Inference Hooks

Inference Hooks connect Claude Enterprise to your runtime guards at the platform level. Before any governed prompt reaches the model — across claude.ai, Claude Cowork, and Claude Code (web, desktop, and CLI) — Anthropic sends the conversation transcript to Willow, and Willow returns an allow or deny verdict. A denied request never reaches the model.

Where Guard Hooks run inside each coding agent on the endpoint, Inference Hooks run server-to-server: one organization-level configuration in claude.ai routes every prompt through Willow, with nothing to install on user machines.

Inference Hooks vs. Guard Hooks

	Guard Hooks	Inference Hooks
Where it runs	On the machine, in each agent	Anthropic → Willow (server-to-server)
Coverage	Claude Code, Cursor, Codex	All Claude Enterprise surfaces (claude.ai, Cowork, Claude Code)
Rollout	MDM token + plugin/managed settings	One org config in claude.ai
Verdicts	block / ask / warn / redact (can mask tool output)	allow / deny only (no content mutation)
Auth	Org HMAC token	Org HMAC token (custom request header)

Binary verdicts

The Inference hooks protocol supports only allow and deny — it cannot rewrite, redact, or mask content. Willow maps a hard guard block to deny; every other outcome (warn, ask, redact) proceeds as allow. Use Guard Hooks when you need PII/secret masking on tool output.

Prerequisites

• The Guard Hooks beta feature must be enabled in Beta Features. It also gates Inference Hooks.
• At least one runtime guard should be active so the hook has something to enforce.
• A Claude Enterprise organization with the organization:manage permission (built-in Admin, Owner, or Primary owner role) to configure Inference hooks in claude.ai.
• Your organization's Willow org token — the same token used by the Guard Hooks and the Willow Scan Agent.

How it works

1. A user submits a prompt (or Claude is about to consume a tool result) on any Claude Enterprise surface.
2. Anthropic POSTs the prompt frame — the conversation transcript up to the point of inference — to Willow's Inference hooks endpoint and holds the model.
3. Willow authenticates the caller with your org token, extracts the latest turn, and evaluates it against your active runtime guards.
4. Willow returns {"action": "allow"} or {"action": "deny", "deny_reason": "..."}. On deny, the user sees the guard's reason followed by your organization's standing message; the denial is recorded in your Monitor → Logs and the Claude Enterprise Activity Feed.

The endpoint always answers with HTTP 200 within the verdict timeout and fails open on any internal error, so guard enforcement is strictly additive.

Willow endpoint

Willow exposes the AI security server at:

https://<org>.<your-domain>/api/claude/inference-hooks

Use the same host your organization already uses for the Willow connect portal (the one that serves your OAuth and connect endpoints). The endpoint accepts the Anthropic prompt frame and returns the verdict — no other configuration is needed on the Willow side once the beta feature is on.

Step 1 — Get your org token

The endpoint authenticates with your organization's Willow token, passed as a request header (see Step 3). If you already run the Guard Hooks or the Willow Scan Agent, it is the same token. Retrieve it from the Guard Hooks setup flow on the Security → Guards page, or from your Scan Agent MDM profile.

The token is presented as:

Authorization: Bearer <org-slug>:<signature>

warning

This token authenticates every verdict request as your organization. Treat it as a secret and store it only in the encrypted custom-header field in claude.ai.

Step 2 — Configure the endpoint in claude.ai

In claude.ai, go to Organization settings → Data and privacy → Inference hooks, turn on Allow for your organization, then open the settings page and click Configure:

• Endpoint URL: your Willow endpoint from above (https://<org>.<your-domain>/api/claude/inference-hooks). Only https:// URLs on port 443 are accepted.
• Leave Enforce verdicts off for now — you turn it on in Step 5.

Step 3 — Add the org token as a custom header

In the same Configure endpoint dialog, add a custom request header so Willow can authenticate the caller:

Header	Value
Authorization	Bearer <org-slug>:<signature>

Header values are stored encrypted and shown only once. Because Anthropic never redisplays them, re-enter the value whenever you edit the header or change the endpoint URL.

Signing secret not required

Willow authenticates with your org token, so you do not need to verify Anthropic's Standard Webhooks signing secret. You may still save a signing secret in claude.ai (Anthropic generates one on first save); Willow simply ignores it.

Step 4 — Test the connection

Click Test connection. Anthropic sends a synthetic prompt to Willow using the URL and header currently in the form (re-enter the token first). A successful result reports the allow/deny verdict Willow returned. If it fails, check:

• The URL is your https:// connect host, reachable without redirects.
• The Authorization header was re-entered exactly as Bearer <org-slug>:<signature>.
• The Guard Hooks beta feature is enabled for your organization.

Step 5 — Roll out and enforce

1. Under Failure handling, choose Allow the request (fail open) or Block the request (fail closed) for when Willow is unreachable, and set the verdict timeout (default 5,000ms).
2. Under Rollout, set Requests inspected (%) — start low and ramp to 100.
3. Optionally set Mode to Shadow mode to observe verdicts against live traffic without blocking anyone.
4. Turn on Enforce verdicts. Allow about a minute for the change to propagate.

What Willow inspects

Willow scans the most recent turn of the transcript — the fresh user prompt, or the tool result Claude is about to consume — against your active guards. This includes text, extracted attachment text, tool_result output, and tool_use arguments. Willow never receives system prompts, tool definitions, Claude's hidden reasoning, or raw file bytes.

Denials and (optionally) passing evaluations are logged to Monitor → Logs, governed by the same Log Settings as the other guard surfaces.

Turn it off

• Pause enforcement: turn off Enforce verdicts in claude.ai — prompts stop being sent to Willow within about a minute.
• Fully disable: turn off Allow for your organization in Data and privacy. Your endpoint and header configuration are retained.