Skip to main content
Claude Enterprise puts TrustGuard in front of every model request your organization makes through Claude — Claude chat, Claude Code, and Claude Cowork — server-side, with nothing installed on laptops. Anthropic calls TrustGuard before the model answers, through the org-level hook it calls Inference Hooks; TrustGuard returns allow or deny. Typical uses:
  • Stop jailbreaks and prompt injection org-wide — a Prompt Guard detector screens every prompt from chat, Claude Code, and Cowork before it reaches the model.
  • Catch secrets and PII leaving the org — Data Loss Prevention flags API keys, tokens, and customer data pasted into Claude. On this path the verdict is binary, so DLP blocks or reports; it cannot mask in flight.
  • Audit who uses Claude for what — every request lands in Activity with consumer.id (the actor’s email) and the surface in source.application, without touching endpoints.
  • Apply different rules per surface — one collector, one policy, and gates on source.application: e.g. Report on Claude chat, Block on Claude Code.
What it can not do: no Ask dialog — there is no IDE prompt on this path, so an ask gate resolves to allowed here rather than stopping anything — no Transform/masking, and no visibility into individual tool executions — it sees the model request, not the shell command Claude Code is about to run. For action-level control on developer machines, pair it with the Claude Code plugin; the two paths stamp different source.application values, so they gate independently.

​
Coverage

Ask — the Claude dialect answers allow or deny only and there is no IDE prompt on this path, so an ask gate resolves to allowed. Use the Claude Code plugin where you need a dialog. Use it when you need org-wide coverage no user can disable, with nothing installed on laptops. Not when you need per-tool control or masking — pair it with Claude Code for that. ⚠️ Tool content is visible in the transcript and can be blocked, but only by denying the whole inference at the single pre-inference decision point. There is no per-tool verdict. Limits. Allow or deny, and nothing else: no redaction, no ask, no output coverage. A non-2xx from TrustGuard is a delivery failure, not a deny — Anthropic’s own failure handling decides what happens then. Full comparison: Coverage.

​
How it maps

One Anthropic organization endpoint maps to one TrustGuard collector. Claude chat, Claude Code, and Claude Cowork share that hook; TrustGuard stamps source.application so policies can target a surface without separate collectors. This path does not install Claude Code lifecycle hooks — that is the Claude Code plugin (source.application = claude-code-plugin). Do not put this collector’s tgk_… on a TrustGate MCP connector.

​
Setup

  1. In TrustGuard, create a Claude Enterprise collector (Catalog → IDE & coding agents).
  2. Mint a tgk_… API key on the collector Auth tab.
  3. In the Anthropic admin console (Data and Privacy → Inference hooks), set:
    • Hook URL: {TRUSTGUARD_URL}/v1/evaluate/claude
    • Authorization: Bearer <collector API key> (the tgk_… key — not tgcol_…)
  4. Save the endpoint in Anthropic first — that generates the whsec_… signing secret.
  5. Paste whsec_… into the collector Connection tab in TrustGuard.
  6. Reopen Edit in Anthropic and run Test connection (after the secret is installed).
  7. Assign a default policy before enforcing in production.

​
Evaluate path

This is not the generic POST /v1/evaluate path. The Claude dialect returns only allow or deny. Ask is not a permission prompt here (no IDE dialog) — it degrades to allow. Failures degrade to allow so a TrustGuard outage does not block the org’s Claude usage.

​
Surfaces

TrustGuard copies the frame’s source.application into the gate attribute map on every delivery. Unknown values are accepted as-is (open string).

​
Policy gates per surface

Keep one collector and one default policy. Differentiate with a gate on source.application (Policies → Gates → attribute Source application): Gates run before detectors. In Observe policy mode, Block is recorded only. Test the condition on the policy Test tab with Extra parameter Source application = claude-code (or the surface you care about). A gate on claude-code does not match the laptop plugin (claude-code-plugin). Also available on the same hook deliveries: collector.type = anthropic_inference_hook, model.provider = anthropic, consumer.id from the actor email/id.