Claude’s Inference Hooks: Real-Time DLP for AI Prompts

Anthropic put inference hooks into beta for Claude Enterprise on August 5, 2026, and the mechanic is simpler than the category name suggests: before a governed prompt reaches the model, Anthropic posts the conversation transcript to a security server your organization runs, waits for a verdict, and proceeds only on an allow. Deny, and the user sees a blocked-by-policy message instead of a completion.

That is a meaningful change in where enterprise AI policy gets enforced. Until this release, most organizations inspected AI usage from the outside — a proxy watching egress, a CASB watching sanctioned apps, a compliance API pulling transcripts after the fact. Inference hooks move the checkpoint inside the model vendor’s own infrastructure, at the moment before inference, with the customer’s server holding the veto.

This guide covers what actually shipped, how a verdict is produced and what the security server does and does not receive, the two places where Anthropic’s launch blog and its own technical documentation disagree, how the hook layer compares with the network layer after Check Point’s July 30 firewall launch, and a rollout sequence that does not take your Claude estate down on day one.

Inference hooks launched in beta on August 5, 2026 for Claude Enterprise. A single organization-level setting governs conversations across claude.ai, Claude Cowork, and Claude Code — on the web, in the desktop app, and in the CLI. Anthropic’s framing is that this removes the need for separate integration work or a per-product agent, which is the practical difference between a control a security team can actually own and one that fragments across four consoles.

Configuring hooks requires the organization:manage permission, held by the built-in Admin, Owner, and Primary owner roles or by any custom role granted it. That places the control with the same people who already administer the tenant, rather than with individual workspace owners — which matters if your Claude estate has grown the way most have, one team at a time. If you are still mapping what those surfaces do, our guides to Claude Cowork’s enterprise plugin and connector layer and to how Cowork handles enterprise AI governance cover the surfaces this hook now sits in front of.

The technical documentation describes the flow concretely. Anthropic sends a signed HTTPS POST to the AI security server endpoint your organization configures, carrying the conversation transcript. Each request is signed according to the Standard Webhooks specification once your organization generates a signing secret — so verifying provenance is the first thing your endpoint should do, before it reads a single token of the payload.

Your server has to answer within the verdict timeout, which defaults to five seconds and is organization-configurable. The answer is a small JSON object: an action of allow lets the request proceed, while a deny carries a deny_reason. That reason is not just telemetry — the blocked-by-policy message the user sees is assembled from the per-request deny_reason your server supplied, followed by a standing admin-configured message such as who to contact for an exception, with a built-in default if no standing message has been set. Every denial is recorded in the organization’s Activity Feed, the existing Claude Enterprise compliance surface.

What crosses the wire is deliberately bounded. The security server receives transcript text, tool calls and their results, and text extracted from attachments. It never receives raw file or image bytes, system prompts, or Anthropic-internal context, and tool definitions are not included. Ancillary requests — conversation-title generation being the documented example — are never sent to the security server at all.

This is the part Anthropic’s own blog post gets wrong. The launch copy states that the same check runs on tool calls, and that when Claude calls a tool — including tools connected through MCP, skills, and plugins — the tool’s response is checked before it is sent back to the model. Read plainly, that promises a synchronous allow-or-deny check on tool output.

Two primary sources say otherwise. Anthropic’s technical documentation states that the only hook event today is prompt, which fires once per governed inference request before inference begins, and that response-side enforcement is planned as a later event. Proofpoint — a data-security vendor that shipped an integration on the same day, so it has every incentive to describe the surface accurately — answers the question directly in its FAQ: inference hooks apply to what employees send in, and for the response side it points customers at the Compliance API for visibility into what Claude returned.

Two primaries against one line of marketing copy is not a close call. The accurate picture at the time of writing: inference hooks gate the inbound prompt. Prior tool calls and their results do reach your security server, because they are part of the transcript that accompanies a later request — but that is next-turn context, not a standalone check fired the moment a tool returns. Plan your controls against the documented event, and treat the response side as a roadmap item rather than a shipped capability.

Counted plainly, that is nine content types a security team would reasonably want covered: two fully gated today, one partially, and six not gated at all. That ratio is not a criticism of a beta — it is the scoping exercise you need before anyone writes “Claude usage is DLP-controlled” into a control narrative. The two covered categories happen to be the two that carry most day-to-day paste-and-upload risk, which is why the feature is genuinely useful even at this scope.

None of these are defects. They are the shape of the control, and each one forces a decision that belongs to your security team rather than to Anthropic. Make the four below explicitly, and write them down — regulated teams will need them in an audit narrative anyway, which is the same discipline behind the oversight patterns regulated industries already require of agents.

The strongest case for hook-level inspection does not come from Anthropic. It comes from Proofpoint, a vendor whose own network and data-security products this feature might be assumed to cannibalize. Asked directly whether inference hooks replace network-based AI security tools such as a proxy or CASB, Proofpoint’s answer is no — and its explanation of what hooks add is the structural argument.

