Inference hooks are a new Claude Enterprise capability, announced by Anthropic on August 5, 2026, that routes every governed prompt through the customer's own AI security server for an allow-or-deny verdict before inference runs. When an employee submits a prompt in Claude chat, Claude Code, or Claude Cowork, Anthropic sends the conversation transcript to the organization's configured security endpoint — each request signed under the Standard Webhooks specification — and waits for a verdict, five seconds by default. A denied request never reaches the model. The user sees a blocked-by-policy message with the reason the security server supplied, and the denial is recorded in the organization's Activity Feed.

The inspection extends to tool results: when Claude calls a tool through MCP connectors, skills, or plugins, the tool's response is checked before it is sent back to the model. The protocol is webhook-based with a published schema, so it plugs into DLP infrastructure enterprises already operate — Netskope, Palo Alto Networks, Proofpoint, Zscaler — or a security server built in-house. Rollout controls ship with it: shadow mode observes verdicts on live traffic without blocking anything, a rollout percentage inspects a chosen fraction of requests, and role-based exclusions exempt selected groups. Inference hooks are in beta for Claude Enterprise organizations today.

This is a meaningful moment for AI governance. Until this release, Anthropic's native inline enforcement was limited to Claude Code's client-side hooks; a frontier model vendor has now put a customer-controlled policy checkpoint directly in the inference request path, org-wide, with nothing installed on user devices. The premise Waxell is built on — that governance belongs in the request path, before something happens, not in a dashboard afterward — is now shipping from the model vendor itself. Which makes it worth being precise about what this checkpoint decides, and what it leaves undecided.

Why does inline enforcement stop at the model boundary?

An enforcement point can only govern the surface its operator controls. Anthropic controls the inference request, so that is where the checkpoint sits: after the request leaves the client, before the model runs. That placement is the feature's strength — one configuration covers chat, Claude Code, and Cowork uniformly — and also the source of its boundaries.

Anthropic documents those boundaries plainly, which deserves credit. Per its own platform documentation: the only hook event today is prompt, and "response-side enforcement is planned as a later event." Verdicts are allow or deny — "rewriting or redacting a prompt is not supported." Raw file and image bytes are never sent to the security server, so image-only content, such as a screenshot of a document, is not inspected. Voice mode is not covered, organizations using API access through the Claude Platform are out of scope, and the feature is not available on Amazon Bedrock or Google Cloud.

None of that is a flaw in what shipped. It is a precise map of where the model boundary ends — and agentic risk concentrates on the other side of it. A prompt verdict decides what the model may see. It does not decide what an agent may do with the response: which tool call executes next, whether that action stays in scope, what it costs, or whether the output is safe to act on. Those are policy enforcement decisions that arise after inference, in the gap between "the model responded" and "the agent acted" — and that gap is where incidents now live. When an autonomous agent framework ran against Hugging Face's dataset pipeline in July 2026, the company's own disclosure counted "more than 17,000 recorded events" executed "across a swarm of short-lived sandboxes." Those were actions, not prompts. A checkpoint that inspects what flows into a model is necessary; for systems that act, it is not sufficient.

What should security teams do with inference hooks now?

If your organization runs Claude Enterprise, this feature is worth adopting deliberately rather than reflexively. Five concrete steps:

Start in shadow mode against your existing DLP endpoint. The protocol is designed to point at the server your other channels already report to. Shadow mode gives you verdict telemetry on live traffic — what would have been blocked, and why — before anyone is blocked.

Choose your failure policy consciously. If your security server is unreachable or misses the verdict timeout, your configuration decides whether the request is blocked or proceeds uninspected. Fail-closed protects data and interrupts work; fail-open does the reverse. This is a risk decision, not a default to accept.

Map what the hook does not see. Image-only attachments, voice mode, API-based usage, and non-Claude AI tools all sit outside this checkpoint. Your inventory of ungoverned channels should shrink because of this release — not disappear from the agenda.

