fields: `conversation_preferences` for claude.ai instructions and `cowork_global_instructions` for Cowork. The endpoint lists current members of one organization and is in beta.
Those preferences are account-level settings. Anthropic says the same saved text is returned under every organization to which a member belongs. A compliance integration that aggregates several linked organizations therefore needs to recognize that repeated records can describe one member-level value rather than separate organization-specific instructions.
The default response includes only current members who set at least one of the two values. Callers can request unset members as well, restrict a request to as many as ten user IDs, and paginate results with a default page size of 20 and a maximum of 100. These controls support targeted review and organization-wide enumeration, but the page does not present the endpoint as a historical change log.
Access depends on a broad user-data scope
The endpoint requires `read:compliance_user_data`, not the narrower organization-data read scope. Anthropic's Compliance API setup guide says that permission also covers chats, messages, files, projects, session metadata and transcripts, organization users and group membership. The practical access decision is therefore broader than permission to read saved instructions alone.
Anthropic distinguishes a full Compliance Access Key from an Admin API key. Claude Enterprise owners create Compliance Access Keys in claude.ai, while Admin API keys can reach only the Compliance API Activity Feed. The organization-data page says calls to the user-preferences endpoint with an Admin API key return a forbidden response.
The setup guide advises organizations to choose the smallest scope set their integration needs and to protect Compliance Access Keys as production credentials. That guidance is especially relevant here because the same read scope reaches several kinds of user content. Teams evaluating the endpoint should separate the operational need to inspect preferences from who can hold the key, which linked organizations it covers and where retrieved text is stored downstream.
What the new visibility does and does not establish
Saved instructions can help a reviewer reconstruct one layer of a user's Claude configuration. They are not, by themselves, evidence that a particular response followed those instructions, that other system controls did not override them or that the stored value was unchanged over time. The fetched documentation does not publish propagation timing, preference-version history or an independent audit of the endpoint.
The next verifiable checkpoint is a controlled Enterprise test: set a known preference, retrieve it with a correctly scoped key, confirm organization and member mapping, and check how the result is recorded in the organization's audit pipeline. Until that evidence exists, the confirmed change is the beta retrieval capability and its stated access boundary, not end-to-end compliance assurance.
Status
Confirmed. Internal confidence is medium. Three official Anthropic documentation pages establish the October 15 release, response fields and access requirements, but this run did not test a tenant, key, returned value, audit event or downstream integration.
Sources
- Anthropic — Claude Platform release notes
- Anthropic — Compliance organization data
- Anthropic — Compliance API setup
Update note: Last reviewed 2026-10-16. We will revise this post if Anthropic changes the endpoint's beta status, scope requirements, returned fields or organization coverage.
Sources
- Anthropic — Claude Platform release notes — official
- Anthropic — Compliance organization data — official
- Anthropic — Compliance API setup — official
Drafted with AI assistance from source briefs; reviewed for citation completeness and label accuracy.