Someone on your team pastes a client's contract into Claude to get a quick summary. Your security tools would stop that contract going out by email or onto a personal file share, because someone wrote rules for those, but nothing checks what goes into the chat. Can the rules your company already has now check what staff send to Claude, and what will they still miss?

Since 5 November, Claude Enterprise has inference hooks, though Team plans don't. A hook is something that automatically happens when something else happens. Here, each time someone on your staff sends a prompt, Anthropic first sends the conversation to a security server that your company or its security vendor runs. Claude waits for that server to answer allow or deny before it does anything.

The server that answers allow or deny can pass the conversation to the data loss prevention (DLP) scanner your company already has, so the rules it already holds can check Claude too. Anthropic's documentation says that's the most common use. I like the security angle here, especially that hooks can contact the security vendors a company already uses. I think this implementation of hooks is a step up for enterprise security and AI.

Posts from Cisco, Nightfall AI and Metomic said between 3 and 6 November that their products now work with inference hooks. Of the people commenting on the news, Josh McGowan, a systems administrator, asked who owns the recommended baseline and how anyone checks it fits. Kirsten Co, who helps AI companies sell to large firms, wrote that a buyer's security team wants to know what an agent can touch. Arush Gupta, a consultant at Tredence, listed two things he'd test before trusting the hooks: how much delay a check adds to each tool call, and what happens when your server is slow or down.

Reactions on LinkedIn, 6 November 2026.

If the server is down or slow, a setting you choose decides whether Claude blocks everything or carries on unchecked. The check also only sees text. With attachments, your server gets only the text pulled out of them, so a screenshot of that client contract goes through unchecked. Your server can allow or deny but can't edit, so it can't take out a client's name and let the rest through. Anthropic says a small share of tool calls in voice mode aren't sent to your server at all, so don't rely on hooks alone for voice. A blocked message stays in the chat and is sent again with every later message, so staff have to edit it out or start a new chat.

Inference hooks also leave out Claude used through Amazon Bedrock or Google Cloud, and anything that uses Claude's API through the Claude Platform. Only someone with the Owner or Primary Owner role, the two highest roles in your Claude organisation, can switch them on.

Once they're switched on, Anthropic posts each conversation to your server, signed so the server can tell it came from Anthropic, and waits five seconds by default for an answer. If your server says no, the request never reaches the model, and the person sees your server's reason plus a note your admins write, such as who to ask for an exception. Every denial is logged in your organisation's Activity Feed.

One setup covers claude.ai, Claude Code, Cowork, Claude for Microsoft 365, Claude in Chrome and Claude Tag in Slack, with nothing to install on anyone's computer. A setting called Validate tool calls extends the check to connectors, skills and plugins, so a request to read a calendar or send a file can be checked before it runs.

The same server can archive every conversation as it happens, or enforce your own rules, such as which models staff may use and at what hours. Nobody has to be blocked on day one. Shadow mode records what would have been denied without stopping it, and a rollout percentage checks only some requests while your team tunes the rules.

The hooks came with several beta features for admins, including two that matter here. One lets them stop staff signing in to personal Claude accounts in Claude Desktop on company computers. The other, a security center in Organization settings, compares your settings with Anthropic's recommended setup and exports a report for auditors. The report is not a certification.

Made-up situations for illustration. The answers come from Anthropic’s inference hooks documentation.

Does the hook see it?

Your company is on Claude Enterprise and has switched on inference hooks. Assume the hook is on for everyone and your server is working. For each thing your staff do, decide whether the hook checks it, and the reason appears underneath.

Checked0

Your server sees it before Claude acts.

Only sometimes0

It depends on the Validate tool calls setting, or Anthropic doesn’t send all of it.

Not checked0

Your server never sees the content.

  1. Someone pastes a client’s contract into a chat on claude.ai.

    Checked. The prompt goes to your server before it reaches Claude. The answer is Checked. The prompt goes to your server before it reaches Claude.

  2. They attach a screenshot of the contract instead.

    Not checked. Your server never gets the image itself, so a screenshot of a document isn’t inspected. The answer is Not checked. Your server never gets the image itself, so a screenshot of a document isn’t inspected.

  3. They attach the contract as a PDF made in Word.

    Checked. Your server gets the text from the file and checks it like a typed prompt. A scanned PDF is only a picture, so it goes through unchecked, like a screenshot. The answer is Checked. Your server gets the text from the file and checks it like a typed prompt. A scanned PDF is only a picture, so it goes through unchecked, like a screenshot.

  4. A developer pastes customer records into Claude Code.

    Checked. One hook covers Claude Code when it’s signed in to your Enterprise account, as well as claude.ai, Cowork and Claude in Chrome. The answer is Checked. One hook covers Claude Code when it’s signed in to your Enterprise account, as well as claude.ai, Cowork and Claude in Chrome.

  5. Claude uses a connected tool, such as email, to send a file.

    Only sometimes. Only if your admins have switched on Validate tool calls. Without it, the request to send the file isn’t checked before it runs. The answer is Only sometimes. Only if your admins have switched on Validate tool calls. Without it, the request to send the file isn’t checked before it runs.

  6. Someone talks to Claude in voice mode, and Claude uses a tool.

    Only sometimes. Prompts and most tool calls are sent, but a small share of voice tool calls aren’t, so Anthropic says not to rely on hooks alone for voice. The answer is Only sometimes. Prompts and most tool calls are sent, but a small share of voice tool calls aren’t, so Anthropic says not to rely on hooks alone for voice.

  7. Your developers use Claude through Amazon Bedrock.

    Not checked. Inference hooks aren’t available on Amazon Bedrock or Google Cloud. The answer is Not checked. Inference hooks aren’t available on Amazon Bedrock or Google Cloud.

  8. Someone uses their personal Claude account for a work task.

    Not checked. The hook covers your company’s Enterprise accounts. A new setting blocks personal accounts in Claude Desktop on company computers, but it doesn’t stop someone using a personal account in a browser or on their phone. The answer is Not checked. The hook covers your company’s Enterprise accounts. A new setting blocks personal accounts in Claude Desktop on company computers, but it doesn’t stop someone using a personal account in a browser or on their phone.

Nothing sorted yet.

What to do about the gaps

  • Tell staff that screenshots of client documents go to Claude unchecked, so the same rules apply to them.
  • Ask your admins whether Validate tool calls is on.
  • Don’t rely on hooks alone for voice mode.
  • Block personal Claude accounts in Claude Desktop on company computers.
  • If your developers use Claude through Amazon Bedrock or Google Cloud, ask them what checks their prompts there.

This page sends nothing anywhere. Your answers stay in your browser.

How to read this

An inference hook sends each prompt to a security server your company or its security vendor runs, and Claude waits for an allow or deny before it acts.

It only sees text. It covers the Claude apps your staff sign in to with your Enterprise account, and it checks tool calls only when Validate tool calls is on.

Choose an answer for each situation, or drag it onto a box, and the reason appears underneath with the right answer outlined. You can’t change an answer once you’ve chosen it.

If you're on Claude Enterprise, ask your security vendor whether its product supports Claude's inference hooks. Run them in shadow mode first to see what they would block, decide before you switch them on whether Claude stops or carries on when your server is down, and tell staff that screenshots of client documents go to Claude unchecked, so the same rules apply to them. If you're on a Team plan, inference hooks don't cover you, so tell staff what they mustn't paste or upload, and ask your IT provider whether you need Enterprise.

*Kit Library members can print an inference hooks rollout checklist that covers each of these steps.*

AI securityAnthropicClaude