Claude inference hooks: DLP runs before the model sees it

Anthropic shipped inference hooks in beta for Claude Enterprise: a checkpoint that sits between your employee hitting enter and the model reading a single token. Your prompt goes to a server you run. Your server says allow or deny. Only then does inference happen. That's a different control surface than anything the browser-extension DLP vendors have been selling.

What actually happened

In the announcement, Anthropic describes inference hooks as inline data loss prevention for Claude Enterprise. When an org turns them on, every governed inference request routes over a signed WebSocket to an HTTPS "AI security server" that the org — or its security vendor — operates. Claude sends the prompt and its surrounding context. Your server returns a verdict. A denied request never reaches the model.

The coverage is the part worth reading twice. One configuration at the org level covers chat, Claude Code, and Cowork, plus MCP connectors, skills, and plugins. Nothing gets installed on user devices. Tool responses can be inspected too, not just the initial prompt — which matters, because the exfiltration path in an agent setup is usually something a tool pulled back, not something a human typed.

The rollout controls are unusually grown-up for a beta. Per the platform docs, you get shadow mode (evaluate, always allow), role-based exclusions, percentage rollouts, and configurable timeout and failure-policy settings.

Why an inference-time checkpoint matters for your business

Most "AI governance" you can buy today is a proxy or a browser extension. Both break the moment work moves to a CLI, a desktop app, or an agent running unattended at 2am. Putting the hook on the server side of the request means the CLI and the agent are governed by the same rule as the chat window. That's the actual win here, and it's a pattern to copy even if you're not on Claude Enterprise.

Two things to think hard about before you flip it on.

Your security server is now in the critical path. Every governed prompt waits on your HTTPS endpoint. That's why the failure policy is configurable, and choosing it is a business decision, not a security one: fail-closed means your outage stops everyone from working; fail-open means your outage is a silent gap in the control. Pick deliberately, write it down, and monitor that endpoint like it's production — because it is.

Shadow mode is the whole plan for month one. Run it in evaluate-only, log every verdict you would have issued, and go read them. The gap between the policy you think you have and the prompts your team actually sends is where the surprises live. We've seen the same pattern with approval gates on agents and network allowlists: the control is easy, the policy is the work.

This also lands in a week where IBM found 92% of breached orgs were missing AI access controls. A hook that runs before inference is a real answer to that. A hook nobody tuned is a checkbox.

Sources: Anthropic, Claude Platform Docs.