> For the complete documentation index, see [llms.txt](https://help.nightfall.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.nightfall.ai/data-exfiltration-prevention/ai-agent-security/ai-governance/hook-policy-recommendations.md). # Hook policy recommendations Recommended AI Agent Security policies for coding agents, Claude Enterprise Inference Hooks, and remote MCP servers. Five policies cover most organizations. Policies 1, 2, and 4 run on coding agents through device hooks. Policy 3 runs on Claude Enterprise through Inference Hooks. Policy 5 is a gateway setting, not a policy. | # | Policy | Control | Hook types | Action | | - | ------------------------------------------------ | ------------------------------------- | -------------------------------------------------------- | ------------------------------ | | 1 | Block secrets in coding agents | Device hooks | User Prompts, Tool Calls, Tool Responses, Shell Commands | Block from day one | | 2 | Block regulated data in coding agents | Device hooks | User Prompts, Tool Calls | Monitor for a week, then Block | | 3 | Block sensitive prompts in Claude Enterprise | Inference Hooks | User Prompts | Shadow mode, then Block | | 4 | Record regulated data in tool output and replies | Device hooks | Tool Responses, Model Responses | Monitor | | 5 | Limit what remote MCP tools can do | MCP Gateway and MCP Server Visibility | Not applicable | Disable write and delete tools | Device hooks cover Claude Code, Cursor, and VS Code Copilot on managed devices. Inference Hooks cover Claude Enterprise everywhere it runs, with no agent. To decide which controls you need, see [Choosing a control](/data-exfiltration-prevention/ai-agent-security/ai-governance/choosing-a-control.md). To pair these with your endpoint policies, see [AI agent and Inference Hooks policies](/data-exfiltration-prevention/exfiltration_endpoint/policies/recommended-policy-configurations/ai-agent-and-inference-hooks-policies.md). ### Rules for every agent policy 1. **One action per policy.** Block or Monitor applies to every hook type you select. Model Responses can only record, so keep it in a separate Monitor policy. 2. **Know what each hook type sees.** Tool Calls covers MCP tools and subagent launches, before they run. Tool Responses covers MCP tool output, after the tool runs and before the model reads it. Shell Commands covers terminal commands and the agent's built-in file tools, including the content the agent writes to a file. 3. **Do not use the source code classifier on agent policies.** Reading and writing code is what coding agents do, and Claude Code traffic on Claude Enterprise passes through Inference Hooks. A source code rule matches ordinary work. Control where code goes instead, with policy 5 and the endpoint source code policies. 4. **Turn content scanning on and add detection rules.** With content scanning off, Block denies every event the policy covers and Monitor records every event. 5. **Give Inference Hooks their own policy.** Select User Prompts only and leave MCP server scope on All MCP servers. 6. **Write a custom block message.** Agent policies do not send end-user notification emails or offer override with justification. The block message is what the person sees in their client. 7. **Name policies by control**, for example "Device hooks: block secrets" and "Inference Hooks: block sensitive prompts", so an admin can tell them apart. *** ### 1. Block secrets in coding agents **Use case.** Stop API keys, passwords, and private keys from being pasted into a prompt, passed to an MCP tool, returned by an MCP tool to the model, run in a terminal command, or written into a file by the agent. **Where.** Device hooks: Claude Code, Cursor, and VS Code Copilot. **Scope.** All users with hooks installed, or start with engineering and anyone with production credentials. MCP server scope: All MCP servers. Shell command patterns: empty, so every command and file write is scanned. **Hook types.** User Prompts, Tool Calls, Tool Responses, Shell Commands. Tool Responses stops the model from reading a secret a tool returned. The tool has already run. Blocking tool responses works on the macOS and Windows agents. VS Code Copilot does not support it. **Detection rules.** Credentials and API keys. Passwords. Cryptographic private keys. **Action.** Block. Admin alert to the security channel. **Block message.** *"Nightfall blocked this because it contains a secret or API key. Remove it, and rotate the key if it was already shared."