Hook policy recommendations
Policy templates for IDE hooks, Claude Inference Hooks, and the MCP Gateway.
These follow the same shape as the endpoint templates: scope, triggers, detectors, actions. Create them under Configuration > Policies > Exfiltration > AI Agent Security, except the gateway actions, which are on AI Governance > MCP Gateway. See also Choosing a control.
Endpoint browser, clipboard, and cloud-sync templates stay on Recommended Policy Configurations. Connect steps are on Connect Inference Hooks.
1. Block secrets before a coding agent acts
Use case. Stop API keys, passwords, and private keys from being pasted into a prompt, passed as a tool argument, or typed into a shell command.
Where. IDE hooks. Claude Code, Cursor, and VS Code Copilot.
Scope. Engineering and anyone with production credentials. Content scanning on. MCP server scope: All MCP servers.
User Prompts
Block
Tool Calls
Block
Shell Commands
Block
Tool Responses
Monitor
Model Responses
Off, until you want the reply in the incident
Detection rules. Credentials and API keys. Passwords. Cryptographic private keys. Leave file classifiers off so a source-code match cannot block a build command.
Actions. Block. Admin alert to the security channel. End-user text: "A secret or API key was detected. Remove it and rotate the key if it was already exposed."
Credential detectors are specific enough to Block on day one. Leave shell patterns empty so every command is scanned.
2. Block sensitive prompts on Claude Enterprise, with no device rollout
Use case. Stop PII, PCI, PHI, credentials, and classified documents from reaching Claude on claude.ai, Cowork, Claude Desktop, mobile, and Claude Code, including machines that never received the agent.
Where. Inference Hooks. The only hook type is User Prompts. MCP server scope: All MCP servers. Do not narrow by tool. Prefer org-wide scope. A user-inclusion list is unreliable on claude.ai in this release. Use Claude role exclusions only when those people should be uninspected.
Detection rules. PII, PCI, PHI, credentials and API keys. Add file classifiers for financial, HR, legal, M&A, and source code after a shadow week. Content scanning must be on. With it off, Block denies every prompt this policy covers.
Actions. Monitor while Anthropic is in shadow mode. Switch the Nightfall action to Block in the same window as turning Claude from shadow mode to enforcing.
A tool argument or a tool result that arrives in a later prompt frame is part of the same scan. A match denies the model. It does not unwind the tool. Keep recommendation 1 wherever the shell or the tool itself must not start.
This policy does not catch images, Claude on Bedrock, Vertex, or a Console API key, Cursor, VS Code, or a role excluded in the Claude admin.
3. Monitor what tools and the model bring back
Where. IDE hooks. Tool Responses, Monitor. Model Responses, Monitor. Leave the pre-action hook types off on this policy. Content scanning on.
Detection rules. PII, PCI, PHI, credentials, source-code classifier.
Actions. Monitor. Admin alert. No Block. The wizard does not block these two hook types.
4. Narrow remote MCP to read tools
Where. MCP Gateway, not an exfiltration policy. Enable the server, disable Write and Delete tools, and refresh after new tools appear. A content policy on gateway traffic does not block a call in this release.
5. PHI and source code, by channel
Keep the endpoint templates for browser, clipboard, and cloud sync. Add the agent channel beside them.
PHI
All endpoint triggers, Block, override logged
Recommendation 2 for Claude Enterprise. Recommendation 1's shape with PHI detectors on device hooks
Source code
Git push and personal repos
IDE hooks, User Prompts and Tool Calls, Block, source-code classifier, Monitor for one week first. Inference Hooks, User Prompts, shadow then Block
PCI and financial files
PCI and financial file classifiers
Inference Hooks, User Prompts, shadow then Block
Connect Inference Hooks
The screen-by-screen connect flow is Connect Inference Hooks.
You need a Claude Enterprise organization, the Owner or Primary owner role in claude.ai, and Inference Hooks enabled on your Nightfall tenant. Inference Hooks and the Compliance API are separate.
In Nightfall, open the Anthropic integration and choose Inference Hooks. Copy the endpoint URL, the header name
X-Api-Key, and the identification key. The key is shown once.In claude.ai, go to Organization settings, Data and privacy, Inference hooks. Turn on Allow for your organization. Paste the URL. Add the
X-Api-Keyheader. Save. Copy the signing secret Anthropic shows once.Paste the signing secret into Nightfall. Until it verifies, Claude allows every prompt.
Use Test connection in the Claude console.
Start in shadow mode: 100% inspected, timeout at least 5,000 ms, failure handling Allow the request. Existing device policies do not cover this traffic. Turn content scanning on and add detection rules. Content scanning off with Block denies every prompt the policy covers.
When the decisions look right, turn on Enforce verdicts. Keep failure handling on Allow unless a Nightfall outage should block Claude for the organization.
Which combination to deploy
Block Claude Enterprise prompts with no laptop rollout
Inference Hooks, plus the Compliance API
Stop shell and tool calls on Claude Code, Cursor, or VS Code
Device hooks, via the agent and MDM
Both
Inference Hooks and device hooks, plus the Compliance API
Remote MCP tools
MCP Gateway, plus Visibility
A chat that already happened
Compliance API
Bedrock, Vertex, or a Console API key
Device hooks only
Was this helpful?