Feed denials into your audit trail. Denials land in the Activity Feed; your compliance record should capture them alongside the rest of your AI activity, keeping PII findings reviewable in one place.

Decide what governs actions and outputs in the meantime. Anthropic says response-side enforcement is planned. Until it arrives — and for the surfaces and vendors this feature will never cover — output validation, tool-call governance, and cost limits need an enforcement layer of their own.

How Waxell handles this

Inference hooks answer one question: may this content reach the model? The questions that remain — may this tool call execute, is this output safe to act on, has this run exceeded its budget — are answered at other points in the stack, and that is where Waxell operates.

Waxell MCP Gateway governs the tool calls themselves, for the assistants your team already uses — Claude Desktop, Claude Code, Cursor, or any MCP-compatible client. Where an inference-boundary verdict is binary, the Gateway can redact PII in flight rather than choosing between blocking a request outright and letting it through untouched, and it blocks secrets so they never leave the gateway at all. It fingerprints tools and scans their descriptions for prompt injection before any agent calls them, and it parks destructive actions for human approval instead of letting them execute. One governed endpoint fronts 160+ upstream connectors, with policy changes propagating in about 30 seconds.

For the agents your team builds, Waxell Observe supplies the response side that a prompt-boundary checkpoint leaves for later: output quality gates, PII and content policies applied to what agents produce and do, and hard cost limits per agent, per user, and per session — drawn from 50+ policy categories and enforced at 0.045ms p95, fast enough to sit in the execution path. A governance layer that operates below the model boundary is not in competition with inference hooks; it is the other half of the same architecture. Run the DLP checkpoint at the boundary, and enforcement where your agents act.

FAQ

What are Claude inference hooks?

Inference hooks are a beta Claude Enterprise feature, announced August 5, 2026, that routes every governed prompt through the customer's own AI security server before inference runs. The server returns an allow-or-deny verdict; a denied request never reaches the model. The hook runs on Anthropic's servers, so it covers Claude chat, Claude Code, and Cowork with one organization-level configuration.

Do inference hooks redact sensitive data from prompts?

No. Anthropic's documentation states that verdicts are allow or deny, and that rewriting or redacting a prompt is not supported. A prompt that contains regulated data can be blocked entirely, but not cleaned and passed through. Redaction in flight requires a different enforcement point, such as a governed gateway in front of tool calls.

Do inference hooks inspect Claude's responses?

Not today. Anthropic's documentation states that the only hook event is prompt, which fires before inference begins, and that response-side enforcement is planned as a later event. Content flowing into the model — prompts and tool results — is inspected; enforcement on what the model produces is not yet part of the feature.

What happens if the DLP server goes down?

The organization's failure-policy setting decides: block requests until the server recovers, or let them proceed without inspection. There is also a configurable verdict timeout, five seconds by default. Choosing between fail-closed and fail-open is one of the most consequential settings in the rollout.

How are inference hooks different from an AI gateway?

Inference hooks inspect content entering one vendor's models from that vendor's enterprise surfaces. An AI gateway such as Waxell MCP Gateway sits in front of the tools and data your assistants and agents reach — across clients from multiple vendors — and can enforce richer outcomes than allow-or-deny, including PII redaction in flight, secret blocking, and human-in-the-loop approval on destructive actions. Many organizations will run both: one governs the model boundary, the other governs what agents do.

Sources

• Anthropic, Inference hooks: inline data loss prevention for Claude Enterprise — August 5, 2026

• Anthropic, Inference hooks — Claude Platform Docs — accessed August 6, 2026

• The Next Web (Ana Maria Constantin), Anthropic built an inspection layer that lets enterprises block sensitive data before it reaches Claude — August 5, 2026

• Hugging Face, Security incident disclosure — July 2026 — July 16, 2026

The model boundary now has a checkpoint. Give the rest of your stack one too: put Waxell MCP Gateway in front of your assistants' tool calls — PII redacted in flight, secrets blocked, destructive actions parked for approval. Start free.