Claude Inference hooks are generally available for Claude Enterprise as of November 5, 2026. Anthropic routes governed prompts—and optional tool calls—to your HTTPS AI security server for an allow or deny verdict before the model runs, with shadow mode and percentage rollout for safe enablement.
Last updated: November 7, 2026
Table of contents
- What shipped on November 5, 2026
- How Inference hooks work
- How to enable and enforce safely
- Building the AI security server
- Limits, exclusions, and related controls
- Frequently asked questions
- Sources
What shipped on November 5, 2026
Anthropic’s Claude Enterprise security update made Inference hooks generally available: prompt hooks check prompts before inference, and pre-tool-call hooks check tool calls before they run. Owners and Primary Owners manage them for Enterprise plans covering Claude, Claude Code, Cowork, and other Claude Enterprise products.
The same day also shipped a Security Center (beta), centralized management at admin.claude.com (beta), Admin API sign-out and self-serve IP allowlists (beta), Claude Desktop shadow-IT controls (beta), and EDR in the Cowork local VM (beta). This guide focuses on Inference hooks—the GA control that changes live prompts and tools. Related reading: Claude Personal Finance, Claude Code 2.1.318, and Claude Message Threads.
| Capability | Status (official) | What it does |
|---|---|---|
| Prompt hooks | Generally available | Inspect governed prompts before inference |
| Pre-tool-call hooks (Validate tool calls) | Generally available; on by default in a new config | Inspect tool calls before they run |
| Shadow mode / rollout % | GA with hooks | Observe or sample before full enforce |
| Security center | Beta | Compare org settings with Anthropic recommendations |
| Centralized management / IP allowlist / Admin API sign-out | Beta | Parent console and access controls |
| EDR in Cowork VM | Beta (macOS/Windows) | Run your sensor inside the local VM |
How Inference hooks work
According to the platform overview, a user submits a prompt on a governed surface. Anthropic POSTs the conversation transcript to your organization’s configured HTTPS AI security server. Requests are signed with the Standard Webhooks scheme once you generate a signing secret. Your server must return a verdict within the configured timeout (default 5 seconds). {"action":"allow"} continues inference; {"action":"deny","deny_reason":"..."} blocks the request and shows your reason plus an optional standing admin message. Denials appear in the Activity Feed.
The hook runs on Anthropic’s servers after the client request and before the model, so nothing installs on employee devices. Your server sees transcript text, tool calls and results, and extracted attachment text—not raw file or image bytes, system prompts, or Anthropic-internal context. Verdicts are allow or deny only; rewriting or redacting a prompt is not supported. Claude Platform API organizations are out of scope. Related API reading: Claude API version 2026-10-21 and Grok API watermarking for other vendor-side output controls.
With Validate tool calls on, a tool_call frame fires before tools run. One verdict covers the whole frame. Some claude.ai-owned tools may be omitted from that frame; the next prompt frame still includes them in the conversation. Voice mode also sends prompts and tool calls, but a small share of tool calls may be skipped, so do not treat hooks as the only voice control.
How to enable and enforce safely
- Confirm you are an Owner or Primary owner on a Claude Enterprise organization (organization:manage).
- Host a public HTTPS endpoint on port 443 that Anthropic can reach without redirects. Private, localhost, IPv6-only, and reverse-tunnel hosts (ngrok-style) are refused.
- In claude.ai → Organization settings → Data and privacy, turn on Allow for Inference hooks. That unlocks settings and forces Enforce verdicts off until you are ready.
- Configure the Endpoint URL, copy the one-time signing secret, add up to 16 static request headers if needed, and run Test connection.
- Set Failure handling (Allow the request, Block the request, or Shadow mode) and Prompt verdict timeout (1–10,000 ms; default 5,000).
- Optionally set Requests inspected (%) and role exclusions or Only selected roles, then turn on Enforce verdicts. Allow about a minute for the change to propagate.
The configuration docs recommend Shadow mode first so your DLP policies see real traffic without blocking anyone. Endpoint health shows status, failures per minute, block rate, circuit-breaker trips, and recent errors (webhook_error vs relay_error). After a trip, fix the server and turn Enforce verdicts back on, or wait for automatic recovery checks that start about 10 minutes later.
Building the AI security server
The integration guide defines two frame types: prompt (full transcript up to inference) and tool_call (latest assistant message with tool_use blocks and tool_info). Always respond HTTP 200 with a JSON verdict—non-200 statuses are webhook failures, not denials. Drain large bodies (protocol allows up to 64 MiB; raise reverse-proxy body limits). Verify webhook-id, webhook-timestamp, and webhook-signature with HMAC-SHA256 over raw body bytes and a standard base64-decoded whsec_ secret. Deduplicate on webhook-id. Anthropic retries once after a connection failure with the same id. Source IPs for these calls include 160.79.106.0/24; allowlisting helps but does not replace signature checks.
Common use cases listed by Anthropic: DLP scanning, always-allow real-time archival (push alternative to polling the Compliance API), prompt telemetry, and custom policy engines (model allowlists, project rules, working hours). Write deny_reason for end users (max 500 characters). After a deny, users must edit or remove the blocked content before later turns succeed—claude.ai edit, Claude Code /rewind, Cowork edit or New task, or Claude Tag edit plus @Claude !restart.
Limits, exclusions, and related controls
Image-only attachments are not inspected (metadata and extracted text only). Unrecognized future hook event types should return allow, not an error, to avoid tripping the circuit breaker. Built-in roles cannot be excluded; only custom roles. Requests with no member behind them (for example some API-key or Claude Tag Slack cases under Only selected roles) may not be inspected. Hosted Claude Security scans, Code Review research-preview reviews, and smart-report model calls are not governed as Inference hooks requests, though user sessions that act on findings can be.
Pair hooks with the beta Security Center for configuration review and the Compliance API for after-the-fact audit. Enterprise pricing is not restated on the Inference hooks pages. For consumer plan cost context, see How much does Claude Pro cost?.
Frequently asked questions
What are Claude Inference hooks?
Inference hooks let a Claude Enterprise organization send every governed prompt to an AI security server you operate before inference runs. Your server returns allow or deny; a deny never reaches the model. Prompt hooks and pre-tool-call hooks are both generally available as of November 5, 2026.
Who can turn on Inference hooks?
Only Claude Enterprise organizations. Configuring them in claude.ai requires the organization:manage permission, which only the Owner and Primary owner roles hold. The Admin role does not have it.
What products do Inference hooks cover?
One hook governs conversations across Claude products in your Enterprise organization, including claude.ai, Cowork, Claude Code, Claude for Microsoft 365, Claude Tag, and Claude in Chrome on web, desktop, mobile, CLI, or Slack. They are not available on Amazon Bedrock or Google Cloud, and Claude Platform (API) organizations are out of scope.
How do I roll out without blocking users on day one?
Use Shadow mode under Failure handling so your server receives live traffic and returns verdicts while nothing is blocked. You can also set Requests inspected (%) from 0 to 100, exclude or inspect only selected custom roles, then switch Mode to Allow or Block the request when ready.
What happens if my security server is down?
Failure handling decides: Block the request (fail closed) or Allow the request (fail open). The default Prompt verdict timeout is 5,000 ms (1–10,000 ms). Sustained webhook failures attributable to your server trip a circuit breaker; Anthropic stops contacting it and applies your failure handling until recovery.
How does this differ from the Compliance API?
Inference hooks act inline before inference and allow or deny each governed request in real time. The Compliance API retrieves activity, chats, files, projects, session transcripts, and users after the fact for audit and export. Use hooks to stop a request; use the Compliance API to audit what occurred afterward.