Allow or Deny Before the Model Sees It: Anthropic Puts Enterprise DLP Inline With GA Inference Hooks

2026-11-07 Agent & Supply Chain Security by al-ice.ai Editorial

On 5 November 2026, Anthropic published “More visibility and control over Claude Enterprise for security teams,” a bundle that moves enterprise enforcement for Claude from after-the-fact audit into the inference path. The headline item is generally available inference hooks: prompt hooks that ship outgoing prompts to a customer’s own security tool for inspection, and pre-tool-call hooks that check tool calls before they run. Around them sit four beta controls — a Security Center posture page, centralized management from a parent console at admin.claude.com, an Admin API sign-out plus self-serve IP allowlisting and managed-desktop controls, and an EDR sensor inside the local Cowork virtual machine. The announcement and the accompanying platform documentation are unusually candid about where each control stops. Those edges are the actual story.

The timing is worth noting for readers of this site’s August coverage window: Enterprise skill and plugin security scanning — automatic checks for malicious content when someone uploads or edits a third-party skill or plugin — dates to 6 August 2026, three months before this bundle. The November release is not the skill-scanning story; it is the enforcement-layer story that sits underneath it. Scanning decides whether a skill is allowed in the door. Inference hooks decide what its tool calls are allowed to do once inside.

The hook runs on Anthropic’s side, and that is the point

Per the platform documentation, when a user submits a prompt on a governed surface, Anthropic sends the conversation transcript as an HTTPS POST to an AI security server the organization (or its security vendor) operates, waits for an allow or deny verdict, and only then lets inference proceed. A denied request never reaches the model, and each denial lands in the organization’s Activity Feed. Because the checkpoint executes inside Claude’s infrastructure — after the request leaves the client, before the model runs — one configuration covers every governed product uniformly with nothing installed on employee devices: claude.ai, Cowork, Claude Code, Claude for Microsoft 365, Claude Tag, and Claude in Chrome, across web, desktop, mobile, CLI, and Slack.

The tool-call event is the one that matters for agents. With Validate tool calls on, the hook fires before any tool call in a response runs — one verdict covering all calls in that response — and the organization’s own help overview states explicitly that this includes tool calls made through skills, plugins, and connected tools. That sentence connects directly to three of this site’s longest-running threads: poisoned skills and configuration files as an attack path (TrapDoor, MCPhantom), extensions that convert a signed-in agent session into remote code execution (ThisBash, November 2026), and UI escapes that defeat prompt-injection defenses (the Lockdown Mode popup bypass, November 2026). Every one of those techniques ultimately resolves into a tool call. Anthropic just gave defenders a veto at exactly that point — provided they wire it up and read the failure modes below.

The failure mode ships fail-open, and the timeout is five seconds

The configuration documentation states the defaults plainly: on first save, failure handling is “Allow the request” with a 5,000 ms verdict timeout (configurable from 1 to 10,000 ms). If the customer’s security server is unreachable, errors, or answers too slowly, the request proceeds to the model uninspected. Sustained server-side failures trip a circuit breaker that stops contacting the endpoint and applies the same failure-handling setting to every request until verdicts flow again. Rollout tooling softens the landing — shadow mode observes verdicts on live traffic without blocking, a rollout percentage inspects a chosen fraction of requests, and role exclusions exempt members of chosen roles — and the setup flow is deliberately staged so that merely allowing the feature never starts inspection: enforcement stays off until an Owner turns it on in the final step. Only the Owner and Primary owner roles hold the organization:manage permission required to configure any of it.

That default is the single most important line in the release for any team planning to show these controls to an auditor. Fail-open keeps the business running through a DLP outage; it also means every minute of that outage is a minute without DLP. Independent analysis of the release (Beri’s D*AI*LY BRIEF, 6 November) correctly flagged the default on day one — and the vendor’s own configuration guide confirms it, so teams touching regulated data should treat switching the default to Block the request as step zero, not step one.

What the hook never sees

The “current limitations” section of the documentation reads like a pre-written risk register, and security teams should paste it into theirs nearly verbatim:

No raw file or image bytes. The security server receives transcript text, tool calls and their results, and text extracted from attachments — never raw file or image bytes, system prompts, or Anthropic-internal context. Image-only content, such as a screenshot of a document, is not inspected. A DLP story that ends at “hooks are on” has a screenshot-shaped hole in it.
Allow or deny only. Verdicts cannot rewrite or redact a prompt — there is no “strip the card number and continue.” Enforcement is binary per request.
Voice is partial. Prompts and tool calls are sent in voice mode, but “a small share of tool calls isn’t,” and the docs advise against relying on hooks as the sole voice control.
Some calls sit outside the hook by design. With Validate tool calls on, calls to some of claude.ai’s own housekeeping tools (connector/plugin/skill search and suggestions, tool search, model switching, memory reads) may be skipped, though their results appear in the next prompt event. Separately, model calls Anthropic itself makes for Claude Security scans, Code Review on pull requests, and smart reports are not governed requests and are never sent to the endpoint.
Scope boundaries. Hooks are Enterprise-only, unavailable on Amazon Bedrock and Google Cloud, and out of scope for Claude Platform (API) organizations.

