For most enterprises deploying AI agents, control has lived around the model.
Identity determines who can use an agent. Policies and system prompts influence what the model should do. MCP gateways and tool controls govern what it can reach. Sandboxes constrain execution. Observability systems reconstruct what happened afterward.
Inference itself has largely remained on the other side of the model-provider boundary. A request goes in, the model reasons, and a response comes out. Enterprises can control the inputs and the resulting actions, but have had few places to insert their own control directly into that path.
Anthropic’s new Inference Hooks change that in an important way.
Claude Enterprise organizations can now send governed requests to an external AI security service before inference proceeds. Anthropic sends the conversation transcript to that service and waits for an allow or deny verdict. If the request is denied, it never reaches Claude. Because the hook runs server-side, the control applies consistently across governed Claude surfaces, including Claude Code.
The immediate applications are useful: data-loss prevention, project restrictions, model policies, transcript archival, telemetry, and enterprise-specific controls. But we think the more consequential development is the boundary Anthropic has created.
Inference itself is becoming a control surface.
There has been a hole in the middle
In our earlier post, The Four Surfaces Every AI Agent Touches, we argued that agent control cannot begin and end with tools. By the time an agent calls an API, modifies a file, queries a database, or executes a command, most of the decisions that shaped that action have already happened. The model has interpreted the objective, selected relevant context, explored alternatives, and decided which path deserves pursuit. That creates an awkward gap.
We can control what enters an AI system. We can govern what tools are available afterward. We can verify explicit plans and constrain execution when it reaches infrastructure. Yet the inference that transforms one into the other has remained difficult for an independent enterprise control system to reach. This matters more as models become capable.
Anthropic has written about exactly this tension in its own containment work. More capable models may make fewer obvious mistakes, but they also become better at discovering unexpected paths toward a goal, including paths that route around restrictions engineers did not anticipate. Anthropic explicitly notes that probabilistic defenses retain a non-zero miss rate and therefore complements supervision with harder containment boundaries.
Inference Hooks introduce another boundary into that architecture. An enterprise-controlled system can now participate directly before governed inference rather than relying entirely on instructions inside the model or controls applied after the model has acted. That is much more interesting than another webhook.
The model can remain stochastic. The control does not have to be.
There is an important distinction in how we think about this at ArmorIQ. We do not want model reasoning to become deterministic.
The probabilistic nature of reasoning is what makes these systems useful. Models can interpret ambiguous requests, explore alternatives, recover from failures, synthesize unexpected information, and discover approaches nobody explicitly programmed. Trying to remove that uncertainty would remove much of the intelligence. But the control system has a different job. It should be able to make deterministic decisions about the boundaries within which that intelligence operates.
Inference Hooks provide a simple but important example. Claude does not decide whether the enterprise security service approved the request. The external service does. Claude does not reinterpret a denied verdict and decide that proceeding might nevertheless be useful. A denial prevents that governed request from reaching inference. The model remains probabilistic. The enforcement decision sits outside it.
That separation between the execution domain and the enforcement domain is central to the way we have been building ArmorIQ.
We can use this boundary today
The significance of Inference Hooks is not only that they point toward a future architecture. They give us a useful enforcement point today.
ArmorIQ integrates its current intent-control capabilities with Anthropic’s Inference Hooks. A governed Claude request is sent to ArmorIQ before inference, where the transcript can be evaluated against enterprise policy, captured intent, user and agent context, and the controls already available in the ArmorIQ platform. ArmorIQ then returns a deterministic allow or deny decision before Claude processes the request.
The control is not limited to the first message of a conversation. When a tool result returns to Claude and creates another governed inference request, Anthropic invokes the hook again. That means the decision can be reevaluated as the conversation and its external context evolve.
For an enterprise, that creates something immediately useful: ArmorIQ can sit directly in the Claude inference path today. This does not require waiting for a new model architecture or for models to expose their internals. The intelligence remains inside Claude, while an independent control system evaluates whether inference should proceed.
It also complements the rest of the controls already surrounding an agent. Intent and policy can be evaluated before inference. IAP can preserve continuity between accepted plans and subsequent actions. Existing identity, tool, network, and infrastructure controls continue governing what execution is ultimately allowed to affect. In other words, Inference Hooks simply is a new place to apply the ArmorIQ control model with technology we already have.
But we also see today’s hook for what it is: the beginning of the interface, not the end of it.
