Anthropic Put a Veto in Front of Every Enterprise Prompt

On August 5, Anthropic shipped inference hooks to Claude Enterprise in beta. The mechanic is one sentence: before Claude generates anything, the prompt goes to the customer's own security server, and the server returns allow or deny.

The same check runs on tool call responses on the way back in.

That is a small feature description for what is, structurally, the most consequential thing an AI vendor has shipped to security teams this year — because it relocates the enforcement point from where enterprises have been failing to put it to the only place it can actually work.

The problem it's actually solving

Data loss prevention was built for a world of files and endpoints. You inspect email leaving the perimeter, uploads to unsanctioned SaaS, USB writes, browser sessions. Every one of those controls assumes the sensitive thing takes a route you can stand in front of.

An LLM breaks that assumption twice.

First, the exfiltration path is a text box. An employee pasting a customer table into a prompt is not doing anything a network DLP appliance recognizes as unusual — it's an HTTPS POST to an approved vendor. The classic answer, a browser extension or a proxy that inspects the request, works until the same model is reachable from an IDE, a terminal, a desktop agent, and a mobile client. Then you are writing an integration per surface, and each one is a place the coverage silently ends.

Second, and worse, agents originate their own requests. When Claude Code reads a file, when an MCP connector returns a database row, when a skill pulls from an internal wiki — that content enters the model's context without a human ever having typed it. There is no endpoint to instrument because there is no endpoint. The 2026 run of reported agent-security incidents has largely followed this shape: not exotic model exploits, but agents reaching production systems and credentials because the controls assumed a person was in the loop.

Inference hooks answer both by moving the checkpoint inside the vendor's own inference path.

How it works

Claude sends the prompt and its context over a signed connection to a server the organization runs. The server evaluates against whatever policy it already enforces and returns a verdict. Claude waits. If the verdict is deny, generation never happens.

Coverage is the part that matters: Claude chat, Claude Code, Claude Cowork, and other Enterprise surfaces, plus tool calls arriving via MCP connectors, skills, and plugins. One policy server, every surface, no per-product integration.

It is webhook-shaped by design, so it plugs into what security teams already own — Netskope, Palo Alto Networks, Proofpoint, Zscaler, or a server written in-house. Rollout controls are the boring, correct ones: a shadow mode that always allows while logging verdicts, role-based exclusions, percentage-based rollouts, and configurable timeouts and failure policies.

That last item is the one to read closely. A synchronous check in front of every inference call is a latency tax and a new single point of failure. "Customizable failure policies" means each organization gets to decide whether an unreachable DLP server fails open — degrading to no enforcement — or fails closed and takes Claude down for everyone. Both answers are defensible and both are somebody's incident report.

Andrew Grimmett, VP of Information Security at Bandwidth, framed the appeal exactly as a security buyer would: a checkpoint to inspect what's flowing to Claude before anything sensitive leaves the environment.

What it can't do yet

Two limits define the beta.

It's binary. The server can allow or deny. It cannot rewrite or redact. That is a meaningful gap, because the most common real-world DLP outcome is not "block this employee" — it's "strip the sixteen-digit numbers and let the request through." Deny-only enforcement pushes organizations toward loose policies, since a tight one turns into a helpdesk queue. Redaction is where this feature becomes usable at scale rather than usable at demo scale.

It's prompt-side. The only hook event at launch fires before inference. Response-side enforcement — inspecting what the model returns before a human sees it — is planned but not shipped. Prompt-side stops the employee leaking data to the model. It does nothing about the model surfacing something out of a connected system that the employee shouldn't see, which is the failure mode enterprises hit the moment they wire Claude into a document store with imperfect permissions.

Anthropic is being straight about both, which is more than the category usually manages.

Why the vendor had to build it

There's a strategic reading here beyond compliance checkboxes.

Every third-party AI security product — the runtime guardrail startups, the AI gateways, the prompt firewalls — is fundamentally a proxy. It works by sitting between the user and the model, which means it works exactly as well as its coverage of surfaces, and coverage is exactly what a vendor shipping desktop agents, CLI tools, and an MCP ecosystem keeps breaking.

By exposing the hook itself, Anthropic makes the model provider the enforcement point and the security vendors the policy engines. That is a better deal for customers and a narrower business for anyone whose product was the interception. It also removes the last honest objection to deploying agents in regulated environments: we can't see what they're doing. Now you can, and the seeing is your own server's job.

MCP crossing 400 million monthly SDK downloads is the context. When the connector layer becomes ambient, the choke point has to move to the model.

What to watch

Whether redaction ships. Allow/deny is a beta. Transform is a product.

Whether OpenAI and Google mirror it. A vendor-specific hook is a feature; three vendors with incompatible hook protocols is a problem that gets standardized, probably through MCP or something adjacent to it.

Whether anyone runs it in enforce mode. Shadow mode is free. Fail-closed enforcement in front of every prompt is an availability decision, and the honest test of this feature is how many enterprises leave shadow mode within a quarter.

The read

Enterprises spent 2026 discovering that agent security is not model security — it's plumbing security, and their plumbing had no valves. Anthropic just installed one, in the only place a valve does any good, and handed the handle to the customer.

It's incomplete. It's also the first control in this category that doesn't have a surface it forgot about.