Claude documents November 4 publishing-default change for some Enterprise skill libraries
Claude’s current organization-skills documentation describes a November 4 change to the default publishing policy for some Enterprise organizations. If an organization has not selected its own policy and has skill and plugin security scanning enabled, its default changes from Requires review to Open. This is a conditional default change, not a mandate for every organization to allow unreviewed publishing.
Anthropic says organizations that have already chosen a setting keep that choice. Administrators who want to review every submission can explicitly select Requires review before the change. Users whose custom role does not permit publishing to the whole organization still go through review, even under the described default change.
The documentation distinguishes three publishing settings. Requires review sends each submitted version to an owner for approval. Open lists submitted items without owner review, while eligible Enterprise organizations wait for the automatic security scan first. Off removes the publishing option for users but does not delete items already in the library.
Organization-wide skill management is available on Team and Enterprise plans, but group-specific distribution through plugins is described for Enterprise. Owner-provisioned skills are enabled by default and users can turn individual ones off. That differs from a separate Required offering available when administrators manage inventory; not every provisioned skill is automatically mandatory.
Security scanning is not available for organizations using customer-managed encryption keys, zero data retention or HIPAA configurations. The help page also says duplicate checks do not run for HIPAA, zero data retention, FERPA or customer-managed-key organizations. These are different limitations and should not be collapsed into a claim that every automated check has the same exclusions.
The page says skills require cloud code execution and that skills available under the described HIPAA configuration are not covered by the organization’s BAA. Administrators should check their own policy and regulated-use terms before distributing workflows. The page is labeled updated this week, so this brief reports the current November 4 notice rather than asserting an independently verified October 26 product-launch date.