In August, Anthropic shipped something called Inference Hooks for Claude Enterprise. It is in beta, it is easy to miss, and I think it is the most important thing a frontier lab has done for enterprise AI governance this year. Not because of what it does. Because of what it admits.
Here is what it does. When Inference Hooks is turned on, each request covered by the hook is checked first by the customer’s governance endpoint—an HTTPS service operated by the enterprise or its AI governance vendor. Before the model runs, Anthropic’s infrastructure sends that endpoint the conversation as the user sees it: the prompt, earlier turns, text extracted from attachments, and tool calls together with their results. The endpoint evaluates that context against the enterprise’s policies and returns allow or deny. When enforcement is active, an allow verdict lets the model proceed; a denial stops the request before it reaches the model. One configuration covers claude.ai, Claude Code, and Cowork.
Look at that from the vendor's side. Anthropic built a control point inside its own inference path, and then gave the decision at that control point to the enterprise.
For two years the answer from every model vendor to "how do we govern this" has been some version of trust us. Trust our safety filters. Trust our admin console. Trust the audit log you can export after the fact. Every one of those keeps the governance decision inside the vendor's product, made on the vendor's terms.
Inference Hooks breaks that pattern. Anthropic already had a Compliance API; their own docs now contrast the two as "inline, before inference runs" versus "after the fact." They looked at what enterprises were actually asking for and concluded that the right place for a policy decision is not inside Claude. It is inside a governance endpoint the enterprise controls, running the enterprise's policy, keeping the enterprise's records.
That is an acknowledgement that governance is the customer's job, and that the vendor's job is to expose a clean place to plug it in. I have believed this for a long time. Every health system I talk to runs more than one model, has AI features showing up inside software they bought for other reasons, and has people using tools nobody approved. You cannot govern that estate with a different admin console per vendor. You need one control plane for your organization’s policies, enforced the same way, everywhere a model is being asked a question. Anthropic building the hook for that is the first frontier lab agreeing out loud.
There is a detail here I want to call out on its own, because it is a very useful surface Anthropic has exposed, and one that no outside control could reach before.
If you govern AI from the network, the way most enterprise security tooling does, you see a request go out to a model provider and a response come back. That is fine when a person types a question and gets an answer. It is nowhere near fine for an agent. An agent gets a prompt, decides to call a tool, gets a result back, feeds that result into its own context, and decides what to do next. Sometimes that loop runs many times in a single turn. Much of it never crosses a boundary where an outside control can see it. When Claude calls a remote MCP server or a connector, that call happens from Anthropic's infrastructure, and the record that comes back may never pass through the enterprise's network at all.
Inference Hooks sends those tool results to the governance endpoint before the model consumes them. That is per-tool-call visibility you cannot reliably get from outside the loop, because only the party running the loop can expose it. Anthropic is that party, and they did.
I want to be direct about the limits, because the announcement does not dwell on them.
The hook checks inference requests, meaning everything going into the model, and only that. There is no check on the responses Claude generates. A response does show up in the transcript of the next inference request, so the governance endpoint can still catch a problem after the fact, but it cannot stop that response before the clinician reads it. Anthropic's docs say response-side enforcement is planned as a later event, and I take that at face value. As of now, though, only half of the conversation can be stopped.
The verdict is also allow or deny. No redaction, no rewriting, no "let this through with the patient identifier masked." Their docs say so plainly. In healthcare, that is a real gap, because the right call is rarely to block a clinician's whole conversation. It is almost always to handle one field correctly and let the rest of the work continue. A binary gate forces a choice between breaking useful work and letting sensitive data through. Proportional handling would require Anthropic to add transformation; the current hook does not support it.
As far as I can tell, no other frontier lab has shipped anything like this: a customer-hosted governance endpoint that sees prompts and tool results across the vendor's own applications and gets to say no. There are vendor-hosted content filters elsewhere, and some of them are inline. That is not the same thing. A filter the vendor runs is the vendor deciding for you. The whole point here is that the decision moves to the customer.
I would like every company that puts a model in front of a clinician to expose this, including the ones that are not model vendors at all. If Anthropic can call out to an enterprise's governance endpoint before its model acts, the application vendor embedding a model into a clinical workflow can do it too. Health systems should ask for it in every AI procurement conversation, and should read a vendor who will not offer it as a vendor that does not yet provide an adequate enterprise control point.
Anthropic has defined a few conventions that the rest of the industry then adopted; MCP is the obvious one. I hope this is another. The enterprise should own the control point. The vendor's job is to expose it.
Nitin Goel is CTO of Vitea, an AI governance platform for healthcare. Vitea helps health systems see, control, and prove how AI is used across their organizations.
.png)
.png)
.png)
.png)
