Hooks vs. Open Telemetry

Nightfall uses device hooks and OpenTelemetry to monitor AI agent activity on the endpoint. Claude Enterprise Inference Hooks are a third control, in Claude's cloud, and are covered on Choosing a control. This page is the difference between device hooks and OpenTelemetry.

Capability comparison

Capability	Hooks (real time)	OTel telemetry (async)
Timing	Before the action executes	After the action completes
Can block actions	Yes, for prompts, tool calls, and shell commands	No. Monitor only
Prompt text scanning	Yes	Yes, when prompt logging is enabled
Tool I/O scanning	Yes	Yes, when tool-detail logging is enabled
Cost and token tracking	No	Yes
Model name	No	Yes
Complete session audit trail	Partial, at hook points	As supported by the client's OTel export
Detect hook bypass	No	Hooks status on the device list shows whether hooks were disabled

Agent support

Agent	Device hooks	OTel	Enforcement
Claude Code	Yes	No	Block or Monitor
Cursor	Yes	No	Block or Monitor
VS Code Copilot	Yes	No	Block or Monitor
Claude Cowork	No device hooks	Yes	OTel is monitor only. Prompts can be blocked with Inference Hooks, which do not use the endpoint agent

When to use each

Use device hooks to block a prompt, a tool call, or a shell command before it runs, and to monitor tool output and model replies after the fact.

Use OpenTelemetry to track token cost, audit a session, and see when hooks were removed. Claude Cowork's session audit is OpenTelemetry. Inline blocking of Cowork prompts is Inference Hooks, not OTel.

What device hooks intercept

Hook point	When it fires	What it scans	Can block?
User Prompts	Before the prompt is sent to the model	Full prompt text	Yes
Tool Calls	Before a tool executes	Tool name and input	Yes
Shell Commands	Before a shell command executes	The command string	Yes
Tool Responses	After the tool finishes	Tool name and output	No. Monitor only. The action has already happened
Model Responses	After the model replies	The model response	No

How enforcement works

1. The AI agent pauses the action and sends the content to the Nightfall agent on the endpoint.

2. The agent evaluates active AI agent policies.

3. Allow, and the action proceeds. Block, and the person sees why.

4. A violation is recorded whether the action was blocked or monitored.

If the Nightfall agent does not answer within 15 seconds, the hook fails open and the action proceeds. When the agent recovers, enforcement resumes.

Claude Cowork

Claude Cowork does not run Nightfall's device hooks. Configure OpenTelemetry for the session audit: cost, tokens, and tool invocations. See Claude's Cowork monitoring docs for the export setup.

To block a Cowork prompt before the model runs, use Claude Inference Hooks. That check does not require the endpoint agent or an MDM hook rollout. It also does not stop a tool that has already executed.