Anthropic Inference hooks let Enterprise admins block prompts

Anthropic announced on 20 October 2026, in its Claude Platform release notes, that Inference hooks are out of beta for Claude Enterprise organizations. According to the documentation, a hook sends the conversation transcript to an HTTPS service that your organization or its security vendor operates, waits for an allow or deny verdict, and only then lets inference run. A denied request never reaches the model.

How it works

Anthropic says the hook runs on its servers, after the request leaves the client and before the model runs, so it applies to every governed request across the Claude products in an organization without anything installed on user devices. The documentation names claude.ai, Cowork, Claude Code, Claude for Microsoft 365, Claude Tag and Claude in Chrome, and says the list is not exhaustive.

There are two events. A prompt event fires once per governed request. A tool_call event fires when Claude's response contains tool calls, before any run, but only in organizations that turn on Validate tool calls. Requests are signed under the Standard Webhooks specification so your server can verify them. A denial shows the user the reason your server supplied plus a standing message set by administrators, and is recorded in the organization's Activity Feed.

Rolling it out without blocking people

Anthropic describes three ways to phase enforcement: shadow mode, which records verdicts on live traffic without blocking anything; a rollout percentage, which inspects a chosen fraction of requests; and role exclusions, which exempt chosen members entirely. Configuring hooks needs the organization:manage permission, which only the Owner and Primary owner roles hold.

What happens when your server is down

The verdict timeout is 5 seconds by default. If your server is unreachable, errors or times out, a setting you choose decides whether the request is blocked or proceeds without inspection. Sustained failures trip a circuit breaker: Anthropic stops calling your server and applies that setting to every request until it detects verdicts coming back. Fail-closed protects data but stops work when your server has an outage; fail-open keeps people working but leaves a gap. The documentation does not recommend one.

The catch

• Verdicts are allow or deny only. Anthropic says rewriting or redacting a prompt is not supported.
• Raw file and image bytes are never sent, only metadata and extracted text, so a screenshot of a document is not inspected.
• Claude Platform organizations (API access) are out of scope, and hooks are not available on Amazon Bedrock or Google Cloud.
• Anthropic says not to rely on hooks as your only control for voice, because a small share of tool calls is not sent.
• A denied message is resent with every later message, so a server that scores the whole transcript keeps denying until the user edits the offending content out.

A related feature that is not live yet

The same release notes mention organization webhooks for events about enforcement actions on your end customers' user profiles. The webhooks documentation says event delivery is not live: Anthropic does not send the two events yet, so a registered endpoint receives nothing. Access is by request through your Anthropic account team.

What to do

• If you run Claude Enterprise, ask your security team whether a DLP vendor already offers a compatible AI security server before building one.
• Start in shadow mode, and measure how often your server answers within 5 seconds before you enforce.
• Decide fail-open or fail-closed in writing, with the owner who accepts the outage or the gap.
• Keep the Compliance API for after-the-fact audit; Anthropic positions hooks for stopping requests and the Compliance API for reviewing what happened.