Anthropic launched inference hooks on August 5, 2026, a beta feature for Claude Enterprise that routes every employee prompt through the organization’s own security server for an allow-or-deny verdict before the model ever sees it. The system, described in Anthropic’s announcement, extends the kind of inline data loss prevention that security teams already run on email and web traffic to chat, Claude Code, and Claude Cowork sessions, with a single organization-level configuration.
Until now, Anthropic’s only native inline enforcement lived in Claude Code’s client-side hooks, which run on the user’s machine. Inference hooks moves the checkpoint onto Anthropic’s servers, after a request leaves the client and before inference runs, so one control covers every governed surface with nothing installed on user devices.
How the enforcement path works
When a user on a governed surface submits a prompt, Anthropic sends the conversation transcript to the organization’s security server over a signed connection and waits for a verdict. On an allow, inference proceeds. On a deny, the request never reaches the model, and the user sees a blocked-by-policy message built from the reason the security server returned plus a standing notice the organization’s administrators configure, such as where to request an exception. Every denial lands in the organization’s Activity Feed.
The same inspection runs on tool calls. When Claude invokes a tool, including tools connected through MCP connectors, skills, and plugins, the tool’s response is checked before it goes back to the model. That closes the other half of the data-movement problem: sensitive material entering a conversation from a connected system, not only what an employee pastes in. Tool responses have become a watched attack surface for exactly this reason, since they carry data into the model’s context from outside the organization’s perimeter, as recent research into agent sandbox escapes has underlined.
The verdict itself is a small JSON object, and the server must answer within a configurable timeout, five seconds by default, per the product documentation. Requests are signed under the Standard Webhooks specification once the organization generates a signing secret, so the security server can verify the traffic genuinely came from Anthropic.
The security server sees transcript text, tool calls and their results, and text extracted from attachments. It never receives raw file or image bytes, system prompts, or tool definitions. Ancillary requests like conversation title generation skip the endpoint, and voice mode is not covered.
Built to sit in front of the existing DLP stack
Anthropic is not selling the scanning engine. The protocol is webhook-based with a published schema, and the announcement names Netskope, Palo Alto Networks (PANW ), Proofpoint, and Zscaler as destinations organizations can point the hook at, alongside in-house servers. Security vendors can build integrations against the documented schema and have mutual customers route verdicts to their platforms. The architecture inverts the usual DLP deployment: instead of the vendor’s appliance chasing AI traffic on the network, the AI provider calls the vendor’s verdict API on every request. Check Point took the mirror-image approach days earlier, moving AI prompt inspection into its firewalls so the network layer intercepts model-bound traffic.
Rollout controls acknowledge that blocking employees on day one is how DLP programs die. Shadow mode observes verdicts on live traffic without blocking anything, a rollout percentage inspects a chosen fraction of requests, and exclusions exempt members of chosen roles entirely. If the security server is unreachable, errors, or blows the timeout, the organization chooses the failure posture: block the request, or let it through uninspected.
The documentation lists DLP as the most common deployment but describes three others: real-time transcript archival as a push-based alternative to polling Anthropic’s Compliance API, prompt telemetry captured at the moment of use, and custom policy engines enforcing rules like model allowlists or project-scoped restrictions before inference.
What the beta does not cover
The documentation’s stated limits define the current envelope. Verdicts are binary: the server can allow or deny a prompt, but cannot rewrite or redact one. Attachments arrive as metadata and extracted text, so image-only content, a screenshot of a document, for example, goes uninspected. The only hook event at launch fires on the prompt before inference; response-side enforcement, checking what the model returns, is planned as a later event. And the feature governs Claude Enterprise surfaces only: API access through the Claude Platform is out of scope, and organizations running Claude on Amazon Bedrock or Google Cloud get nothing.
That leaves the inspection-point contest with two live models. Network-layer controls see whatever crosses the wire but strain against encrypted, dispersed AI traffic; provider-side hooks like this one see exactly what the model would see, but only inside one vendor’s perimeter. The documentation limits hooks to Claude Enterprise surfaces and excludes Bedrock and Google Cloud, while Check Point’s firewall approach inspects traffic at the network layer.
Inference hooks is available in beta to Claude Enterprise organizations, with configuration gated behind the organization’s admin roles. The prompt event is live across claude.ai, Cowork, and Claude Code sessions on the web, desktop, and CLI, and Anthropic’s documentation frames response-side enforcement as the next checkpoint to arrive.
