> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neuraltrust.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Claude Enterprise

> Connect Claude chat, Claude Code, and Claude Cowork to TrustGuard via Anthropic Inference Hooks.

One Anthropic organization endpoint maps to **one** TrustGuard collector. Claude chat,
Claude Code, and Claude Cowork share that hook; TrustGuard stamps
`source.application` so policies can target a surface without separate collectors.

## Setup

1. In TrustGuard, create a **Claude Enterprise** collector (Catalog → IDE & coding agents).
2. Mint a `tgk_…` API key on the collector **Auth** tab.
3. In the Anthropic admin console (Data and Privacy → Inference hooks), set:
   * **Hook URL:** `{TRUSTGUARD_URL}/v1/evaluate/claude`
   * **Authorization:** `Bearer <collector API key>` (the `tgk_…` key — not `tgcol_…`)
4. **Save** the endpoint in Anthropic first — that generates the `whsec_…` signing secret.
5. Paste `whsec_…` into the collector **Connection** tab in TrustGuard.
6. Reopen Edit in Anthropic and run **Test connection** (after the secret is installed).
7. Assign a default [policy](/trustguard/concepts/policies) before enforcing in production.

## Evaluate path

```text theme={null}
Anthropic → POST /v1/evaluate/claude
  Authorization: Bearer tgk_…
  Standard Webhooks signature (whsec_)
  → TrustGuard allow | deny
```

This is **not** the generic [`POST /v1/evaluate`](/trustguard/api/evaluate) path. The
Claude dialect returns only **allow** or **deny**. Failures degrade to allow so a
TrustGuard outage does not block the org’s Claude usage.

## Surfaces

| `source.application` (observed)  | Product                       |
| -------------------------------- | ----------------------------- |
| `claude-ai`                      | Claude chat                   |
| `claude-code`                    | Claude Code                   |
| (Cowork when Anthropic emits it) | Claude Cowork                 |
| `config-test`                    | Anthropic **Test connection** |

TrustGuard copies the frame’s `source.application` into the gate attribute map
on every delivery. Unknown values are accepted as-is (open string).

## Policy gates per surface

Keep **one** collector and **one** default policy. Differentiate with a
[gate](/trustguard/concepts/policies#gates-match-before-you-detect) on
`source.application` (Policies → **Gates** → attribute **Source application**):

| Goal                                        | Condition                                                     | Then                    |
| ------------------------------------------- | ------------------------------------------------------------- | ----------------------- |
| Stricter on Claude Code only                | `source.application` **eq** `claude-code`                     | **Block** or **Report** |
| Waive chat (detectors still run after Skip) | `source.application` **eq** `claude-ai`                       | **Skip**                |
| Several products                            | `source.application` **in** `claude-code,cowork-when-emitted` | **Block**               |

Gates run **before** detectors. In **Report** policy mode, Block is recorded
only. Test the condition on the policy **Test** tab with
`source.application = claude-code` (or the surface you care about).

Also available on the same hook deliveries: `collector.type` =
`anthropic_inference_hook`, `model.provider` = `anthropic`, `consumer.id` from
the actor email/id.

## Related

* [Policies — Gates](/trustguard/concepts/policies#gates-match-before-you-detect)
* [Collectors](/trustguard/concepts/collectors)
* [Evaluate API](/trustguard/api/evaluate)