Auditability and Control

Nightfall protects AI agent activity with three mechanisms. Device hooks and OpenTelemetry run on the endpoint. Claude Inference Hooks run in Claude Enterprise before the model, with nothing installed on the laptop. Choosing a control says which one covers prompts, tool calls, shell commands, and model responses.

Hooks, real-time enforcement on the device

Hooks intercept AI agent actions before they execute. When a developer submits a prompt, calls a tool, or runs a shell command, Nightfall scans the content and can block the action.

• Supported agents: Claude Code, Cursor, VS Code Copilot

• Enforcement: Block or Monitor on prompts, tool calls, and shell commands. Tool responses and model responses are monitor only

OpenTelemetry, async monitoring

OpenTelemetry captures agent activity after actions complete: session audit, cost, model, and tool activity. It does not block.

• Supported agents: Claude Cowork

• Additional data: token usage, cost per prompt, model name, API errors

Claude Inference Hooks

For Claude Enterprise, Nightfall can allow or deny a prompt before the model runs. This covers claude.ai, Cowork, and Claude Code signed into that organization, including machines with no agent. It does not replace device hooks when the shell command or the tool call itself must not start. Setup and policy templates are on Hook policy recommendations.

Prerequisites

Device hooks need the following. Inference Hooks do not.

Nightfall endpoint agent

• Version 1.2.12.11 or later.

• The agent must be installed and running on each endpoint where AI agents are used.

MDM configuration profile

Deploy the Nightfall endpoint agent configuration profile (v3 or later) via your MDM provider. This profile grants the agent its OS permissions. It is not the Claude Code hooks file nightfall-hooks.mobileconfig.

AI agent policy

At least one AI Agent Security policy must be active. Install hooks from the client guides under Setup and Installation. Claude Code, Cursor, and VS Code Copilot each have their own package and path.

Next steps

• Choosing a control

• Setup and Installation

• Hooks vs. Open Telemetry

• Hook policy recommendations