Claude Enterprise Adds Security Center and GA Hooks | Zeniteq
Loading
Loading article
Zeniteq is now available on mobile for iPhone, iPad and Apple Watch.Download nowLearn more
Claude Enterprise Adds Security Center and GA Hooks
Anthropic’s enterprise-security update makes inference hooks generally available, while its new posture dashboard and several management controls remain in beta.
Anthropic’s November 2026 update introduces generally available inference hooks, allowing organizations to route prompts and tool calls to external security services for real-time allow or deny decisions before processing. This server-side integration enables centralized governance across Claude, Claude Code, and Cowork without requiring device-level software. While these hooks provide crucial enforcement, the new security center and centralized management tools remain in beta. Security teams must carefully configure failure policies, as choosing to block or allow traffic during service outages directly impacts both operational continuity and risk exposure.
Anthropic announced a substantial Claude Enterprise security update on November 5, 2026, combining a new security center with generally available inference hooks. The hooks let organizations send governed prompts and proposed tool calls to a customer-operated security service for an allow-or-deny decision before Claude proceeds.
The release gives security teams two distinct capabilities: visibility into Claude’s configuration and an enforcement point inside its request flow. The status distinction matters, though. Prompt and pre-tool-call inference hooks are generally available; the security center, centralized management and several access controls remain beta. Anthropic describes the package in its enterprise-security announcement.
For deployment planning, the release breaks down like this:
Capability
Release status
Main purpose
Prompt inference hooks
Generally available
Check governed requests before inference
Pre-tool-call inference hooks
Generally available
Check proposed tool calls before execution
Security center
Beta
Compare settings with Anthropic’s recommendations
Centralized management
Beta
Manage company-wide identity settings across organizations
API member sign-out and self-service IP allowlists
Beta
End member sessions and restrict network access
Additional Claude Desktop controls
Beta
Manage settings and restrict outside accounts on managed computers
Availability still depends on the product, plan and applicable beta limits. Inference hooks specifically require Claude Enterprise, and teams should confirm coverage for the surfaces they intend to govern.
How inference hooks enforce policy
Inference hooks run on Anthropic’s servers after a request leaves the client and before the relevant inference or action proceeds. Anthropic sends an HTTPS request to an AI security server operated by the customer or its security vendor, then waits for a verdict.
That server-side placement is the consequential change. Anthropic says one setup can govern supported requests across Claude, Claude Code, Cowork and other Claude Enterprise products, without deploying hook software on individual devices. The inference-hooks documentation describes two events:
prompt: Runs before each governed inference request.
tool_call: Runs before proposed tool calls execute, when the organization enables Validate tool calls.
For a prompt check, the security service receives the conversation transcript and decides whether inference may proceed. An allow verdict has this documented JSON form:
{"action": "allow"}
This response authorizes the request to continue. A deny verdict blocks it, and its deny_reason supplies part of the message shown to the user. Administrators can add a standing message explaining whom to contact or how to request an exception. Denials also appear in the organization’s Activity Feed.
Pre-tool-call validation adds a separate decision point. A prompt may be acceptable while a subsequent tool action violates policy, so checking the initial request alone leaves an important gap. Anthropic’s documentation says one tool-call verdict covers all tool calls in that model response.
Tool results can also enter the checked flow when they return for inference. This is part of the documented request flow, not a third hook event.
The inspection boundary has limits
The security service receives transcript text, tool calls and results, and text extracted from attachments. It does not receive raw file or image bytes, system prompts or Anthropic-internal context.
That boundary matters for data-loss prevention. A policy requiring inspection of an original binary attachment cannot assume the hook supplies that file. Teams need to map their rules to the content actually delivered.
I’d also treat the security endpoint as a sensitive data processor: routing conversations into it creates another place where access controls, logging and retention need scrutiny. Anthropic says the hook system itself retains configuration and activity metadata, not its own copy of prompt or response content. That statement does not describe what a customer’s security server stores.
These are documented enforcement mechanisms, not independently measured security outcomes. The announcement provides no independent effectiveness measurements for customer-built or vendor-operated hook policies.
The security center shows posture, not certification
The beta security center lives under Organization settings → Security posture. It brings together controls for the organization, chats, Cowork and Claude Code, comparing current values with Anthropic’s recommendations.
Passed: The value matches Anthropic’s recommendation.
Failed: The value differs, with an explanation and a link to change it.
Not attested: A person needs to confirm the control.
Shown for information: The setting is reported without a pass-or-fail judgment.
The page is view-only. Administrators must change settings in their respective configuration pages. Automatically checked controls refresh when the security-center page loads, while externally managed settings may require an Owner’s attestation.
This distinction is useful for audits. A setting read directly from Claude and a setting confirmed manually through a device-management system are different kinds of evidence. The downloadable PDF separates automatically checked controls from Owner-confirmed ones and records attestation details.
Anthropic explicitly calls the security center “guidance, not a guarantee.” Neither the page nor its PDF is a security certification.
