Claude Enterprise Adds "Inference Hooks" — Every Prompt Inspected by Your Own Server First

On August 5, 2026, Anthropic released “inference hooks” for Claude Enterprise. When an organization turns it on, every prompt and tool call response is inspected by the organization’s own security server before reaching the model¹. The decision to allow or block is made by that server, and Claude enforces it in real time¹. The feature covers Claude Enterprise surfaces including chat, Claude Code, and Claude Cowork¹.

When companies roll out generative AI internally, the concern that lingers longest in IT and security is usually how to close the paths by which employees might paste sensitive information into a model. Existing DLP (data loss prevention) products cover email and file sharing, but prompts to an LLM sat outside the inspection point. This feature inserts a synchronous check there.

Previously Limited to Claude Code’s Client-Side Hooks

In the announcement, Anthropic notes that security teams require every channel where employees can move sensitive data to pass through an inspection point their team controls, and that until now native inline enforcement was limited to Claude Code’s client-side hooks¹.

In other words, controls existed on the coding tool, but chat, Cowork, and tool calls made through MCP connectors could not be covered by the same mechanism. Inference hooks is positioned as closing that gap with a single enforcement layer that requires no separate integration work or agent per product¹.

The Model Waits for a Verdict Before Generating

The mechanism is synchronous. When an organization turns on inference hooks, every inference request routes through a signed WebSocket connection to a security server. Before the model starts generating, Claude sends the prompt and its surrounding context to that server, which returns an allow or deny verdict. Claude proceeds only once it has one¹.

The same check runs on tool calls. When Claude calls a tool — including tools connected through MCP, skills, and plugins — the tool’s response is inspected before it is returned to the model¹. Inspection points sit on both the inbound and outbound sides. Where GitHub’s move to let enterprises restrict which MCP servers Copilot can use controls which tools may be connected, this layer looks at what those tools returned.

The inspection logic itself does not live on Anthropic’s side. What gets blocked is decided by the organization’s server, with Claude acting as the enforcement point¹. So this is not a feature that stops sensitive data from leaking by virtue of being installed; it is an additional place where existing policy can be applied.

Point It at the DLP Server You Already Run

What makes deployment realistic is that the protocol is an open, webhook-based one with a published schema. Anthropic says organizations can simply point it at the same server their other tools already report to — Netskope, Palo Alto Networks, Proofpoint, Zscaler — or at an AI security server built in-house¹. Building an inspection server from scratch and adding one destination to an existing DLP stack are very different propositions in terms of internal approval time.

Enabling it once at the organization level applies it across Claude Enterprise surfaces, including tool calls made through MCP connectors, skills, and plugins¹.

There are staged rollout controls as well: shadow mode (always allow), role-based exclusions, and percentage-based rollouts, along with adjustable failure-policy tolerance and timeouts to match an organization’s risk tolerance¹. Switching on a synchronous check across an entire company at once means work can stall when the inspection server fails to respond. The presence of failure-policy tolerance and timeout settings suggests a design that leaves that availability-versus-control trade-off to the organization. Starting in shadow mode, observing what would have been denied, and only then switching to enforcement is the natural sequence.

For security vendors, Anthropic notes that because inference hooks is built on a webhook-based protocol with a documented schema, vendors can build an integration and Claude Enterprise customers can point their organization at that platform¹.

Anthropic includes a customer quote from Andrew Grimmett, Vice President of Information Security at Bandwidth, who says inference hooks adds a checkpoint to inspect what is flowing to Claude in real time, before the model ever sees it, and that this lets the company safely move faster on AI without giving up control¹. That is an adopting customer’s assessment, not a performance evaluation.

A Week Aimed at Compliance Blockers

Anthropic worked on enterprise adoption barriers from another direction the same week. On August 6, self-hosted environments for Claude Code entered public beta, letting sessions started from web, mobile, desktop, or a routine run inside the organization’s own network rather than on Anthropic-hosted infrastructure².

Even with self-hosted environments, though, the conversation itself — prompts, responses, and tool results, which can include code that Claude reads — is sent to Anthropic for inference, and the session transcript is stored². Moving execution in-house does not keep the contents that reach the model inside. Inference hooks is the means of inspecting those contents, and the two announcements complement each other.

How much latitude to give agents has been a recurring question for months. Cloudflare’s proposal to give agents an identity and a spending cap governs behavior; Claude Code making auto mode the default on August 14 shifts approval design to a classifier. Inference hooks sits on a different layer from either: the contents entering the model.

For now, inference hooks is in beta for Claude Enterprise customers, with no general availability date given¹. Configuration steps are in Anthropic’s documentation.