One GA Component, Six in Beta
The announcement reads as a single launch. The status list at the bottom of Anthropic's own post reads differently. Inference hooks, the mechanism that routes prompts and tool calls through a customer's data-loss-prevention tools, are generally available. The security center is in beta. So is centralized management, the parent-organization console at admin.claude.com. So are the two access controls, member sign-out through the Admin API and the self-serve IP allowlist, the new Desktop owner settings, and the EDR integration for Cowork.
The component that can enforce allow-or-deny decisions is generally available. The security center, centralized administration, new access controls and Cowork EDR integration remain in beta. GA status does not eliminate the documented inspection gaps, failure-handling choices or deployment exclusions.
One page, one baseline, one disclaimer
The security center puts Claude's settings for chat, Cowork and Claude Code on a single page in Organization settings. For each control it shows the current value, Anthropic's recommended value where one exists, and a link to the setting itself. The checks run each time the page loads, the Compliance API can read the same results, and admins can work through a review together in an attestations workspace, then download the page as a report for auditors. The report marks which controls were checked automatically and which an Owner confirmed by hand.
Anthropic's own screenshot makes two of the limits visible without any help. The page is labeled Beta, and the example organization in it passes 13 of 16 controls. The third limit is in the text: the center is, in Anthropic's words, guidance based on its recommendations, not a certification or a guarantee of compliance with any law or standard. A high score means a configuration matches Anthropic's baseline. It does not mean the configuration satisfies SOC 2, ISO 27001 or a sector rule, and Anthropic does not claim otherwise. The mapping work stays with the customer.
The hooks are the substance
Before model inference, Anthropic sends the documented prompt-hook payload to an HTTPS endpoint operated by the organization or its security vendor. The signed request allows the customer's server to evaluate the content against its policies and return an allow-or-deny verdict. Normal enforcement follows that verdict, but the organization can configure fail-open behavior when the security endpoint is unavailable or times out.
When administrators enable Validate tool calls, Anthropic also sends pre-execution tool-call information to the configured security server. According to its documentation, one allow-or-deny verdict applies to all tool calls in the response being evaluated, rather than providing a separate decision for each call. Anthropic says denied requests display the security server's reason alongside an administrator-configured message, and that denials are recorded in the organization's Activity Feed.
The documented edges matter as much as the mechanism. Anthropic's documentation says hooks receive transcript text, tool-call information and extracted attachment text, but not raw file or image bytes, system prompts or tool definitions. A screenshot of a confidential document with no extracted text would therefore have its image contents omitted from the hook's inspection. The request could still be denied based on other visible content or the organization's failure-handling policy. Hooks should not be treated as complete protection against sensitive information contained only in images. Verdicts are binary: rewriting or redacting a prompt is not supported, so a policy can stop a request or wave it through, nothing in between. Anthropic says the inference-hooks system retains configuration and verdict metadata rather than copies of the content sent for inspection. That statement does not describe all data retained elsewhere in Claude Enterprise or by the customer's security vendor. Coverage is broad across claude.ai, Cowork, Claude Code, Microsoft 365, Slack and Chrome, but it stops at the deployment boundary: no Bedrock, no Google Cloud, no Platform API organizations. In voice mode, a small share of tool calls is not sent at all, and a denial usually ends the call with a general error. Some calls Anthropic runs itself, including Claude Security's hosted scans and Code Review on GitHub pull requests, are not governed requests and never reach the customer's server.
Two operational choices will decide how the feature feels in practice. If the security server is unreachable or too slow, the organization's own failure setting chooses: block the request, or let it proceed without inspection. Sustained failures trip a circuit breaker that applies that choice to every request until the server recovers. And rollout can be gradual, with a shadow mode that records verdicts on live traffic without blocking anyone, a rollout percentage, and exemptions by role. One wrinkle is documented plainly: a denied message is resent with every later message in the same conversation, so the user has to edit or remove it before the conversation can continue.
A one-way console, a partial sign-out, a sensor that watches
The rest of the package is useful and unfinished in specific ways. Centralized management lets a parent organization run single sign-on, directory sync, domain verification, groups and Compliance API keys once, across its child organizations, with more than one identity provider if an acquisition brought its own. Each child keeps its own members and org-level controls, and a parent role does not by default grant access inside a child organization, although Compliance API keys created at the parent can read data across organizations. Anthropic states that setup cannot be undone, which makes the list of parent admins the decision to settle before anyone starts.
Member sign-out is narrower than its name suggests. One Admin API call ends a person's sessions on every browser and device, and Claude Code has to sign in again. It does not end API keys, cloud sessions already running or scheduled routines, and the member can sign in again afterwards. It is a session reset, not a revocation.
The EDR integration addresses a visibility gap in local Cowork sessions. Cowork executes commands and code inside an isolated virtual machine, limiting what a sensor running only on the host can observe. Anthropic's beta allows an approved EDR sensor to run inside that VM and report activity to the customer's existing security console. The integration operates in detection mode rather than blocking activity, and it does not cover cloud-hosted Cowork sessions. The Help Center adds that the sensor can see prompts, files and responses inside the VM and sends that data to the vendor, that removing the device-management settings does not remove a sensor already installed, and that the signature covers the package file, not updates the sensor downloads afterwards.
None of that makes the package weak. It makes it legible. An enterprise team can start with the one generally available component, hooks in shadow mode against policies it already runs, and treat the dashboard, the parent console and the sensor as what their labels say they are: beta tooling, adopted on the customer's own testing, at the customer's own risk.
Sources
- [1] Anthropic, "More visibility and control over Claude Enterprise for security teams", official announcement, 5 November 2026, read in full for this article. The status list, the security center description and its guidance-not-certification wording, centralized management, the access controls and the EDR announcement all come from this post.Read source
- [2] Anthropic, Claude Platform Docs, "Inference hooks", technical documentation, read 7 November 2026. The hook payload, verdict behavior, failure handling, rollout controls and coverage exclusions all come from this page.Read source
- [3] Anthropic, Claude Help Center, "Inference hooks overview", updated 19 October 2026.Read source
- [4] Anthropic, Claude Help Center, "Run your endpoint detection and response (EDR) sensor in Claude Cowork on Claude Desktop", updated 2 November 2026. The sensor visibility, removal and signature-scope details come from this article.Read source