Inference hooks are out of beta for Claude Enterprise organizations
By Steven Van ·
Claude Enterprise owners can send each governed prompt to their own security server for an allow or deny verdict before the model runs.
Inference hooks have left beta for Anthropic's Claude Enterprise organizations, according to the Claude Platform docs. The release note for October 20, 2026 gives no other detail. The linked documentation page describes how the feature works.
What inference hooks do
A Claude Enterprise organization can route every governed prompt through an AI security server before inference runs. This is an HTTPS service that the organization or its security vendor operates. Anthropic sends the conversation transcript to that server and waits for an allow or deny verdict. A denied request never reaches the model.
There are two hook events:
- prompt fires once per governed inference request, before inference begins.
- tool_call fires when Claude's response contains tool calls, before any of them runs. It applies in organizations that have Validate tool calls on.
How verdicts work
Each request is signed according to the Standard Webhooks specification once the organization generates its signing secret. The server has 5 seconds by default to respond, and the organization can change that timeout. On allow, inference proceeds. On deny, the user sees a blocked-by-policy message. It combines the reason the server supplied in the deny_reason field with a standing message that administrators configure. If administrators haven't set one, a built-in default tells the user to contact them. Each denial is recorded in the organization's Activity Feed.
If the server is unreachable, returns an error or times out, the organization's failure handling setting decides whether the request is blocked or allowed without inspection. Sustained failures trip a circuit breaker. Anthropic then stops contacting the server and applies the failure handling setting to every request until it detects that the server is returning verdicts again.
Enforcement can be phased in with shadow mode, which observes verdicts without blocking anything. A rollout percentage inspects only a fraction of requests, and exclusions exempt members of chosen roles.
What the server receives
The server sees transcript text, tool calls and their results, and text extracted from attachments. It never receives raw file or image bytes, system prompts, or Anthropic-internal context. Image-only content, such as a screenshot of a document, is therefore not inspected. Verdicts are allow or deny only, and rewriting or redacting a prompt is not supported.
Availability
Inference hooks are available only to Claude Enterprise organizations. Configuring them requires the organization:manage permission in claude.ai, which only the Owner and Primary owner roles hold. One hook covers conversations across Claude products in the organization, including claude.ai, Cowork, Claude Code, Claude for Microsoft 365, Claude Tag and Claude in Chrome. This holds on the web, in desktop and mobile apps, in the CLI and in Slack.
Platform organizations using the API through the Claude Platform are out of scope. Inference hooks are not available on Amazon Bedrock or Google Cloud. The docs also advise against relying on them as the only control for voice mode, because a small share of tool calls isn't sent to the endpoint there.