Claude Enterprise (beta)

Claude Enterprise's inference hooks send an organization's governed requests to an outside server for an allow or deny verdict before the model runs. Intertrace is that server. Anthropic documents one hook for every Claude product in the organization, including claude.ai (web, desktop and mobile), Cowork, Claude Code, Claude for Microsoft 365, Claude Tag and Claude in Chrome. Claude Platform (API) organizations, Amazon Bedrock and Google Cloud are not covered.

Prompts. Each prompt request carries the conversation so far. Intertrace screens what people and their tools put into it: the person's messages and the text Anthropic extracted from attachments as a prompt, tool results as content the model is about to read (hidden instructions). It uses the same checks as traffic through Intertrace's gateway, under the agent's own data and attack settings. A hook can only allow or deny, so where a mask would apply: email addresses, phone numbers and other personal data go on and are recorded; card numbers, social security numbers and credentials are denied. Text already checked in the same conversation is not checked again.

Tool calls. With Validate tool calls on in claude.ai, each tool_call request lists the tool calls in one Claude response before any of them runs. Intertrace decides each one exactly like any agent's action (access rules, approvals, roles, data checks), as an MCP call when Anthropic names the server. One verdict covers the whole response, so one stop stops them all. A call that needs a person's approval is denied with the link to it; once a person approves, asking Claude again with the same request runs it.

One agent per app. Requests are decided as one Intertrace agent per Claude app: Claude (claude.ai), Claude Code (the same agent itr's hooks use), Claude Cowork, and Claude (other apps) for any app Anthropic names that Intertrace doesn't know. Each is created and protected on its first request. Anthropic says the app name is advisory, so it only picks the agent; it never relaxes a rule.

Intertrace doesn't write the person's messages or attachment text to its database; decisions are recorded as screens and actions like any agent's.

1. 1

   Create the address in Intertrace

   Connect → Claude Enterprise → Create the hook address (owners and admins). Intertrace gives you an address like https://gateway.intertrace.ai/integrations/claude-enterprise/hooks/<id>. One Intertrace organization has one address.

2. 2

   Point claude.ai at it

   A Claude organization Owner (Admins don't have the permission): Organization settings → Data and privacy → Inference hooks → Allow for your organization, then Configure, paste the address and click Next. claude.ai shows the signing secret once (whsec_…). Anthropic's steps.

3. 3

   Bring the secret back

   Paste it into Intertrace and save. It is stored encrypted and never shown again. Until it is saved, Intertrace refuses every request to the address.

4. 4

   Test, then choose failure handling

   Click Test connection in claude.ai: it should report an allow verdict. Then set failure handling to Block the request and the verdict timeout to 5,000 ms or more. Start in Shadow mode if you want to watch verdicts before anything is blocked, then turn on Enforce verdicts and Validate tool calls.

Anthropic treats anything but an HTTP 200 verdict as a failure and applies your failure handling, and claude.ai's first default is Allow the request. So Intertrace never fails that way on its own account: if it can't reach its policy service, can't finish a check within its 4-second budget, can't read a decision or can't read the request, it answers deny.

• What Intertrace can't close: claude.ai's own timeout firing before Intertrace answers, and Anthropic's circuit breaker, which stops calling a server after sustained failures and applies failure handling to every request until it recovers. With failure handling set to Block, both fail closed; with Allow, both let requests through unchecked.
• Requests Intertrace doesn't govern (an address that isn't registered, protection turned off, a signature that doesn't verify, another Claude organization) get an error, never allow, so your failure handling decides them.
• Content Intertrace can't read (an image attachment, which Anthropic sends as metadata only, or a kind of content it doesn't know yet) is denied unless you turn on "Let through content Intertrace can't read". A request of a type it doesn't know is denied too.
• Anthropic resends the whole conversation each time, so after a deny the person edits the message (or starts a new chat, a new task in Cowork, /rewind in Claude Code).

Every request is signed under the Standard Webhooks scheme (webhook-id, webhook-timestamp, webhook-signature: HMAC-SHA256 over the id, the time and the exact body). Intertrace's gateway checks it itself, in constant time, and refuses a time more than five minutes from its clock. After you rotate the secret in claude.ai and save the new one, the old one keeps working for ten minutes. The first signed request that names your Claude organization pins it: a request naming another one is refused, and a Claude organization belongs to one Intertrace organization. Anthropic also sends from 160.79.106.0/24 if you want to allowlist it. Anthropic's protocol.

Known gaps from Anthropic's documentation: some of claude.ai's own tool calls (listing connectors, ending a chat, reading past chats) are not sent as tool calls, only in the next prompt; voice mode may skip a small share of tool calls; Claude Tag conversations aren't inspected when you limit inspection to selected roles; system prompts, tool definitions and raw file bytes are never sent.