Anthropic has moved enterprise AI traffic control from an afterthought to a gate. Inference hooks, announced as generally available in a November 5 Claude Enterprise security update, let organizations route every governed prompt through their own AI security server, including existing data loss prevention infrastructure, before the model runs. Until now, inline enforcement existed only as client-side hooks inside Claude Code.
Two hook events are covered. The prompt hook fires once per governed inference request, before the model starts. The tool_call hook fires when the response of Claude contains tool calls, before any of them execute, when the "Validate tool calls" setting is on, and a single verdict covers all tool calls in that response. Anthropic sends the conversation transcript to the customer-operated HTTPS service, signed under the Standard Webhooks specification once a signing secret is generated, and the server must return an allow or deny verdict within a default timeout of five seconds. A deny never reaches the model; the user sees a blocked-by-policy message built from the per-request deny reason plus a standing administrator message. There is no rewrite or redaction option: verdicts are allow or deny only.
The visibility boundaries are explicit. The security server sees transcript text, tool calls and results, and text extracted from attachments. It does not receive raw file or image bytes, system prompts, or Anthropic-internal context, which means a screenshot of a confidential document remains a known blind spot because image-only content is not fully inspected.
One hook configuration governs the enterprise surface area in a single stroke: claude.ai chat, Claude Code, Cowork, Claude for Microsoft 365, Claude Tag and Claude in Chrome, across web, desktop, mobile, CLI and Slack. The hooks are scoped to Claude Enterprise organizations and are not available on Amazon Bedrock or Google Cloud, and configuration requires the organization:manage permission held only by Owner and Primary owner roles.
Anthropic has built in the rollout controls security teams usually demand before enforcement goes live. Shadow mode logs verdicts without blocking anything. A rollout percentage can inspect only a slice of traffic, and role-based exclusions can skip specific members such as the red team. If the AI security server is unreachable, errors or times out, a failure-handling setting either blocks or allows the request, and sustained failures trip a circuit breaker until the endpoint recovers.
The same November 5 package bundled the surrounding apparatus. A security center in beta compares the settings of the organization for chat, Cowork and Claude Code against Anthropic recommendations, with attestations and auditor-ready reports, readable through the Compliance API where licensed. A centralized parent admin console in beta at admin.claude.com consolidates SSO, SCIM directory sync, domain verification and groups across child organizations, alongside an admin API for ending member sessions, self-serve IP allowlisting and desktop controls that can block personal accounts on managed machines. EDR sensors from CrowdStrike, SentinelOne and Tanium can now run inside the isolated Cowork VM in detection mode, closing a monitoring blind spot for shell commands and file access that agents execute there.
Commercially, the gap Anthropic just closed was one Microsoft and Google left open for years: Microsoft Purview has offered equivalent inline hooks for Teams and Copilot, and Google Workspace DLP covers Gemini. Third-party DLP vendors including Netskope, Palo Alto Networks, Proofpoint and Zscaler are compatible, and several have already published Claude connectors. The long-standing enterprise objection that "we cannot control what employees send to the chatbot" is now technically answered. Whether organizations actually deploy the gates, tune the rules and live with the false positives is an execution problem rather than a product gap.
Comments (0)
Log in to join the discussion
Log InNo comments yet