By the end of this chapter you will be able to create a bounded folder and access plan , the practical setup that tells Cowork exactly what it may see, what it may create, and what it must not touch.

The archive-originals-not-for-cowork/ folder in this diagram is not granted to Cowork. It represents the originals you kept elsewhere on your machine. Its label is a reminder, not a grant. Cowork does not need to see this folder and should not be given access to it.