> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neuraltrust.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Claude Enterprise

> Screen every Claude chat, Claude Code, and Cowork model request org-wide, server-side — nothing installed on laptops.

**Claude Enterprise** puts TrustGuard in front of **every model request** your
organization makes through Claude — Claude chat, Claude Code, and Claude Cowork —
server-side, with **nothing installed on laptops**. Anthropic calls TrustGuard
before the model answers, through the org-level hook it calls Inference Hooks;
TrustGuard returns allow or deny. Typical uses:

* **Stop jailbreaks and prompt injection org-wide** — a
  [Prompt Guard](/trustguard/detectors/content-security#prompt-guard--prompt_guard)
  detector screens every prompt from chat, Claude Code, and Cowork before it
  reaches the model.
* **Catch secrets and PII leaving the org** —
  [Data Loss Prevention](/trustguard/detectors/data-loss-prevention) flags API
  keys, tokens, and customer data pasted into Claude. On this path the verdict
  is binary, so DLP **blocks or reports**; it cannot mask in flight.
* **Audit who uses Claude for what** — every request lands in **Activity**
  with `consumer.id` (the actor's email) and the surface in
  `source.application`, without touching endpoints.
* **Apply different rules per surface** — one collector, one policy, and
  [gates](/trustguard/concepts/policies#gates) on
  `source.application`: e.g. Report on Claude chat, Block on Claude Code.

What it can **not** do: no **Ask** dialog — there is no IDE prompt on this
path, so an `ask` gate resolves to **allowed** here rather than stopping
anything —
no Transform/masking, and no visibility into individual tool executions — it
sees the model request, not the shell command Claude Code is about to run. For
action-level control on developer machines, pair it with the
[Claude Code plugin](/trustguard/integrations/claude-code); the two paths
stamp different `source.application` values, so they gate independently.

## Coverage

| Surface      | Monitor | Block | Redact |
| ------------ | :-----: | :---: | :----: |
| LLM input    |    ✅    |   ✅   |    ❌   |
| LLM output   |    ➖    |   ➖   |    ➖   |
| Tool listing |    ✅    |   ⚠️  |    ➖   |
| Tool call    |    ✅    |   ⚠️  |    ❌   |
| Tool result  |    ✅    |   ⚠️  |    ❌   |

**Ask** — the Claude dialect answers allow or deny only and there is no IDE
prompt on this path, so an `ask` gate resolves to **allowed**. Use the
[Claude Code plugin](/trustguard/integrations/claude-code) where you need a dialog.

**Use it when** you need org-wide coverage no user can disable, with nothing
installed on laptops. **Not when** you need per-tool control or masking — pair it
with [Claude Code](/trustguard/integrations/claude-code) for that.

⚠️ Tool content is visible in the transcript and can be blocked, but only by
denying the **whole inference** at the single pre-inference decision point. There
is no per-tool verdict.

**Limits.** Allow or deny, and nothing else: no redaction, no `ask`, no output
coverage. A non-2xx from TrustGuard is a delivery failure, not a deny — Anthropic's
own failure handling decides what happens then.

Full comparison: [Coverage](/trustguard/integrations/coverage).

## How it maps

One Anthropic organization endpoint maps to **one** TrustGuard collector.
Claude chat, Claude Code, and Claude Cowork share that hook; TrustGuard stamps
`source.application` so policies can target a surface without separate
collectors.

This path does **not** install Claude Code lifecycle hooks — that is the
[Claude Code plugin](/trustguard/integrations/claude-code)
(`source.application = claude-code-plugin`). Do not put this collector's
`tgk_…` on a TrustGate MCP connector.

## Setup

1. In TrustGuard, create a **Claude Enterprise** collector (Catalog → IDE & coding agents).
2. Mint a `tgk_…` API key on the collector **Auth** tab.
3. In the Anthropic admin console (Data and Privacy → Inference hooks), set:
   * **Hook URL:** `{TRUSTGUARD_URL}/v1/evaluate/claude`
   * **Authorization:** `Bearer <collector API key>` (the `tgk_…` key — not `tgcol_…`)
4. **Save** the endpoint in Anthropic first — that generates the `whsec_…` signing secret.
5. Paste `whsec_…` into the collector **Connection** tab in TrustGuard.
6. Reopen Edit in Anthropic and run **Test connection** (after the secret is installed).
7. Assign a default [policy](/trustguard/concepts/policies) before enforcing in production.

## Evaluate path

```text theme={null}
Anthropic → POST /v1/evaluate/claude
  Authorization: Bearer tgk_…
  Standard Webhooks signature (whsec_)
  → TrustGuard allow | deny
```

This is **not** the generic [`POST /v1/evaluate`](/trustguard/api/evaluate) path. The
Claude dialect returns only **allow** or **deny**. **Ask** is not a permission
prompt here (no IDE dialog) — it degrades to allow. Failures degrade to allow so a
TrustGuard outage does not block the org’s Claude usage.

## Surfaces

| `source.application` (observed)  | Product                       |
| -------------------------------- | ----------------------------- |
| `claude-ai`                      | Claude chat                   |
| `claude-code`                    | Claude Code                   |
| (Cowork when Anthropic emits it) | Claude Cowork                 |
| `config-test`                    | Anthropic **Test connection** |

TrustGuard copies the frame’s `source.application` into the gate attribute map
on every delivery. Unknown values are accepted as-is (open string).

## Policy gates per surface

Keep **one** collector and **one** default policy. Differentiate with a
[gate](/trustguard/concepts/policies#gates) on
`source.application` (Policies → **Gates** → attribute **Source application**):

| Goal                                        | Condition                                                     | Then                    |
| ------------------------------------------- | ------------------------------------------------------------- | ----------------------- |
| Stricter on Claude Code only                | `source.application` **eq** `claude-code`                     | **Block** or **Report** |
| Waive chat (detectors still run after Skip) | `source.application` **eq** `claude-ai`                       | **Skip**                |
| Several products                            | `source.application` **in** `claude-code,cowork-when-emitted` | **Block**               |

Gates run **before** detectors. In **Observe** policy mode, Block is recorded
only. Test the condition on the policy **Test** tab with Extra parameter
**Source application** = `claude-code` (or the surface you care about).
A gate on `claude-code` does **not** match the [laptop plugin](/trustguard/integrations/claude-code)
(`claude-code-plugin`).

Also available on the same hook deliveries: `collector.type` =
`anthropic_inference_hook`, `model.provider` = `anthropic`, `consumer.id` from
the actor email/id.

## Related

* [Claude Code plugin (local hooks)](/trustguard/integrations/claude-code)
* [Policies — Gates](/trustguard/concepts/policies#gates)
* [Collectors](/trustguard/concepts/collectors)
* [Evaluate API](/trustguard/api/evaluate)