# Claude Inference Hooks: Enterprise DLP Before Every Prompt > Source: > Published: 2026-08-10 18:08:13+00:00 Anthropic launched inference hooks on August 5 — a beta feature for Claude Enterprise that intercepts every employee prompt before the model ever sees it. One security server, one organisation-level configuration, and suddenly every Claude surface is covered: chat, Claude Code, Cowork, MCP connectors, skills, and plugins. For enterprise security teams, it is the inline DLP checkpoint they have been asking for since AI landed on the corporate stack. ## How It Works The mechanism is a webhook. When a user submits a governed prompt, Anthropic sends a signed HTTPS POST carrying the conversation transcript to the organisation’s configured AI security server. The server evaluates the content and responds with a verdict: allow or deny. Claude waits for that verdict before generating anything. If the server says deny, the prompt never reaches the model and the user sees a plain-language reason why it was blocked. The request is signed under the [Standard Webhooks specification](https://github.com/standard-webhooks/standard-webhooks) using a signing secret the organisation generates in the Claude admin console. Your server should reject any unsigned request outright — the docs are explicit on this. The default verdict timeout is five seconds. If your server goes silent, the outcome depends on your org’s configured fallback: allow by default or deny by default. The verdict schema is minimal: ``` // Permit the prompt {"action": "allow"} // Block it with a user-facing explanation {"action": "deny", "deny_reason": "Message contains restricted financial data."} ``` That is the entire surface area of the protocol. Intentionally simple. ## What It Actually Covers The scope is broader than it first appears. A single configuration at the organisation level covers Claude.ai chat, Claude Code terminal sessions, Claude Cowork, and every tool call made through MCP connectors, skills, and plugins. When Claude calls a tool — say, pulling a file from Google Drive via an MCP connector — the tool’s response is checked before it is sent back to the model. Claude Code coverage is the part security teams should notice. Until now, terminal-based Claude Code sessions were effectively a blind spot for corporate DLP tools — no browser proxy catches a CLI agent running on an engineer’s machine. Inference hooks is the first official mechanism that closes that gap. ## Build or Buy Engineering teams have two practical options. The first is to build an AI security server in-house: deploy an HTTPS endpoint on port 443, on a publicly routable host (private IPs and loopback ranges are refused at connect time), verify the Standard Webhooks signature, apply whatever rules you need — regex patterns, ML classifiers, keyword blocklists — and return allow or deny. The protocol is open and the schema is published, so the implementation is straightforward. The second option is to point inference hooks at a security vendor that has already built the connector. [Proofpoint](https://www.proofpoint.com/us/blog/data-security/real-time-data-loss-prevention-claude-inference-hooks) is the most developer-friendly integration at launch: it reuses the DLP rules already governing your email and endpoint traffic with no new rule language required. [Zscaler](https://www.zscaler.com/blogs/product-insights/zscaler-integrates-claude-inference-hooks-scale-ai-while-addressing-risks), Netskope, Palo Alto Networks Prisma AIRS, and Check Point also have documented integrations. If you are already running any of those platforms, turning on inference hooks is mostly configuration, not development. ## The Gaps — Be Realistic The current beta has real limitations that matter depending on your use case. **Binary verdicts only.** The whole message either proceeds or it is blocked — there is no mechanism to strip a credit card number and pass the rest of the prompt through. For teams in healthcare or financial services who need smart redaction rather than hard blocks, that is a significant constraint.**Prompt-side only.** Inference hooks only fires before inference. Response-side enforcement — inspecting what Claude outputs before it reaches the user — is listed as planned but is not available today.**No image inspection.** Attachments arrive as extracted text only. A screenshot of a sensitive document is not scanned. ## Why This Is Happening Now Sensitive enterprise data transfers to AI tools [increased 93% year-over-year](https://www.infosecurity-magazine.com/news/sensitive-ai-data-upload-doubles/), according to recent reporting. MCP connectors accelerated the problem: Claude can now pull directly from Slack, Google Drive, Microsoft 365, Jira, and Confluence, which means sensitive content that never touched a browser proxy flows straight into the model. Security teams had tools to monitor email and web traffic. They had nothing for AI inference — until now. Inference hooks is the first time a frontier lab has built native inline DLP interception into the AI platform itself. That sets a precedent. Expect other providers to ship similar mechanisms as enterprise AI governance tightens through the rest of 2026 and into 2027. If you are running Claude Enterprise, the [official announcement](https://claude.com/blog/claude-enterprise-inference-hooks) and the [platform documentation](https://platform.claude.com/docs/en/manage-claude/inference-hooks) are the places to start. The protocol is open, the vendor connectors are live, and the deployment path is shorter than most enterprise security projects.