Anthropic released Inference hooks in beta for Claude Enterprise organizations.
Every governed prompt routes to an AI security server — an HTTPS service the organization or its security vendor runs — which returns allow or deny before inference proceeds. One configuration covers claude.ai, Claude Cowork, and Claude Code across web, desktop, and CLI.
Placement makes an upstream reading available: the same control, better situated. Our observation is that placement is the less useful axis. What determines a verdict’s reach is the boundary it acts on — and on that axis these two systems are not one control at two heights. They are different controls at different boundaries, and an enterprise running one without the other carries a specific, nameable gap.
Two instruments, two boundaries
The inference hook binds where context enters the model. The Claude Code hook binds where state is written.
That distinction does all the work. A verdict at the context boundary decides what the model may read. A verdict at the write boundary decides what the agent may do. In a conversational surface those collapse into roughly the same thing, because reading is most of what happens. In an agentic surface they come apart completely, and Claude Code and Cowork are agentic surfaces.
Anthropic’s own launch framing marks the transition: before this release, native inline enforcement was limited to Claude Code’s client-side hooks. That is accurate, and it is also the reason the two must now be read together rather than ranked.
What the server-side hook actually gates
There is one hook event today. It is named prompt, and it fires once per governed inference request, before inference begins; response-side enforcement is documented as a later event.
That single sentence carries a consequence worth drawing out. An agent loop is not one inference request. It is many. The model emits a tool call, the harness executes it, the result comes back, and the harness issues a new inference request whose transcript now carries both the tool call and its result as content blocks. That request gets its own verdict. Anthropic states the effect plainly: when Claude calls a tool, including through MCP connectors, skills, and plugins, the tool’s response is checked before it returns to the model.
So tool results are inspected. Every hop is a new governed request.
The mechanism behind that effect — that it happens through the next prompt frame rather than through a distinct response event — is our reading of the published schema, not a vendor statement. It matters because of what it implies. By the time a frame carrying a tool call is sent for a verdict, that tool has already executed and returned. The state was written. What the verdict can prevent is the model seeing the result. It cannot prevent the action that produced it.
Enforcement binds at the context boundary. The commit boundary sits outside this instrument’s reach.
Three further limits are documented and worth holding: verdicts are binary, with rewriting or redacting a prompt explicitly unsupported; raw file and image bytes never reach the security server, so image-only content such as a screenshot is not inspected; and system prompts, tool definitions, and the model’s hidden reasoning are excluded from what the server sees.
The write boundary has three layers, not one
This is the layer to state precisely, because describing the write boundary as a single gate — as our own earlier framing did — understates the enterprise’s position.
PreToolUse is not the write-boundary control. It is one tier of three, and the precedence between them is the whole architecture.
A hook that exits with code 2 stops the tool call before permission rules are evaluated, so the block applies even where an allow rule would otherwise have let the call proceed. That makes a blocking hook authoritative over the permissive layer.
But hook decisions do not bypass permission rules. Deny and ask rules are evaluated regardless of what a PreToolUse hook returns: a matching deny blocks the call, and a matching ask still prompts, even when the hook returned allow. Deny-first precedence holds, and a managed deny cannot be overridden by any other settings scope or by command-line flags.
Beneath both sits sandboxing — OS-level containment on Bash and its child processes, which holds even if a prompt injection bypasses the model’s decision-making entirely.
So the ordering is: managed deny as the unoverridable floor, the blocking hook as the programmable tier above it, allow rules as the permissive layer, and the sandbox as containment beneath all of it. Two independent authorities can refuse, and either is sufficient alone. A hook returning allow is not sufficient, because deny and ask still apply.
That ordering also places a line in the hooks reference that stands on its own as a caution: architects are directed to use the permission system rather than a hook to enforce a hard allow or deny. Read against the precedence above, it is Anthropic naming which tier is the floor. The hook is programmable and expressive; the permission rule is unoverridable. They are not competing for the same job.
What composition delivers
Four properties emerge only when both systems are running. Stated affirmatively, because this is the strongest enterprise position either vendor primitive has yet supported.
Because the checkpoint runs inside Anthropic’s infrastructure, it reaches a Claude Code session on an unmanaged personal laptop exactly as it reaches one on a corporate device. Client-side authority depends on managed settings arriving at the machine; server-side authority does not. This is the property the client-side hook structurally cannot have.
The inference hook’s failure handling is a configured choice between blocking and allowing, though the default on first save is to allow at a 5,000 ms timeout. On the client side, forceRemoteSettingsRefresh blocks CLI startup until managed settings are freshly fetched and exits rather than continuing on stale or absent policy. Fail-closed is available on both sides of the split — a correction to the common reading that the client half simply fails open.
The server-side verdict is binary. The client-side hook is not: PreToolUse rewrites tool input and PostToolUse rewrites tool output, and the reference names redaction and transformation as intended uses. The tier that can only refuse sits where refusal is cheap. The tier that can transform sits where a false positive would otherwise block real work.
Denials record to the organization’s Activity Feed carrying the reference_id the security server supplied in its verdict. Locally, the session transcript and the prompt_id correlate to the OpenTelemetry prompt.id. Two independently produced records of the same event, joinable on a key the customer chose, is a materially different assurance position than one record produced by whoever happened to build the handler.
The hard claim
An enterprise running only the server-side hook has uniform coverage and cannot refuse a single action. An enterprise running only the client-side hooks can refuse actions on one surface and has no inspection point on any other. Neither configuration is a partial version of the other; each is complete on its own axis and empty on the opposite one.
Composition is not tuning. It is the only arrangement that produces both uniform inspection and write-path authority, and it is available today with no product that does not yet exist.
The companion dispatch enumerates the conditions under which a configured enforcement layer does not enforce — nine of them, each with its owner and its structural close.
Uniform inspection and write-path authority are separate properties held by separate instruments. The server-side hook gates what the model reads across every surface and refuses no action; the client-side boundary refuses actions on one surface and sees no other.
Neither is a partial version of the other. The enterprise position is the composition, and the composition is available today.
