Skip to content

Claude Enterprise inference hooks, now in Metano

Metano Product TeamVarun Anand · Head of Product3 min read

Key takeaways

  • Inference hooks act before inference; the Compliance API acts after.
  • The control point moves to the service, so it no longer matters where the user sits or whether IT ever touched the device.
  • One set of guardrails applies to endpoints, browsers, and inference hooks alike, no second rulebook.
  • Named identities only: events for anyone outside scope are dropped at the door, counted, never stored.
  • Connecting it takes about ten minutes, and the first session shows up in Metano as soon as someone in scope sends a prompt.

Table of contents

A sales lead opens claude.ai on a personal iPad at the airport. Pastes in a customer’s pricing sheet. Asks for a one-page summary for the board.

Small thing. The iPad has no sensor. The browser has no extension. The security team never hears about it.

We security folks built our AI controls around the endpoint: a sensor on the laptop, an extension in the browser. That works for the devices the company owns. It does nothing for the contractor on their own machine, the engineer on a home desktop, or the iPad at the airport. Claude Enterprise gets used from all of them.

The control point moves to the service#

Diagram comparing coverage: an endpoint sensor only covers the managed laptop, while the inference hook covers all four surfaces.
Inference hooks stop a request before it runs; the Compliance API only audits it after.

In August 2026 Anthropic added inference hooks to Claude Enterprise. Before Claude runs a prompt, Anthropic sends the conversation to an HTTPS server the organization chooses. The server answers allow or deny. A denied request never reaches the model, and the user sees the reason.

The check runs on Anthropic’s side. Where the user sits, and whether IT ever touched the device, stop mattering. If the organization’s Claude account is in use, the hook fires.

One setting covers claude.ai, the desktop and mobile apps, Claude Code, Cowork, Claude for Microsoft 365, Claude in Slack, and Claude in Chrome. The server sees the transcript, the tool calls and their results, and text pulled from attachments. It does not see system prompts, raw files, or images.

Anthropic puts it simply. Inference hooks act before inference. The Compliance API acts after. One stops a request, the other audits it.

What Metano does on the other end#

  • Sessions. Each conversation becomes a session: the user, the prompts, the tools Claude called, and what came back. A Claude session from a personal phone reads the same as Cursor on a managed laptop.
  • Detections. Prompt injection, secrets and sensitive data in prompts or tool results, and tool calls outside what the agent should be doing. Each alert carries the session and the exact turn.
  • One set of guardrails. A policy written in plain English applies to endpoints, browsers, and inference hooks alike. The rule that stops a coding agent on a laptop from sending a credential out also stops Claude Code or Cowork through the hook. No second rulebook.
  • Blocking with a reason. On a deny, Metano returns the verdict and the reason. The user sees it, edits the message, and carries on. The denial is logged in Metano and in the Anthropic Activity Feed.

Start with five people#

Nobody wants monitoring every employee on day one. We don’t either.

  • Named identities only. The administrator lists the email addresses in scope. Events for anyone else are dropped at the door: counted, never stored.
  • Monitor before enforce. Anthropic’s shadow mode and Metano’s audit mode line up. Policies run, verdicts are logged, nothing is blocked. Turn on enforcement once the verdicts look right.
  • Prompt visibility is a role. Only named administrators and SOC analysts can open prompt content. Every view is logged. Prompts are encrypted at rest.

Connecting it takes about ten minutes#

  1. The Claude Enterprise primary owner allows inference hooks under Data and privacy, then creates a request signing secret.
  2. A Metano administrator opens Integrations, chooses Anthropic, selects Inference hooks, and pastes the secret.
  3. Metano shows the endpoint URL and header. Create an ingest key and copy it.
  4. Back in Claude Enterprise, add the endpoint, the header with the key, and the identities in scope. Test the connection.
  5. Start in monitor mode.

The first session shows up in Metano as soon as someone in scope sends a prompt, from whatever device they are on.

Three things to do this week#

  1. Ask the Claude Enterprise primary owner to allow inference hooks and create a signing secret. Nothing changes until an endpoint is set.
  2. Pick five users, at least one on a device IT does not manage. Run two weeks in monitor mode.
  3. Write one guardrail in plain English and watch it apply to Claude on any device, to coding agents on laptops, and in the browser.

The sales lead still gets the board summary. Just without the pricing sheet in it.

Talk to us at metano.ai.

Metano Product Team

Varun Anand

Head of Product

The team that builds Metano’s runtime defense for AI agents.