The distinction is about vantage point. A network tool sees traffic that traverses it. A hook sees the parsed transcript inside the model vendor’s infrastructure, regardless of which device or network the request came from. For agentic usage — a developer running Claude Code from a personal laptop on a home connection, an agent invoking MCP tools — that difference decides whether anything is inspected at all.

The counterpoint launched six days before inference hooks did. On July 30, 2026, Check Point announced an AI Network Firewall shipped as part of firewall software release R82.20, which inspects AI prompts, autonomous agent actions, and MCP server traffic at the network gateway — inline, with no application changes required, running on firewalls organizations already operate as part of a broader “AI Defense Plane.” Two vendors answering the same question, six days apart, from opposite ends of the stack.

Coverage of the launch has treated inference hooks as a Claude feature. The more useful frame is a comparison of where each vendor chose to put the checkpoint, because that choice — not the rule syntax — determines what a control can and cannot do. The table below is built from each vendor’s own primary documentation and press material.

Read down the fourth column and the picture is clear. Only two of the four gate the prompt before the model sees it, and they gate it in different places: one inside the model vendor for one vendor’s traffic, one at the gateway for whatever crosses it. OpenAI’s Compliance API is an evidence system; Google’s is rule-based enforcement inside Workspace, but pre-inference gating is not described in the primary sources we checked. That is not a ranking — a mature program runs more than one — but it is the distinction that gets lost when every one of these is described as “AI DLP.” If you are assembling this stack, our write-up of OpenAI’s Lockdown Mode and the exfiltration stage it severs covers the equivalent decision on the other major assistant.

The forward-looking read: prompt gating is the easy half. Response-side enforcement is the hard half, because a verdict on an output means holding a streaming completion until a third-party server approves it, and every millisecond is visible to the user. Anthropic has said that event is planned; the interesting question for the next two quarters is whether it ships as a true blocking gate or as an asynchronous after-the-fact signal that looks like enforcement in a slide and reads like telemetry in the docs. Buy on what exists today, and treat the roadmap as a reason to stay in the conversation rather than as scope you already own.

The rollout controls that ship at launch are the reason this can be adopted without a change-freeze weekend: shadow mode observes verdicts on live traffic without blocking anything, percentage-based rollout inspects a chosen fraction of requests, and role-based exclusions exempt selected roles entirely. Used in that order, you get real traffic against real rules before anyone is ever blocked.

You can bring an existing vendor or build your own. Named launch partners are Netskope, Palo Alto Networks, Proofpoint, and Zscaler, over an open webhook-based protocol with a published schema — or you host a custom in-house AI security server at an endpoint of your own, say https://ai-security.example.com/verdict. Proofpoint’s same-day integration applies its existing DLP policies — the rules that already govern email, endpoint, and cloud data loss — directly to Claude prompts, with no new rule language required, which is the pragmatic path if you already own one of these platforms.

Data loss prevention is the deployment Anthropic calls the most common, but it is not the only one the documentation describes. Three others are worth knowing about before you scope the project, because they change who in your organization should care.

The telemetry and policy-engine cases are the ones most teams underestimate. Once you have a server that sees every governed prompt, you also have the cleanest inventory of AI usage your organization will ever get — which is far easier to maintain alongside a registry that already tracks what data each agent touches than as a standalone reporting project.

The reason a control like this ships now is visible in the vendor research. Proofpoint’s 2026 AI and Human Risk Landscape Report — a vendor-run survey, so read it as directional rather than audited — found that nearly nine in ten global organizations have moved AI assistants beyond pilot, and that 42% have already had a suspicious or confirmed AI-related incident.

Read those two bars together and the design of inference hooks makes sense. When adoption is this widespread and incidents are common, the bottleneck stops being detection — most organizations already know roughly what is happening — and becomes the ability to intervene before the fact. A compliance API tells you what left. A hook decides whether it leaves. That is the shift, and it is why the enforcement point matters more than the feature list.

There is a second, quieter signal. Anthropic shipped this as an open, webhook-based protocol with a published schema and four named partners rather than as a proprietary integration with one. That is what a vendor does when it expects enterprise security teams to be the gatekeepers of expansion — a posture that follows naturally from the sort of incident that puts AI vendors in front of a risk committee in the first place, as the kind of incident enterprise security teams are trying to get ahead of illustrates.

Our projection for the next two quarters: expect the response-side event to become the headline feature of the next enterprise release cycle, and expect competitors to answer with their own inline hooks rather than richer logs — because once one vendor lets a customer’s server hold the veto, an audit log stops reading as a control and starts reading as evidence. Teams evaluating where to place their own checkpoint are exactly the conversations our AI and digital transformation engagements start with.