Anthropic announced a substantial Claude Enterprise security update on November 5, 2026, combining a new security center with generally available inference hooks. The hooks let organizations send governed prompts and proposed tool calls to a customer-operated security service for an allow-or-deny decision before Claude proceeds.
The release gives security teams two distinct capabilities: visibility into Claude’s configuration and an enforcement point inside its request flow. The status distinction matters, though. Prompt and pre-tool-call inference hooks are generally available; the security center, centralized management and several access controls remain beta. Anthropic describes the package in its enterprise-security announcement.
For deployment planning, the release breaks down like this:
| Capability | Release status | Main purpose |
|---|---|---|
| Prompt inference hooks | Generally available | Check governed requests before inference |
| Pre-tool-call inference hooks | Generally available | Check proposed tool calls before execution |
| Security center | Beta | Compare settings with Anthropic’s recommendations |
| Centralized management | Beta | Manage company-wide identity settings across organizations |
| API member sign-out and self-service IP allowlists | Beta | End member sessions and restrict network access |
| Additional Claude Desktop controls | Beta | Manage settings and restrict outside accounts on managed computers |
Availability still depends on the product, plan and applicable beta limits. Inference hooks specifically require Claude Enterprise, and teams should confirm coverage for the surfaces they intend to govern.
How inference hooks enforce policy
Inference hooks run on Anthropic’s servers after a request leaves the client and before the relevant inference or action proceeds. Anthropic sends an HTTPS request to an AI security server operated by the customer or its security vendor, then waits for a verdict.
That server-side placement is the consequential change. Anthropic says one setup can govern supported requests across Claude, Claude Code, Cowork and other Claude Enterprise products, without deploying hook software on individual devices. The inference-hooks documentation describes two events:
prompt: Runs before each governed inference request.tool_call: Runs before proposed tool calls execute, when the organization enables Validate tool calls.
For a prompt check, the security service receives the conversation transcript and decides whether inference may proceed. An allow verdict has this documented JSON form:
{"action": "allow"}
This response authorizes the request to continue. A deny verdict blocks it, and its deny_reason supplies part of the message shown to the user. Administrators can add a standing message explaining whom to contact or how to request an exception. Denials also appear in the organization’s Activity Feed.
Pre-tool-call validation adds a separate decision point. A prompt may be acceptable while a subsequent tool action violates policy, so checking the initial request alone leaves an important gap. Anthropic’s documentation says one tool-call verdict covers all tool calls in that model response.
Tool results can also enter the checked flow when they return for inference. This is part of the documented request flow, not a third hook event.
The inspection boundary has limits
The security service receives transcript text, tool calls and results, and text extracted from attachments. It does not receive raw file or image bytes, system prompts or Anthropic-internal context.
That boundary matters for data-loss prevention. A policy requiring inspection of an original binary attachment cannot assume the hook supplies that file. Teams need to map their rules to the content actually delivered.
I’d also treat the security endpoint as a sensitive data processor: routing conversations into it creates another place where access controls, logging and retention need scrutiny. Anthropic says the hook system itself retains configuration and activity metadata, not its own copy of prompt or response content. That statement does not describe what a customer’s security server stores.
These are documented enforcement mechanisms, not independently measured security outcomes. The announcement provides no independent effectiveness measurements for customer-built or vendor-operated hook policies.
The security center shows posture, not certification
The beta security center lives under Organization settings → Security posture. It brings together controls for the organization, chats, Cowork and Claude Code, comparing current values with Anthropic’s recommendations.
According to the security-center Help Center documentation, controls can appear as:
- Passed: The value matches Anthropic’s recommendation.
- Failed: The value differs, with an explanation and a link to change it.
- Not attested: A person needs to confirm the control.
- Shown for information: The setting is reported without a pass-or-fail judgment.
The page is view-only. Administrators must change settings in their respective configuration pages. Automatically checked controls refresh when the security-center page loads, while externally managed settings may require an Owner’s attestation.
This distinction is useful for audits. A setting read directly from Claude and a setting confirmed manually through a device-management system are different kinds of evidence. The downloadable PDF separates automatically checked controls from Owner-confirmed ones and records attestation details.
Anthropic explicitly calls the security center “guidance, not a guarantee.” Neither the page nor its PDF is a security certification.
My view is that the dashboard’s most useful role is configuration review: spotting changes, assigning follow-up work and recording accepted risks. A green status means alignment with Anthropic’s recommendation for that control. It cannot substitute for an organization’s legal analysis, control testing or evidence requirements.
Organizations with the Compliance API enabled can also retrieve posture data programmatically, and control-status changes generate activity-feed events.
Beta management controls need their own rollout plan
Centralized management introduces a parent-organization console at admin.claude.com for company-wide identity settings across Claude Enterprise and Claude Platform organizations. It covers single sign-on, SCIM directory synchronization, domain verification, groups and Compliance API keys.
The announcement also describes support for multiple identity providers, each with its own SSO and SCIM configuration. That can help an acquired business retain its existing provider while a company migrates domains incrementally.
The permission boundary deserves attention:
- Each organization keeps its own members, roles and organization-level controls.
- A parent-level role does not automatically grant access inside each organization.
- Compliance API keys created at the parent level can read data across organizations.
That last point makes parent-level API credentials especially sensitive. A team consolidating identity administration should review data-access scope alongside administrative convenience.
The beta access controls add several more operational options. Enterprise administrators can manage IP allowlists themselves, set commonly used Claude Desktop settings without a device-management push, and block personal or other outside Claude accounts in Claude Desktop on managed computers. Owners can also restrict permitted workspace folders.
Those desktop restrictions have a defined scope. Blocking outside accounts in the managed desktop application should not be read as a blanket claim that every possible route to an outside AI account is covered.
Test shadow mode and failure handling before enforcement
Inference hooks offer three documented rollout controls:
Frequently Asked Questions
3 questions
1Who can configure inference hooks?
Inference hooks require the organization:manage permission in Claude, which Anthropic says is held by Owner and Primary owner roles. They are available only to Claude Enterprise organizations. See the hooks documentation.
