The agent workspace

What you'll walk away with: what an agent is made of — you already own three of the four parts — and the two things you read on every run: the steps, and the place it stops to ask.

You need: both tabs, about 20 minutes, and one small body of your own material with a clear end — the folder from lesson 16 if you made one, or three documents you could forward outside the firm. Nothing that sends, posts, pays or deletes. If a tab has no surface that runs a task like this, the run written out on the page stands in. Nothing to install.

First, thirty seconds of retrieval — from memory, not from the page: what happens behind every "the AI checked something" moment? Say it, then check it against lesson 14: the model writes a request, the app runs it, the window receives — and the receipt is the only thing that separates a step that ran from a sentence saying one did. Every lesson so far has had you pressing send, once, and reading what came back. This one is the same window with the send pressed by software, many times in a row — and what you read is the same, multiplied: every step's receipt, and every place it stops to ask.

Four parts, and you own three

The window. A run works from lesson 03's complete list, and nothing outside it exists.

The instructions. What moved a reply off the average in lesson 09 — name the audience, force the format, ban the hedge — steers every step of a run, written once instead of typed each time. Both products let you save that file of instructions and switch it on by name — GPTs (ChatGPT) · Skills (Claude) — and it is the same window text either way. Nothing here asks you to build one.

The reach. Lesson 14 built it: a connector renders what a tool holds into text the window can read and turns a request into an action the tool performs, and the permission you grant decides what can change.

The loop — the fourth part. Software hands the window its own next prompt. A step's result arrives as text in the window; the next request is written from a window that now contains it; and that repeats until the software ends the run or you stop it. No new door opened between step one and step nine — the window grew. So every reading you already have applies to step nine: lesson 07 on a long pile, and lesson 10 on a completion taking the shape of the hole.

What an agent is says all four in one line.

Both products name a surface where that assembly runs against your own apps and files: the agent workspace — Work (ChatGPT) · Cowork (Claude). Menus move, what is on offer moves, and what your account opens moves; look for the nearest control that starts a run rather than answers a message.

What a step leaves behind, and where it stops

Each step in the loop is the fork lesson 14 drew: a request that ran and a result that arrived as text — or a sentence saying one did. A run's closing summary is prose about the steps; the steps are what happened. So open them, and read what was asked for and what came back before the summary. No receipt, no action — lesson 06's rule for lookups, pointed at doing.

A run that narrates a step you cannot open is unread, not untrustworthy. The move is to ask for the same thing in a way you can see — one step, its result shown — or to do that one step yourself.

Then the gate. The loop stopping to ask is the one moment the software stops pressing send and waits for you. Read first, write after trust, and keep an approval step on anything that leaves your account — connectors and MCP's rule, made a move on a run: let it read; let it write where you can see the result; put the gate on anything that goes out; and decline the first permission you are not sure about, to find out what the run does without it. Where a tab offers no place to ask, the gate is still yours: keep the run to reading and writing where you can see, and do the sending yourself.

A run you can stop is a run you can predict, then check — the loop is software, and the stop is yours. Find the control that stops one before you start one.

Do this in ChatGPT and Claude

Setup. A task whose worst outcome is a file you delete afterwards, and an instruction of this shape:

Read every file in the folder [its name] and write one file, summary.md, listing what is still open. Change nothing else, and ask me before you write.

Predict first, in writing, three things: how many steps; which files or tools it will touch; and where it will stop to ask.

If your tab runs it — five moves.

Move 1 — start the run with the instruction above, and watch the steps arrive. Each one is a request and a result.

Move 2 — open every step and read the receipt against what you predicted: what was asked for, what came back. Do not read the summary first.

No steps shown at all. Treat the run as unread, and ask for the same thing one step at a time, where you can see each result.

Move 3 — find the ask. When the run stops for a permission, read what it is asking to do: that sentence is the only place the reach is written down. If it never stops to ask, keep it to reading and do the sending yourself.

Move 4 — decline one you are not sure about, and read what changes next.

It asks for a permission you will not grant. Decline, and read what follows: a narrower ask, a step that does not run, or a stop. All three are readable, and a decline is data, not a failure.

Move 5 — stop the run once, deliberately, part-way — then compare the three predictions against what happened. If you cannot find a stop, keep the run to reading, and find the control before you start the next one.

A step you did not expect. The prediction did its job; the fix is the sentence you wrote, not the machine.

If your tab does not. The run below is SIMULATED — shaped like the one just described, written out so you can practice reading steps; nothing ran to produce it, there is nothing to paste, and none of it is a claim about what your account would do. Before you read its steps, predict from the Told to line alone: which steps are licensed, and where must the run stop?

SIMULATED RUN — nothing here ran in your account; do not paste it

Told to: read every file in the folder weekly-notes and write one file, summary.md, listing what is still open. Change nothing else, and ask before writing.

Step 1 · read folder weekly-notes — returned: two file names.

Step 2 · read file weekly-notes/mon.md — returned: its text.

Step 3 · read file weekly-notes/tue.md — returned: its text.

Step 4 · read file archive/old-plan.md — returned: its text.

Step 5 · write file weekly-notes/summary.md — waiting for your approval.

Now read. Steps 1 to 3 are the instruction. Step 4 is a file the instruction never named — and the folder listing never returned — the shape the prediction exists to catch. Step 5 is the gate, on the only step that changes anything. The move for step 4 is the sentence you wrote, not the machine: lesson 09's moves, written once — the folder named, and what is out of bounds named beside it.

No surface in either tab. The read above is the lesson, and the three moves — predict, open the step, find the ask — run on any labeled step you already have, including the tool step lesson 14 had you open.

Then the same five moves in the other tab. What repeats across both is the shape you can plan around; where the two differ, that is one product's surface on one day, not a rule for next month — which is why the move you keep is open the step, not a preference between two surfaces. No surface in the second tab: read the block above again, with your own instruction in its place.

---

Check your understanding: you open the steps of a finished run. It was told to read the folder client-notes and write one summary file inside it. Step 1 read client-notes. Step 2 read personal/rates.md. Step 3 wrote client-notes/summary.md. Step 4 sent the summary to an address it found in one of the files. Which step read outside the folder it was given, and which one needed your hand on it before it ran?

Check yourself first — then open one good answer+−

Step 2 went outside the instruction: it was told one folder and read a file in another. The fix is the one lesson 09 gave you, written once: name the folder, name what is out of bounds, and say what to do when something looks relevant but was not named.

Step 4 is the one that needed the gate. Steps 1 to 3 read and wrote inside your own material, where a mistake is a file you delete. Step 4 left your account, where a mistake sits in someone else's inbox and you cannot take it back. Read first, write after trust — the order lesson 14 gave you — and the gate on anything that goes out.

Your answer should have hit step 2 as the overreach — with the instruction, not the machine, as the fix — and step 4 as the one that needed the gate, because it is the one that left your account.

Use this the first time you let a run touch your own material. Write the prediction first, open every step, and keep the gate on anything that leaves your account. Next: The coding agent — the same window with hands on your computer, and the diff you read before anything is kept.