How do Claude Enterprise inference hooks work?

Claude Enterprise inference hooks send every governed prompt, and optionally every batch of tool calls, to an AI security server your organization runs, and Claude waits for an allow or deny verdict before the model or the tools proceed. Anthropic's November 5, 2026 security update presents them as generally available next to four other controls, most in beta ^[1]; the release notes show the hooks left beta on October 20, 2026 ^[5].

What changed in Claude Enterprise on November 5?

The November 5 update groups five areas of control for security teams, and inference hooks are the only one it presents as generally available ^[1]. That status is not new on November 5: the release notes record the hooks entering beta on August 5, 2026 and leaving beta on October 20, 2026 ^[5]. Most of the rest ship as betas, and the EDR integration also reaches Claude Team.

Inference hooks get most of this post because they are the one piece a developer has to build, and the one that sits in the path of every agent action ^[2].

How do Claude Enterprise inference hooks work?

An inference hook is a signed HTTPS POST from Anthropic to your AI security server, sent after the request leaves the client and before the model runs ^[2]. Because the check runs on Anthropic's servers, it applies the same way across every Claude product in the organization, with nothing to install on user devices.

There are two events. A prompt frame fires once for each governed inference request, before inference starts. A tool_call frame fires when Claude's response contains tool calls, before any of them runs, if the organization has Validate tool calls on ^[2]. One verdict covers the whole tool call frame, so you cannot allow some calls in a response and deny others ^[4].

The server sees what the user sees: transcript text, tool calls and their results, and text extracted from attachments. It never receives raw file or image bytes, system prompts, tool definitions or Claude's hidden reasoning ^[4]. Tool calls that code makes inside the code execution tool are sent as separate tool call frames before they run.

Coverage is broad but not total. One hook governs claude.ai, Cowork, Claude Code, Claude for Microsoft 365, Claude Tag and Claude in Chrome, on the web, desktop, mobile, CLI or Slack. It is not available on Amazon Bedrock or Google Cloud, and organizations that use the API through the Claude Platform are out of scope ^[2].

What does the verdict look like?

The verdict is a small JSON object returned with HTTP 200: {"action": "allow"} lets the request proceed, and a deny adds a deny_reason of up to 500 characters shown to the user and an optional reference_id of up to 50 characters for your own records ^[4].

{
  "action": "deny",
  "deny_reason": "This prompt appears to contain payment card numbers. Remove them and send it again.",
  "reference_id": "scan_0001"
}

Errors are not denies. Any status other than 200, an unparseable body or an action other than allow or deny counts as a webhook failure, and Anthropic reads at most 64 KiB of the response ^[4]. A failure falls through to your failure handling setting, so a server that returns 403 to block a prompt may in fact let it through.

How do you build and switch on an inference hook?

You build an HTTPS service, verify Anthropic's signature on each request, and then an Owner or Primary owner connects it in claude.ai under Organization settings, Data and privacy ^[3]. Only those two roles hold the organization:manage permission; the Admin role does not.

Requests follow the Standard Webhooks scheme. The webhook-signature header carries an HMAC-SHA256 over {webhook-id}.{webhook-timestamp}.{raw body}, you should reject timestamps more than 5 minutes from your clock, and the signing secret is the standard base64 value after its whsec_ prefix ^[4]. A minimal check, consistent with the documented procedure:

import base64, hashlib, hmac, os, time

def verify(headers: dict, body: bytes) -> bool:
    h = {k.lower(): v for k, v in headers.items()}
    msg_id = h.get("webhook-id")
    ts = h.get("webhook-timestamp")
    sigs = h.get("webhook-signature")
    if not (msg_id and ts and sigs and ts.isdigit()) or abs(time.time() - int(ts)) > 300:
        return False
    raw = os.environ["INFERENCE_HOOKS_SIGNING"].removeprefix("whsec_")
    mac = hmac.new(base64.b64decode(raw), f"{msg_id}.{ts}.".encode() + body, hashlib.sha256)
    expected = b"v1," + base64.b64encode(mac.digest())
    return any(hmac.compare_digest(expected, s.encode()) for s in sigs.split())

