Anthropic adds inline DLP to Claude Enterprise with inference hooks
Inference hooks routes every Claude Enterprise prompt through your organisation's security server for an allow-or-deny verdict before Claude ever sees it.
On 5 August 2026, Anthropic launched inference hooks, a beta feature for Claude Enterprise that puts your organisation’s own security server directly in the path of every employee prompt, before Claude processes a single token.
The idea is straightforward. When a user submits a prompt, Anthropic sends the conversation transcript to an HTTPS endpoint you control, and waits for a verdict. Allow, and inference proceeds normally. Deny, and the request never reaches the model. The user sees a blocked-by-policy message, and the denial is logged in your organisation’s Activity Feed.
This is the same kind of inline enforcement your security team already runs on email and web traffic. Inference hooks brings it to Claude.
What gets covered
The hook fires across every Claude Enterprise surface from a single configuration: claude.ai chat, Claude Code, Claude Cowork, MCP connectors, skills, and plugins. Previously, the only native inline enforcement Anthropic offered lived in Claude Code’s client-side hooks, which ran on the user’s machine and covered only that one surface. Inference hooks moves the checkpoint onto Anthropic’s servers, so one control applies uniformly, with nothing to install or manage on user devices.
The hook also fires on tool call responses. When Claude calls a tool connected through MCP, a skill, or a plugin, the tool’s response is checked before it comes back to the model. That matters because sensitive data does not only flow in through prompts; it can also arrive via the tools Claude is reaching out to.
How it works technically
Anthropic sends a signed HTTPS POST to your configured endpoint. The request body carries the conversation transcript and is signed using the Standard Webhooks specification, so your server can verify the request genuinely came from Anthropic. Your server evaluates the content and responds with a verdict within a configurable timeout, which defaults to five seconds.
Verdicts are binary. Your server can allow or deny a request, but it cannot rewrite or redact it. If you need to block a prompt, it is blocked in full.
A few things are worth noting about what gets sent. Attachments are represented by metadata and extracted text only; raw file and image bytes are never transmitted. That means image-only content, such as a screenshot of a document with no extracted text, is not inspected by the hook.
On the current beta, the only hook event is prompt, which fires once per governed request before inference begins. Response-side enforcement, covering what Claude sends back to the user, is planned as a future addition.
Rolling it out without disruption
Anthropic has built in a few mechanisms to make rollout manageable. Shadow mode lets you observe verdicts on live traffic without blocking anything, so you can validate your server’s behaviour before enforcement goes live. A rollout percentage lets you inspect a chosen fraction of requests rather than flipping the switch for everyone at once. Role-based exclusions let you exempt specific groups entirely, which is useful if you have a set of users whose work genuinely cannot tolerate the added latency.
Failure handling is also configurable. If your security server is unreachable or times out, you can decide whether the request should fail open or fail closed depending on your organisation’s risk tolerance.
Connecting to your existing stack
The protocol is webhook-based with a published schema, so there is no proprietary SDK to adopt. If your organisation already uses Netskope, Palo Alto Networks, Proofpoint, or Zscaler, you can point inference hooks at the same server those tools already report to. Palo Alto Networks has announced direct integration with Claude Enterprise through their Prisma AIRS API. Alternatively, you can build your own enforcement logic in-house.
The technical documentation describes four deployment patterns: DLP enforcement (the most common), real-time transcript archival as an alternative to polling Anthropic’s Compliance API, prompt telemetry captured at the moment of use, and custom policy engines for rules like model allowlists or project-scoped restrictions.
What this means for your organisation
If you are a security, legal, or compliance team running Claude Enterprise, inference hooks gives you the same control posture over AI prompts that you have over email and web browsing. Sensitive data going into Claude, or arriving back from connected tools, can be evaluated and blocked before it ever touches the model.
The practical benefit is coverage without fragmentation. Before this feature, covering multiple Claude surfaces required separate integration work for each one. Now a single server configuration governs everything, and the enforcement point lives on Anthropic’s infrastructure rather than on user machines that may or may not be managed.
One boundary to be clear about: inference hooks apply to Claude Enterprise organisations only. If your organisation accesses Claude through the API directly via the Claude Platform, or runs Claude on Amazon Bedrock or Google Cloud Vertex AI, this feature is out of scope for you. It is an Enterprise-tier control, full stop.
To configure inference hooks, you need the organization:manage permission in claude.ai, which the built-in Admin, Owner, and Primary Owner roles hold.
The feature is in beta. You can find the full technical reference in the inference hooks documentation and a plain-language overview in the Help Centre article.