> For the complete documentation index, see [llms.txt](https://help.nightfall.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.nightfall.ai/data-exfiltration-prevention/ai-agent-security/ai-governance/auditability-and-control/hooks-vs.-open-telemetry.md). # Hooks vs. Open Telemetry Nightfall uses device hooks and OpenTelemetry to monitor AI agent activity on the endpoint. Claude Enterprise Inference Hooks are a third control, in Claude's cloud, and are covered on [Choosing a control](/data-exfiltration-prevention/ai-agent-security/ai-governance/choosing-a-control.md). This page is the difference between device hooks and OpenTelemetry. ### Capability comparison | Capability | Hooks (real time) | OTel telemetry (async) | | ---------------------------- | ------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------- | | Timing | Before the action executes (and before the model reads tool output) | After the action completes | | Can block actions | Yes, for prompts, tool calls, shell commands, and tool responses (macOS and Windows agents; not on VS Code Copilot) | No. Monitor only | | Prompt text scanning | Yes | Yes, when prompt logging is enabled | | Tool I/O scanning | Yes | Yes, when tool-detail logging is enabled | | Cost and token tracking | No | Yes | | Model name | No | Yes | | Complete session audit trail | Partial, at hook points | As supported by the client's OTel export | | Detect hook bypass | No | Hooks status on the device list shows whether hooks were disabled | ### Agent support | Agent | Device hooks | OTel | Enforcement | | --------------- | --------------- | ---- | ------------------------------------------------------------------------------------------------------ | | Claude Code | Yes | No | Block or Monitor | | Cursor | Yes | No | Block or Monitor | | VS Code Copilot | Yes | No | Block or Monitor (Tool Responses are monitor only on VS Code Copilot) | | Claude Cowork | No device hooks | Yes | OTel is monitor only. Prompts can be blocked with Inference Hooks, which do not use the endpoint agent | ### When to use each Use device hooks to block a prompt, a tool call, or a shell command before it runs, to block sensitive tool output before the model reads it (on the macOS and Windows agents), and to monitor model replies after the fact. Use OpenTelemetry to track token cost, audit a session, and see when hooks were removed. Claude Cowork's session audit is OpenTelemetry. Inline blocking of Cowork prompts is Inference Hooks, not OTel. ### What device hooks intercept | Hook point | When it fires | What it scans | Can block? | | --------------- | ------------------------------------------------------------------------------- | ------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | | User Prompts | Before the prompt is sent to the model | Full prompt text | Yes | | Tool Calls | Before an MCP tool or subagent executes | Tool name and input | Yes | | Shell Commands | Before a shell command or built-in file tool (`read`, `write`, `edit`) executes | The command string or file path and content | Yes | | Tool Responses | After an MCP tool finishes, before the model reads the output | Tool name and output | Yes, on the macOS and Windows agents (not on VS Code Copilot). The tool has already run, and a block replaces the output so the model never reads it | | Model Responses | After the model replies | The model response | No. Monitor only | ### How enforcement works 1. The AI agent pauses the action and sends the content to the Nightfall agent on the endpoint. 2. The agent evaluates active AI agent policies. 3. Allow, and the action proceeds. Block, and the person sees why. 4. A violation is recorded whether the action was blocked or monitored. If the Nightfall agent does not answer within 15 seconds, the hook fails open and the action proceeds. (Cursor's pre-action hooks `beforeSubmitPrompt` and `preToolUse` carry `failClosed: true` and block if the hook fails or times out.) When the agent recovers, enforcement resumes. ### Claude Cowork Claude Cowork does not run Nightfall's device hooks. Configure OpenTelemetry for the session audit: cost, tokens, and tool invocations. See Claude's Cowork monitoring docs for the export setup. To block a Cowork prompt before the model runs, use Claude Inference Hooks. That check does not require the endpoint agent or an MDM hook rollout. It also does not stop a tool that has already executed. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://help.nightfall.ai/data-exfiltration-prevention/ai-agent-security/ai-governance/auditability-and-control/hooks-vs.-open-telemetry.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.