Then set up the endpoint in this order:

1. Host it where Anthropic can reach it. The URL must be https:// on port 443, on a publicly routable host with an IPv4 address, without redirects; reverse tunnels such as ngrok are blocked ^[3]. Requests come from 160.79.106.0/24, which you can allowlist in addition to checking signatures ^[4].
2. Raise your body size limit. Transcripts are sent untruncated; bodies usually stay under about 10 MB, but the protocol allows up to 64 MiB, while nginx defaults to 1 MB and Express express.json() to 100 kB ^[4].
3. Save the endpoint and store the signing secret. It is shown once and can only be rotated afterwards. You can add up to 16 custom request headers to authenticate the caller, then run Test connection ^[3].
4. Pick failure handling and a timeout. Block the request fails closed and Allow the request fails open. The timeout ranges from 1 to 10,000 ms, and the defaults on first save are Allow the request and 5,000 ms ^[3].
5. Start in shadow mode. Your server returns verdicts on live traffic and nothing is blocked. A rollout percentage from 0 to 100 and role exclusions let you widen enforcement gradually ^[3].
6. Turn on Enforce verdicts. The change takes about a minute to reach every Anthropic server ^[3].

Two operating rules matter once it is live. Anthropic retries exactly once, after 100 ms, and only when the connection attempt fails, so you can deduplicate on webhook-id ^[4]. And when a frame arrives with an event type you do not recognize, the documentation says to return allow rather than an error, because new event types are planned.

What happens when your security server fails?

When your server is unreachable, slow or broken, your failure handling setting decides, and sustained failures trip a circuit breaker that stops Anthropic from calling your server at all ^[3]. While the breaker is tripped, failure handling applies to every inspected request, so with Block the request selected users are blocked until it resets.

Starting 10 minutes after a trip, Anthropic sends a background test request about once per minute and resets the breaker when a valid verdict comes back ^[4]. Each trip is recorded as an inference_hooks_circuit_breaker_tripped activity in the Activity Feed, which needs the Compliance API enabled, so a SIEM can alert on it ^[3].

What does this mean for teams running AI agents?

For teams that let Claude Code or Cowork act on their behalf, the tool_call frame is the practical change: a policy can now stop a bash command or a connector call before it runs, from one place, for every member ^[2][4]. Each verdict also adds your server's round trip to every governed request, so load-test the server before a large rollout.

The other betas fill gaps around that control. The security center shows Owners how chat, Cowork and Claude Code settings compare with Anthropic's recommendations, records attestations for controls it cannot check, and exports a PDF for auditors, though it says the page is "guidance, not a guarantee" ^[6]. Centralized management puts several organizations under one parent console at admin.claude.com, and its setup cannot be undone ^[1].

For offboarding and incidents, the Admin API now signs a member out everywhere with POST /v1/organizations/users/{user_id}/sign_out and the admin-user-sign-out-2026-10-08 beta header, and the Claude Console accepts an IP allowlist of up to 1,000 addresses or CIDR ranges per organization ^[5]. Sign-out does not end API keys, cloud sessions that are already running or scheduled routines, so revoke those separately ^[1].

On devices, Claude Desktop 4.4212.0 or later can install an EDR sensor inside the local Cowork virtual machine, from one of seven approved vendors including CrowdStrike, Palo Alto Networks, SentinelOne and Tanium, after checking the package signature at each VM start ^[7]. Cloud Cowork sessions are not covered, and the sensors run in detection mode: they report activity and do not block it ^[1].

What are the limits and open questions?

Inference hooks can only allow or deny; they cannot redact or rewrite a prompt, and image-only content such as a screenshot of a document is not inspected ^[2]. Some model calls are not sent to your endpoint at all, including hosted Claude Security scans, Code Review runs on GitHub pull requests and smart reports.

A denied message also stays in the transcript, which is resent with every later turn, so a server that checks the whole transcript denies those turns too until the user edits the message, rewinds in Claude Code or starts a new chat ^[2]. The documentation does not publish the failure rate or duration that trips the circuit breaker, so plan for it with monitoring rather than a fixed number ^[3].