Claude inference hooks: your own server approves every prompt

On November 5, 2026, Anthropic announced a bundle of new security features for Claude Enterprise, and the most interesting of them are Claude inference hooks, which are generally available right away. According to Anthropic’s announcement, Claude sends every prompt and every tool call to the organization’s server and only moves on once it gets an “allow”.

How do Claude inference hooks work?

According to the Help Center, the mechanism has two kinds of checks:

1. Prompt hooks: before Claude starts generating a response, the prompt goes to a server the company hosts. The server checks it against the company’s policies and answers allow or deny.
2. Pre-tool-call hooks: the same happens with every tool call, before the tool runs. This also covers tools called by skills, plugins and connected connectors.

Interestingly, the check runs in Claude’s infrastructure, not on employees’ laptops, so one configuration works across the whole organization: in chat, Claude Code, Cowork and the other Claude Enterprise products. Only the Owner and Primary Owner can turn it on.

Anthropic lists three typical uses: DLP (data loss prevention), real-time conversation archiving and enforcing the company’s own policies. The technical documentation (implementing the endpoint, verifying request signatures) lives in the Claude Platform docs.

What else is new in Claude Enterprise?

The rest of the bundle is in beta. It includes, among other things:

1. Security center, a page in Organization settings that compares the settings of chat, Cowork and Claude Code with the configuration Anthropic recommends. For each control it shows the current value, the recommended value and a status, and it lets us download a PDF report for auditors. The data can also be read through the Compliance API (details in the Help Center).
2. Centralized management: a parent organization gets one console at admin.claude.com for SSO, SCIM, domain verification, groups and Compliance API keys, with support for multiple identity providers.
3. EDR in Cowork: admins can run their company’s EDR (Endpoint Detection and Response) sensor inside the Cowork virtual machine on the user’s computer. Claude checks the signature of the sensor package every time the VM starts.
4. Claude Desktop management without pushing configuration through MDM, including blocking personal Claude accounts on work computers and restricting which folders can be used.
5. A self-service IP allowlist and signing an organization member out on all devices through the Admin API. I covered both separately in the post about the Claude IP allowlist.

What should we watch out for?

First, what the documentation leaves out. The inference hooks page describes “allow” and “deny”, but it doesn’t say what happens when our server doesn’t respond or is unavailable (check the technical docs before hooking it up for the whole company). It also has no numbers and no names of supported DLP vendors.

Second, the limits of the security center. According to Anthropic it is guidance, not a certificate: “guidance based on Anthropic’s recommendations, not a certification or a guarantee of compliance”. The page only shows settings and doesn’t change them, and it can’t read some of them (e.g. those from MDM or a proxy), so someone has to confirm those by hand.

Third, the details of the new features. A centralized management setup can’t be undone, so Anthropic advises deciding first who will be the admin of the parent organization. EDR sensors, in turn, work in detection mode, meaning they report activity but don’t block it, and they cover only the local VM, not Cowork sessions in the cloud.

Is this anything new in AI?

We know hooks from Claude Code: scripts that run, among other moments, before a tool is used. Here the same idea moves up to the level of the whole organization and runs on Anthropic’s side, with nothing to install on employees’ machines. With agents that call tools on their own, that’s a sensible direction, as I wrote in the guide to AI agent security. If we’re just getting into the topic, it’s worth starting with the post on what an AI agent is.

FAQ

Who can use inference hooks in Claude?

Organizations on the Claude Enterprise plan. The feature is generally available, and the Owner and Primary Owner can turn it on and manage it.

Do inference hooks require installing anything on computers?

No. According to the Help Center, the check runs in Claude’s infrastructure, and the company only hosts a server that answers “allow” or “deny”.

Is the security center a compliance certificate?

No. Anthropic points out that neither the page nor its PDF report is a security certificate, just a comparison with the recommended configuration.