The transcript is only the outer edge of reasoning
The current Inference Hook operates at the transcript boundary. ArmorIQ can see the conversation context Anthropic exposes and return an allow or deny verdict. The security service receives transcript text, tool calls and their results, and extracted text from attachments. It does not receive Anthropic’s system prompts or internal context. It does not receive raw images or files. Most importantly for reasoning assurance, it does not expose the model’s internal activation state.
The intervention surface is similarly narrow. Today, the external service can allow or deny. It cannot rewrite the prompt, redact part of it, or intervene inside an inference that is already underway. Anthropic says response-side enforcement is planned as a later event. Those limitations are entirely reasonable for a first enterprise interface. They also expose the next question.
What if independent control could eventually reach deeper than the transcript?
That is a question we have been exploring through our Model Assurance Plane, or MAP, an ongoing ArmorIQ research effort that is now in advanced stages.
MAP starts where today’s hook ends
MAP asks a harder question than whether an inference request should begin. It asks whether we can independently assure aspects of the reasoning occurring during inference.
Imagine an agent that eventually produces a structurally valid plan. The plan passes policy. Its subsequent actions can be tied to that plan. Execution remains inside the permissions assigned to the agent. Everything visible may appear correct. But what if the reasoning trajectory that produced that plan had already begun moving toward an undesirable strategy?
If the first thing an external control system can inspect is the completed plan, then the most interesting part of the reasoning process has already happened. Our MAP research explores whether reasoning can become an observable and governable surface without simply asking another LLM to supervise the first one. A critical component of that work is what we call the Reasoning Interface Layer, or RIL.
RIL exists because different models expose radically different control surfaces. An open-weight model running on infrastructure you control may permit access to selected internal activations, synchronization with token generation, projection onto behavioral feature directions, and potentially bounded interventions during inference.
A hosted frontier model is different. The provider owns the inference stack, so independent assurance can only operate through interfaces the provider deliberately exposes. That is why Anthropic’s Inference Hooks are interesting to us beyond their immediate security use cases. They expose part of the architectural seam a hosted-model RIL needs.
A hook is a subset of RIL, not the destination
We should be precise about this. Anthropic’s Inference Hooks are not MAP, nor are they a complete implementation of RIL. Today’s interface does not expose latent model state. It does not provide token-level reasoning signals. It does not support bounded intervention during generation. Its enforcement primitive is intentionally coarse: inspect the governed transcript and decide whether inference should proceed.
But it establishes something important. The model provider owns inference. An independent system can own part of the control decision around that inference. That separation is exactly the architectural direction RIL assumes.
For hosted models, RIL may begin with transcript-level interception and deterministic admission decisions. For models that expose richer observability, the same abstraction could eventually incorporate finer-grained reasoning signals. The interface adapts to what the underlying model can safely expose without requiring the assurance architecture above it to become model-specific.
This gives us two horizons for ArmorIQ.
Today, we can ship a solution using Anthropic Inference Hooks with our current platform. Enterprises can put ArmorIQ directly in the governed Claude inference path and apply independent intent and policy controls before inference proceeds.
At the same time, we are building toward something substantially more ambitious with MAP: moving from deciding whether inference should occur to independently assuring properties of the reasoning occurring inside it.
The first is available with the primitives Anthropic exposes today. The second is the advanced research effort we believe those primitives eventually make possible.
The bigger development is the boundary
It would be easy to describe Inference Hooks as another Claude Enterprise security feature. That undersells what is happening.
Anthropic has made a point in hosted model inference programmable by an independent enterprise control system. Today, that point is designed primarily for transcript-level policy and deterministic admission decisions. Those capabilities are useful immediately, and ArmorIQ can build on them immediately.
But the architectural direction matters even more. As agents gain more authority, enterprises will increasingly want control over more than who can invoke a model and what tools it can reach. They will want assurance over the transformations occurring between those two points.
Our broader ArmorIQ architecture is built around exactly that observation. PAP governs how purpose is refined into plans. IAP maintains continuity between accepted plans and actions. KAP carries authority into operating-system execution. MAP is our ongoing research effort aimed at the remaining surface: reasoning itself.
Anthropic’s Inference Hooks give us a new enforcement point at that surface today. Our MAP work asks how far that surface can ultimately extend. The model should remain probabilistic, adaptive, and increasingly capable. The control system should remain independent of the intelligence it governs.
With Anthropic’s new hooks, we can enforce at the inference boundary today. With MAP, we are building toward assuring what happens inside that boundary tomorrow.
