An AI content partner shows you neatly separated client folders and quickly generates a product script. Your team, working with a China supplier, is considering uploading unreleased specifications and launch materials. Before approving, ask which clients’ files the service can actually read while running your task.
ONCE recommends assessing organization and authorization separately. A folder name describes where material sits. Credentials, server-side permissions and actual execution determine whether it can enter a particular job.
What one documented API rule establishes
Claude Platform’s Files API documentation says files are workspace-scoped, rather than scoped to an end user, conversation or session. API keys with access to that workspace can access its files. For multitenant applications, it recommends a separate workspace per tenant and appropriately scoped keys.
Checked November 1, 2026, this is a specific API rule, not a statement about every Claude product or AI provider. It does not demonstrate a leak at any agency. This article uses existing documentation for an evergreen purchasing analysis, not as a new-launch announcement.
The practical question is what “separate” means in a proposal: different interface folders, application permissions or underlying resources and credentials. Ask the implementation owner to explain and demonstrate the actual restriction.
The ONCE identity, input and destination check
| Check | Question | Useful record |
|---|---|---|
| Job identity | How is the client established, and can supplied text change it? | Verified client association and execution account, without secret credentials |
| Permitted inputs | Do credentials, file mappings and retrieval scope match the approved material? | File identifiers actually used, authorization decision and rule version |
| Output destination | Do generated drafts, caches, exports and background jobs retain the correct client association? | Result owner, recipient and approval for any sharing exception |
This is ONCE’s proposed procurement record, not a claim that a platform supplies every field automatically. The technical owner should identify available evidence and gaps. Keep necessary identifiers and decisions rather than copying confidential source content into another log.
A prompt asking the model not to mention other clients is a task instruction, not a substitute for access controls. A clean final answer alone does not show that unauthorized material never entered the model context.
Use synthetic clients for acceptance
Ask the authorized implementation team to create two fictional clients with clearly different, entirely synthetic product documents in an approved test environment. The following are proposed checks, not tests or an audit performed by ONCE:
- Normal access: a client A task can use A’s approved test document and produces an A-owned result.
- Cross-client reference: supplying B’s test file identifier in A’s test request is rejected or excluded before unauthorized reading, rather than hidden only in the final response.
- Background work and export: batching, retries and exports preserve A’s identity and permitted inputs.
- Unknown identity: missing client association stops processing or goes to an owner for review, instead of falling back to an account with access to every client.
For an implementation using Claude’s Files API, the demonstration should also cover the separate workspaces and scoped keys recommended in its documentation. Two folders on a screen do not demonstrate that arrangement. Record expected and observed behavior with the owner’s explanation. Passing a small test set is not proof of a defect-free system; revisit affected paths when adding tools, connectors or asynchronous jobs.
Separate reusable methods from client-specific knowledge
A production company can build reusable value from its own filming methods, generic shot structures, blank briefs and approved public examples. Unreleased specifications, launch plans and exclusive assets do not become shared material merely because they would improve another job.
In a hypothetical example, one electronics brand’s unreleased feature notes help generate another brand’s script. The issue is not limited to whether the final wording was copied. Permission to bring those notes into the second task is a separate question. This is not an actual client incident.
Define the source, permitted purpose and sharing scope for common resources. Make public and client-specific material distinguishable in the system. Reuse approved methods and assets rather than merging all project inputs into a larger context.
Buy maintained separation, not just generation volume
Request separate scope for client environment setup, identity and file mapping, acceptance testing, ongoing maintenance and checks after connector changes. Use actual supplier estimates; this article supplies no market price or savings claim.
A dedicated environment still needs an owner for cross-client service accounts, exported files and external storage. Clarify permission handling when staff or projects leave. Access isolation, retention and permission to use content are separate questions; a read-access test settles only its agreed scope.
For ONCE’s longer-term move toward managed content services, the analytical implication is that client association must be maintained as workflows scale. More files alone do not establish a better service. Its AIGC articles explore AI content workflows, while its production analysis helps define the assets being entrusted to them.
For the next supplier demo, request both successful authorized access and blocked cross-client access using synthetic material. Then ask how background generation and export preserve the same restriction before handing over unreleased brand inputs.
Source and limits
Claude Platform Docs, Files API, checked November 1, 2026; exact publication date not established. The three checks, synthetic test suggestions and procurement scope are ONCE’s analysis. No account was tested and no supplier is certified by this article.