My view is that the dashboard’s most useful role is configuration review: spotting changes, assigning follow-up work and recording accepted risks. A green status means alignment with Anthropic’s recommendation for that control. It cannot substitute for an organization’s legal analysis, control testing or evidence requirements.
Organizations with the Compliance API enabled can also retrieve posture data programmatically, and control-status changes generate activity-feed events.
Beta management controls need their own rollout plan
Centralized management introduces a parent-organization console at admin.claude.com for company-wide identity settings across Claude Enterprise and Claude Platform organizations. It covers single sign-on, SCIM directory synchronization, domain verification, groups and Compliance API keys.
The announcement also describes support for multiple identity providers, each with its own SSO and SCIM configuration. That can help an acquired business retain its existing provider while a company migrates domains incrementally.
The permission boundary deserves attention:
Each organization keeps its own members, roles and organization-level controls.
A parent-level role does not automatically grant access inside each organization.
Compliance API keys created at the parent level can read data across organizations.
That last point makes parent-level API credentials especially sensitive. A team consolidating identity administration should review data-access scope alongside administrative convenience.
The beta access controls add several more operational options. Enterprise administrators can manage IP allowlists themselves, set commonly used Claude Desktop settings without a device-management push, and block personal or other outside Claude accounts in Claude Desktop on managed computers. Owners can also restrict permitted workspace folders.
Those desktop restrictions have a defined scope. Blocking outside accounts in the managed desktop application should not be read as a blanket claim that every possible route to an outside AI account is covered.
Test shadow mode and failure handling before enforcement
Inference hooks offer three documented rollout controls:
Control
What it does
What to check
Shadow mode
Observes verdicts on live traffic without blocking
Whether policies flag legitimate work
Rollout percentage
Inspects a selected fraction of requests
Whether coverage and operational capacity are sufficient
Role exclusions
Exempts members of selected roles entirely
Whether exceptions are deliberate and documented
Shadow mode is the sensible starting point because a valid integration can still enforce a poorly tuned policy. A security service returning technically correct denials can disrupt work if its rules are too broad.
The failure policy is equally important. Anthropic gives the security server a configurable verdict timeout, five seconds by default. If it is unreachable, returns an error or misses the deadline, the organization chooses whether Claude blocks the request or allows it without inspection.
Sustained failures attributable to the security server trigger a circuit breaker. Anthropic then stops contacting that server and applies the configured failure policy to affected requests. The breaker resets automatically once Anthropic detects that the server is returning verdicts again, according to the hooks documentation.
The practical consequence is significant: failure handling governs more than an occasional timeout. With an allow-on-failure policy, a sustained security-service outage can leave affected traffic proceeding without inspection. With block-on-failure, the same outage can interrupt Claude work even if Claude itself is available.
Neither choice is universally right. The decision should follow the sensitivity of the governed workflow and the organization’s tolerance for interruption.
A concrete audit and deployment sequence
Security teams can turn the documentation into a staged implementation:
Inventory settings and surfaces. Use the security center to review chat, Cowork and Claude Code controls. Separate automatically checked results from attestations, and confirm which products and workflows hooks cover.
Review the security service’s data handling. Establish who can access transcripts, what gets logged and how long records remain. Generate the webhook signing secret and verify incoming requests using the documented Standard Webhooks mechanism.
Build a policy test set. Include permitted work, synthetic sensitive-data examples, attachment-derived text and proposed tool calls. Test prompt and pre-tool-call rules separately.
Start in shadow mode. Review verdicts before enabling blocking. Check denial explanations and the exception-request path, not only whether a request was classified correctly.
Exercise failure paths deliberately. Test an unreachable endpoint, an error response and a delayed verdict. Verify that the selected block-or-allow behavior matches the organization’s decision, including during sustained failure and recovery.
Increase enforcement with explicit exceptions. Use the rollout percentage to expand coverage, document role exclusions and assign responsibility for maintaining the security service.
The key deployment question is whether the organization can operate its policy service reliably enough to make it part of Claude’s request path. The published controls provide the mechanism; policy quality, endpoint reliability and carefully scoped exceptions determine how useful it becomes.
Frequently Asked Questions
3 questions
1
Who can configure inference hooks?
Inference hooks require the organization:manage permission in Claude, which Anthropic says is held by Owner and Primary owner roles. They are available only to Claude Enterprise organizations. See the hooks documentation.
2
Does blocking a prompt delete it?
No. A hook denial prevents the request from reaching the model, but product retention rules still apply. Anthropic notes that a blocked message on Claude remains in the conversation. The documentation distinguishes that product storage from hook-system metadata.
3
Does API member sign-out revoke API keys?
No. The beta sign-out action ends the member’s sign-in sessions across browsers and devices, but leaves API keys, running cloud sessions and scheduled routines active. The member can also sign in again, according to the announcement. It is a session-response tool, not complete credential revocation.
