Inference Hooks: A Gate That Opens Before the Model Sees Anything

On August 5, 2026, Anthropic shipped Inference hooks in beta for Claude Enterprise organizations. When a user submits a prompt, Anthropic's servers forward the full transcript over HTTPS POST to an AI security server the organization operates, and that server's allow-or-deny verdict decides whether inference proceeds. The check runs on Anthropic's side rather than the client, so there is nothing to install, and it applies uniformly across claude.ai, Cowork, and Claude Code on web, desktop, and CLI.

The only hook event today is prompt, firing once right before inference; response-side enforcement is planned as a later event. The verdict timeout defaults to 5,000ms (configurable from 1 to 10,000ms), and if your security server misses that window, your organization's failure-handling policy — block or allow — applies automatically.

A Binary Verdict, and What the Server Actually Sees

Your security server receives the same transcript text, tool calls and results, and text extracted from attachments that the user sees — never raw file or image bytes, system prompts, or Anthropic-internal context. Sensitive data that exists only as an image, like a screenshot, is invisible to the check.

The verdict itself is binary — allow or deny — with no support for rewriting or redacting a prompt. Platform (API) organizations, requests routed through Bedrock or Google Cloud, and voice mode all fall outside its scope, so map exactly which surfaces you actually control before you commit to it as a compliance control.

From Shadow Mode to Circuit Breaker: A Rollout Playbook

Fix four numbers before turning anything on. Set the verdict timeout to the lowest value your security server can reliably meet — trimming it from the 5,000ms default to something like 2,000ms cuts user-facing latency. Start the rollout percentage at 0% and raise it only after a shadow-mode observation window; keep the custom blocked-prompt message under 500 characters and name a contact channel; register up to 16 signed headers so your server can authenticate the caller.

The most common failure is skipping shadow mode and flipping straight to Enforce verdicts. Shadow mode runs verdicts against live traffic without blocking anything, so jumping to enforcement before you've measured your false-positive rate blocks legitimate work from day one. Setting the timeout too aggressively causes the same failure by a different path: a timeout is treated identically to an unreachable server, so in Block mode latency becomes a denial, and in Allow mode it becomes a silent gap in coverage.

Sustained failures on your security server trip the circuit breaker automatically — subsequent requests skip the server and fall back to your failure-handling setting, while administrators get a notification-center alert. Under Block mode, that means the whole organization is locked out from that moment on, so the fix-and-recover procedure — fix the server, then turn Enforce verdicts back on to reset the breaker — needs to be a documented runbook, not tribal knowledge. To exempt specific roles, use custom-role exclusions; if role lookup itself fails, the default behavior closes with a retryable error rather than letting the request through.

Before rollout, run Test connection to reproduce every failure mode — malformed URL, private IP, timeout, non-200 status, unparseable body — one at a time. Signature verification follows the Standard Webhooks spec, and rotating your signing secret is an immediate cutover: the old secret is revoked at once with no overlap window, so your server needs to handle the old-to-new transition on its own. The health dashboard shows endpoint status, failures per minute averaged over the last two minutes, block rate, and breaker history, but it's best-effort — a clean-looking panel is not proof your server is actually healthy — and denial records carry an identifier worth joining against your own incident logs.

Takeaways to Act On

Inference hooks route every prompt to your security server for a binary verdict within a 5,000ms default timeout before the model ever sees it. Measure your false-positive rate in shadow mode first, raise the rollout percentage from 0% in stages, and rehearse how a circuit-breaker trip interacts with your Block-or-Allow failure setting before go-live — skipping that rehearsal is what turns week one into an incident.

References

Inference hooks — Claude Platform Docs (Anthropic)

Configure Inference hooks — Claude Platform Docs (Anthropic)