Claude Enterprise Inference Hooks: Build the Security Server

Anthropic gave enterprise security teams what they have been asking for since Claude Code hit production: a webhook layer that intercepts every employee prompt before the model ever sees it. Inference hooks are now generally available for Claude Enterprise. Yesterday Anthropic layered on a security center, EDR sensors inside Cowork, and a parent admin console. If your CISO has been blocking Claude Code rollout on data-leakage grounds, that objection now has an answer — but only if someone builds the security server. Here is how to do it.

What You Are Intercepting #

When an employee submits a prompt in Claude chat, Claude Code, or Claude Cowork, Anthropic s inference and POSTs the full conversation transcript to an HTTPS endpoint you operate. Your server checks the payload against your DLP or security policies and returns a binary verdict: allow or deny. You have five seconds. Miss that window and the request is denied automatically.

Two hook types exist. Prompt hooks fire on user messages. Pre-tool-call hooks fire before Claude executes an agent action — a bash command, a file read, a web request. One organization-level configuration covers claude.ai chat, Claude Code CLI, Claude Code in VS Code, and Cowork simultaneously.

Build the Server in Three Steps #

Step 1: Verify the Signature Before You Trust Anything

Every request arrives with three headers: webhook-id, webhook-timestamp, and webhook-signature. Anthropic signs each delivery with HMAC-SHA256 per the Standard Webhooks spec. An endpoint that skips this check accepts requests from anyone who discovers the URL.

The signed payload is {webhook-id}.{webhook-timestamp}.{raw body bytes}. Two bugs catch nearly everyone:

• Computing HMAC over re-encoded JSON. Parse the body for your DLP logic, but compute the HMAC over the raw bytes exactly as received. Re-encoding even a single field breaks the signature.
• Wrong base64 variant for the secret. Decode your organization’s webhook secret with standard base64, not URL-safe base64. They are different character sets.

Also reject any request with a timestamp more than five minutes from your server clock — that is the anti-replay window. Use webhook-id as an idempotency key since Anthropic reuses the same ID on retries after a connection failure.

A minimal Python verification function:

import hmac, hashlib, base64, time

WEBHOOK_SECRET = base64.b64decode("your-org-secret")  # standard base64

def verify(headers, raw_body: bytes) -> bool:
    wid = headers["webhook-id"]
    ts  = headers["webhook-timestamp"]
    sig = headers["webhook-signature"]

    if abs(time.time() - float(ts)) > 300:
        return False  # stale request

    payload = f"{wid}.{ts}.".encode() + raw_body
    computed = base64.b64encode(
        hmac.new(WEBHOOK_SECRET, payload, hashlib.sha256).digest()
    ).decode()

    return any(s == f"v1,{computed}" for s in sig.split())

Step 2: Run Your Check and Return a Verdict

The JSON body contains the conversation transcript, hook type, and org/user metadata. Run whatever DLP logic your organization requires — regex for PII patterns, a call to your existing security tool, or a lookup against a blocklist. Then return:

{ "action": "allow" }

// or

{
  "action": "deny",
  "deny_reason": "Contains credit card number. Remove PII before resubmitting.",
  "reference_id": "your-internal-trace-id"
}

Three response traps to avoid. First, deny_reason is capped at 500 characters and shown directly to the user — write it like a helpful error message, not a syslog entry. Second, a non-200 HTTP response is a webhook failure, not a deny. Returning 403 for a blocked prompt does not deny the prompt — it triggers a failure path that also denies, but logs it as an infrastructure error rather than a policy decision. Return 200 always, with the action in the body. Third, any action value other than allow or deny is treated as a failure.

Step 3: Roll Out Gradually — Do Not Start at 100%

Anthropic ships three rollout controls precisely because jumping straight to full enforcement generates false-positive spikes that erode trust in the whole system. Use them.

• Shadow mode: Live traffic hits your endpoint, verdicts are logged, nothing is blocked. Run here first. See what your rules would have denied. Tune before you enforce.
• Rollout percentage (0–100%): Start at 10%, watch for failures, expand incrementally.
• Role-based exclusions: Exempt specific roles — useful for the security team doing red-team work who cannot have their own tool blocked.

Configuration lives in Organization Settings > Security > Inference Hooks. It requires the organization:manage permission, which only the Owner and Primary Owner roles hold. The Admin role does not have it — a point that trips up most initial setup attempts.

What Else Shipped Yesterday #

Inference hooks are the main event, but Anthropic’s November 5 announcement bundled three additional features:

• Security center (beta): A single page that shows all security settings for chat, Cowork, and Claude Code, and flags gaps against Anthropic’s recommended configuration. Replaces hunting through 15 separate settings pages.
• EDR in Cowork (beta): CrowdStrike, SentinelOne, and Tanium can now run a sensor inside the Cowork VM. This closes a monitoring blind spot — standard EDR on the host OS cannot see shell commands and file access that agents execute inside Cowork’s isolated environment. The vendor list also includes Evoke Security, Neo, Palo Alto Networks, and Pluto Security.
• Parent admin console (admin.claude.com): Central management of SSO, SCIM directory sync, domain verification, and groups across multiple Claude Enterprise organizations. IP allowlisting is now self-serve — no Anthropic support ticket required.

The Practical Upshot #

The official developer docs include a full working Python server. If you are already running Netskope, Palo Alto Prisma AIRS, Proofpoint, or Zscaler, check whether your vendor has published a Claude connector — several already have. If you are building your own, the Standard Webhooks signature format is straightforward; the two implementation bugs described above are the only real gotcha.

Microsoft’s Purview has offered equivalent hooks for Teams and Copilot for two years. Google Workspace DLP has the same for Gemini. Claude is now at parity with the enterprise security ecosystem, which means the “we cannot control what employees send” objection is gone. Whether your organization acts on that is now an execution problem, not a product problem.