Enterprise DLP sits at the edge. Email gateways, proxy inspection, endpoint agents. Every tool in the standard compliance stack was designed to catch sensitive data on its way out of the building.

None of them were designed for a world where the data goes to a language model first.

Anthropic launched inference hooks on August 5, a beta feature for Claude Enterprise that moves the checkpoint. Not to the network edge. To the inference layer itself, on Anthropic's servers, after the request leaves the employee's browser and before the model runs. Every governed prompt — in chat, in Claude Code, in Cowork — routes to your organization's AI security server for an allow-or-deny verdict. The model doesn't start until you say go.

The 5-second window is the key constraint. Your security server gets an HTTPS POST with the conversation transcript, signed using the Standard Webhooks specification so your server can verify it came from Anthropic and not an attacker. You return a small JSON verdict: {"action": "allow"} lets inference proceed, a deny carries a user-facing reason. If your server doesn't respond within the configured timeout, a failure policy takes over: block or pass, your call.

Source spread

• Claude — Inference hooks announcement — [hype] Anthropic's own framing; emphasizes coverage uniformity and the DLP use case. Worth reading for the declared scope.
• Claude platform docs — Inference hooks — [builder] Architecture, limitations, and availability. Primary source for technical specifics in this article.
• The Next Web — Anthropic built an inspection layer — [builder] Good on the deployment scenario and why this is different from existing enterprise controls.
• Palo Alto Networks — Prisma AIRS unified data protection for Claude — [builder] One of four named security vendor integrations; useful for understanding what the native integration ecosystem looks like.

Pros & cons

What this actually does:

• The coverage uniformity is real. One webhook configuration governs claude.ai, Cowork, and Claude Code across web, desktop, and CLI. Configure it once, cover every governed surface Anthropic controls directly. If you're an enterprise with all three surfaces in deployment, that's a meaningful reduction in compliance surface area.
• Running before inference matters for some regulated industries in a way that network-layer DLP doesn't cover. If a prompt containing PHI or classified content reaches the model, a data-handling obligation may have already arisen even if the model doesn't surface that content in its response. Inference hooks blocks the prompt before inference begins — before the model ever sees it.
• The staged rollout design is smart engineering. Shadow mode observes verdicts on live traffic without blocking anything. Rollout percentage lets you ramp gradually. Role-based exclusions exempt specific populations. Most enterprise compliance rollouts fail because day-one enforcement breaks workflows; shadow mode is the right answer to that.
• Standard Webhooks signature verification means your security server can validate that each POST actually came from Anthropic. Not every webhook implementation provides this.

What it doesn't cover:

• Image bytes are not sent. Screenshots, scanned documents, images of data — none of this reaches your DLP endpoint. Your server receives text extracted from attachments, but image-only content is invisible. A user who photographs a sensitive document and uploads it may bypass inference hooks entirely.
• Allow/deny only. You can't redact a prompt and pass it through modified. Partially-compliant prompts have to be blocked and resubmitted.
• Platform API organizations are excluded. Accessing Claude via the Claude Platform API rather than through a Claude Enterprise organization on claude.ai means inference hooks doesn't apply.
• Bedrock and Google Cloud are out of scope. One unified config only works for surfaces Anthropic directly controls.

Samwise's take

What builders need to know

• Inference hooks documentation lives in Claude's platform docs. Review the architecture section before scoping your security integration.
• Start in shadow mode. Don't enable blocking enforcement on day one. Use shadow mode to observe verdicts on live traffic; ramp enforcement only after your false-positive rate drops to an acceptable level.
• The image blind spot is real. Inference hooks sees extracted text, not raw image bytes. If image-based document submission is a risk in your deployment, this doesn't cover it — you need a separate control.
• Bedrock and Google Cloud aren't covered. Inference hooks applies only to Claude Enterprise organizations on Anthropic's own infrastructure. If your Claude deployment runs through AWS or GCP, this feature doesn't exist for you.
• Check with your security vendor before building a custom endpoint. Netskope, Palo Alto Networks (Prisma AIRS), Proofpoint, and Zscaler all have or are building native inference hooks integrations. You may not need to build a custom endpoint at all.
• Design for the full use-case surface, not just DLP. The inference hooks architecture also supports real-time transcript archival, prompt telemetry, and custom policy engines. Design for all of these upfront — retrofitting them later means modifying a production webhook you'll be reluctant to touch.

Further reading

• Claude — Inference hooks announcement — official launch post
• Claude platform docs — Inference hooks — architecture, use cases, limitations, availability
• Claude platform docs — Develop an inference hooks integration — request/verdict schemas, signature verification
• Claude platform docs — Configure inference hooks — shadow mode, rollout percentage, exclusions
• Palo Alto Networks — Prisma AIRS unified data protection for Claude — example of a native vendor integration