One more documented behavior deserves a place in incident runbooks: a denied message stays in the conversation under the product’s own retention rules, and because each request carries the whole transcript, follow-up messages re-trigger the denial until the user edits or removes the blocked content — including files Claude would read again. Deny-handling is therefore partly a user-education problem, not purely a control problem.

Security Center: posture page, not certification

The beta Security Center is a page in Organization settings that lines up chat, Cowork, and Claude Code settings against Anthropic’s recommended configuration — current value, recommended value where one exists, and a link to the setting — flags controls that are new or recently changed, and re-checks automatically on every page load. Organizations with the Compliance API can read the same posture results through it. Attestations give admins a shared workspace to record control state, accept risks, and flag issues once, and the page exports a report for auditors that marks which controls were checked automatically and which an Owner confirmed. Anthropic’s own framing is the one to repeat to leadership: the Center is guidance based on its recommendations, not a certification or a guarantee of compliance with any law or standard. File the export as evidence, not as a verdict.

A sign-out that is not an offboarding

The beta Admin API call signs a member out of Claude everywhere — every browser and device, with Claude Code forced to re-authenticate — in one call. The announcement states the limits in the same paragraph: it does not end API keys, cloud sessions already running, or scheduled routines, and the member keeps their membership and can sign back in. An offboarding runbook therefore still needs separate steps for key revocation (keys keep working), scheduled-task shutdown (tasks keep running even after the conversation that created them is deleted), and cloud-session review. The surrounding access controls follow the same “real control, read the scope” pattern: self-serve IP allowlisting (beta) limits most products to approved addresses; on managed computers, admins can block personal and outside Claude accounts in Claude Desktop against shadow IT and owners can limit which workspace folders people use.

Centralized management (beta) gives a parent organization one console for SSO, SCIM directory sync, domain verification, groups, and Compliance API keys across its child organizations, with multi-identity-provider support and two new roles — parent owners manage everything including role assignment, parent admins manage everything except it. Two warnings come straight from the announcement: setup can’t be undone, so the parent-admin decision needs to precede the clicking; and parent-level Compliance API keys can read data across every child organization, making them the most sensitive credential in the estate.

EDR inside the VM, detection-only, local only

When Cowork and unified Claude work locally, shell commands and code run in an isolated VM on the user’s computer. Admins can now run their organization’s EDR sensor inside that VM — set up via device management on macOS and Windows, with the sensor package’s vendor signature verified on every VM start. The two limits are stated outright: sensors run in detection mode (they report activity to the team’s console; they don’t block it), and coverage is the local VM only — not Cowork sessions in the cloud, which run on Anthropic’s servers where no sensor can be installed. That asymmetry now cuts against the direction of travel — remote cloud sessions are where agentic work is heading — so teams should size the pilot accordingly: useful endpoint telemetry for laptop execution, no answer for cloud execution.

What to do

Turn hooks on in shadow mode first, then choose the failure mode on purpose. Run two weeks of live verdicts against your DLP vendor, count would-be denials in your own server logs, and switch regulated-data groups to fail-closed before you enforce anything. The default is fail-open; leaving it there is a decision, so make it deliberately.
Write the image-upload policy separately. Screenshots and image-only attachments bypass inspection entirely. If Claude handles documents in your org, that gap needs its own control, not a footnote.
Fix the offboarding runbook before you need it. Add API-key revocation, scheduled-routine shutdown, and cloud-session review as mandatory steps after the sign-out call — and treat parent-level Compliance API keys as tier-zero credentials.
Export the Security Center report, then assign every gap an owner. It is a well-structured to-do list with an audit-friendly paper trail, which is exactly what it claims to be and exactly what it is not more than.
Put pre-tool-call hooks on the same roadmap as skill governance. Scanning keeps malicious skills out; hooks constrain what admitted skills, plugins, and MCP-connected tools can execute. Either control alone is half the story this site has been telling since TrapDoor.

Verification note: every product claim above was read from primary sources first-hand. We read Anthropic’s announcement “More visibility and control over Claude Enterprise for security teams” (claude.com, dated 5 November 2026) in full, the Claude Help Center release-notes entry for 5 November 2026, the skill-and-plugin-scanning entry dated 6 August 2026, the Inference hooks overview, and the Inference hooks technical and configuration documentation on platform.claude.com (Enterprise-only scope, Owner/Primary-owner configuration, 5,000 ms default timeout, first-save Allow-the-request default, circuit breaker, shadow/rollout/exclusion tooling, attachment-text-only inspection, allow/deny-only verdicts, voice and housekeeping-tool gaps, Bedrock/Cloud and Platform-API exclusions, endpoint hosting requirements). Secondary analysis (Beri, 6 November) was used only for framing and was cross-checked against the vendor documentation before repeating any of its claims. We did not configure hooks, run a security server, enroll an organization, or contact any vendor.

Sources: