Claude inference hooks leave beta, and user profiles limit a ban to one customer

Anthropic's release notes for 20 October 2026 say inference hooks are out of beta for Claude Enterprise organisations. A hook sends every prompt in the Claude apps it covers to an AI security server. That is a web service run by your organisation or your security vendor. Anthropic sends the conversation and waits for an allow or a deny, and a denied request never reaches the model.

The check runs on Anthropic's servers, after the request leaves the user's device and before the model runs, so nothing is installed on staff devices. One hook covers claude.ai, Cowork, Claude Code, Claude for Microsoft 365, Claude Tag and Claude in Chrome. That includes the web, desktop and mobile apps, the command line and Slack.

Hooks aren't available for Claude on Amazon Bedrock or Google Cloud, and Claude Platform organisations, which reach Claude through the API, are out of scope. Inside Claude Enterprise, only the Owner and Primary owner roles can set hooks up.

The security server gets the same content the user sees. That covers the conversation text, the actions Claude takes with its tools and what they return, and text pulled out of attachments. It never receives the raw file or image, the system prompt or Anthropic's internal context. The hooks system keeps no copy of prompts or responses, only settings and records such as verdicts, timestamps and request IDs.

When a request is denied, the user sees a blocked-by-policy message. It gives the server's reason and a standing note the admin writes, such as who to contact for an exception. Each denial is recorded in the organisation's Activity Feed.

If the server is down, returns an error or misses the timeout, a failure-handling setting decides what happens. The request is either blocked or allowed without inspection. The timeout is 5 seconds by default and can be changed.

Anthropic offers three controls for rolling hooks out. Shadow mode records the server's verdicts on live traffic without blocking anything. A rollout percentage inspects only a chosen share of requests, and exclusions exempt members of chosen roles.

With hooks out of beta, a security team can write them into a production rollout plan. A hook puts the team's existing data loss prevention (DLP) tool in front of the Claude apps staff use. Anthropic names DLP as the most common use. Its other examples are live transcript archiving, usage data on prompts, and policy rules such as an approved model list or limits on working hours.

The failure-handling setting is the first decision to take to the risk owner. If failures block, an outage at your security vendor can stop Claude for everyone the hook covers. If failures allow, prompts go unchecked. After repeated failures, Anthropic stops calling the server and applies the setting to every request until the server answers again.

Hooks don't inspect image-only content, such as a screenshot of a document. In voice mode a small share of tool actions isn't sent, and Anthropic advises against using hooks as the only control there. Claude Security scans, hosted Code Review on GitHub pull requests and Smart reports make their own model calls, so hooks don't govern them either.

A blocked message stays in the claude.ai conversation under the product's own retention rules, even though the model never reads it. Each later request carries the whole conversation. A server that checks the full transcript will deny those requests too. The user has to remove the blocked content, for example by editing the message, running /rewind in Claude Code or starting a new chat.

Also on 20 October 2026, Anthropic launched user profiles. A profile tells Anthropic which of your end customers an API request is for. Anthropic runs automated safety checks over API traffic, and requests made for a platform's customers arrive under the platform's own organisation.

Without profiles, one end customer can trigger an enforcement action that applies to the whole organisation. With them, a restriction or ban can apply to one profile and leave the rest of the traffic alone.

You register each customer once, store the ID Anthropic returns and send it in a header on every request for that customer. Profiles aren't billable and don't affect pricing. An application profile is one per signed-up user of your product, and a passthrough profile is one per company you resell API access to.

Your own staff's use carries no profile. Any request without a profile ID counts as your own usage, and Anthropic advises keeping that usage in a separate organisation. Profiles belong to an organisation, so separate workspaces inside one organisation aren't enough.

A profile holds only what you send, plus any Anthropic programme status, and no conversation content. The optional fields are a name, metadata, entity type, country, a reference ID, onboarding date, account status and hashes of a name or email. Anthropic doesn't verify the details. It uses them to link requests to a customer, watch for abuse, enforce its Usage Policy and run trusted access programmes.

Once a field is set, you can replace its value but you can't clear it. Deleting a profile removes what you supplied and leaves the trust and safety records Anthropic keeps about that ID.

Organization webhooks were added to the Admin API in beta. You register a web address, and Anthropic sends it an event when it restricts or bans one of your user profiles, and when that ends. Anthropic's documentation says event delivery isn't live yet, so an address registered today receives nothing. You ask your Anthropic account team for access, and organisations with HIPAA readiness turned on can't use it.

Some companies sell a product built on Claude. Others run a gateway that passes many teams' traffic through one API organisation. For both, user profiles protect business continuity, since an enforcement action on the whole organisation can stop the service for every customer at once.

Every customer request needs the ID, including those sent through Amazon Bedrock and Google Cloud. A request without one still goes through there with no customer attached, and any enforcement action it triggers applies to the whole organisation. Moving internal tools to their own organisation, as Anthropic advises, keeps your staff's tools apart from customer traffic.

The details in a profile go to Anthropic as a supplier. A data protection officer may want the chosen fields on the record of processing. Where a name or email can't be shared, Anthropic suggests sending hashes you compute yourself. Because a value can't be cleared once set, agree the fields before you register the first customer.

Once Anthropic starts sending events, webhooks can tell your systems that a customer was restricted, so support and account teams can act. Until then, Anthropic's documentation points to listing profiles by enforcement status as the way to catch up.