A library Desktop Claude workspace needs local catalog plugins that a public web FAQ bot should not load. What design choice fits?

Plugin surfaces must match who is operating the assistant and what data that surface may touch. Matching catalog plugins to the staff Desktop Claude workspace—not the public library FAQ bot—works because local catalog connectors are appropriate for authenticated staff with folder access, while a public web bot should not load the same privileged local capabilities. Library IT can enable productivity plugins where librarians work and still keep the anonymous FAQ channel on a narrower tool set. Publishing the staff catalog plugins to the organization catalog for reuse fails because it extends privileged local connectors beyond the staff Desktop and can make them available to the public FAQ bot or other unauthorized surfaces. Connecting the public FAQ bot to the local catalog folder with file access fails conceptually: it gives anonymous public traffic direct file-system reach into staff catalog data, which should remain off-limits to the FAQ channel. Managing staff Desktop plugins from the public FAQ bot admin panel fails as a control-boundary error; it lets the public FAQ admin surface govern staff local plugins instead of keeping plugin assignment scoped to the staff Desktop workspace. Exam caveat: "Desktop" convenience does not equal "safe for public," and publishing staff plugins to the organization catalog for reuse is not a security goal when roles differ. Operational check: maintain a per-surface plugin allow-list for library systems, document which catalog connectors attach only to staff Desktop, and verify in staging that the public FAQ bot cannot invoke those local plugins.