* Credential detectors are specific enough to block on day one. *** ### 2. Block regulated data in coding agents **Use case.** Stop customer PII, payment card data, and health information from being pasted into a coding agent or passed to an MCP tool, such as a database query result sent to a chat or ticketing tool. **Where.** Device hooks: Claude Code, Cursor, and VS Code Copilot. **Scope.** All users with hooks installed. MCP server scope: All MCP servers. **Hook types.** User Prompts and Tool Calls. During the monitor week, also select Shell Commands. If most of its matches are test fixtures or sample data the agent is writing, remove Shell Commands before switching to Block. **Detection rules.** PII, PCI, PHI. **Action.** Monitor for one week, then Block. Admin alert to security and compliance. **Block message.** *"Nightfall blocked this because it contains customer or regulated data. Use test data, or contact your security team."* *** ### 3. Block sensitive prompts in Claude Enterprise **Use case.** Stop PII, payment card data, health information, and credentials from reaching Claude, for the whole Claude Enterprise organization, including people who never installed the Nightfall agent. **Where.** Inference Hooks. Covers claude.ai, Claude Desktop, mobile, Cowork, Claude in Slack, and Claude Code signed in to your organization. **Scope.** The whole organization. A user inclusion list is unreliable on claude.ai in this release. Use role exclusions in the Claude admin only for people who should not be inspected. MCP server scope: All MCP servers. A tool-specific scope does not apply to an ordinary chat turn. **Hook types.** User Prompts only. The other hook types do not fire on Inference Hooks. **Detection rules.** PII, PCI, PHI, credentials and API keys. After the shadow week, add file classifiers for financial, HR, legal, and M\&A documents if you want to control attachments. Do not add the source code classifier, because it would block Claude Code. **Action.** Monitor while Claude is in shadow mode. Switch to Block in the same window as you turn on **Enforce verdicts** in Claude. **Claude settings for the shadow period.** 100% of traffic inspected, timeout of at least 5,000 ms, failure handling set to **Allow the request**. Keep the Compliance API on, so hook denials appear in Claude's activity feed. **What it scans.** Each check contains the new text in the conversation: the prompt, text extracted from attachments, and tool arguments and results from earlier steps. A match stops that model turn. It does not undo a tool that already ran, so keep policy 1 on devices where a command or tool must not start. **What it does not cover.** Images, Claude on Bedrock or Vertex, Console API keys, Claude Team, Cursor, VS Code, and roles excluded in the Claude admin. Setup steps are on [Connect Inference Hooks](/data-exfiltration-prevention/ai-agent-security/ai-governance/auditability-and-control/setup-and-installation/connect-inference-hooks.md). *** ### 4. Record regulated data in tool output and replies **Use case.** Keep a record of customer and regulated data that MCP tools return to the agent and that the model writes back, for investigations, without blocking the work. **Where.** Device hooks: Claude Code, Cursor, and VS Code Copilot. **Scope.** All users with hooks installed. MCP server scope: All MCP servers. **Hook types.** Tool Responses and Model Responses. Do not add pre-action hook types to this policy. Secrets in tool output are already blocked by policy 1. **Detection rules.** PII, PCI, PHI. **Action.** Monitor. Start without admin alerts and review events in the console. Add alerts once you know the volume. If a tool should never return this data to the model, move that case to a Block policy with Tool Responses selected. *** ### 5. Limit what remote MCP tools can do **Use case.** Give developers one approved path to remote MCP servers, and remove the tools that can change or delete data. **Where.** [MCP Gateway](/data-exfiltration-prevention/ai-agent-security/ai-governance/mcp-gateway.md), not the policy wizard. **Setup.** Enable the servers you approve. Disable write and delete tools you do not need. Refresh the server after new tools appear, and review the tool list again. The gateway does not scan content in this release. A content policy on gateway traffic will not block a call. Use policies 1 to 3 for content. **Pair with** [**MCP Server Visibility**](/data-exfiltration-prevention/ai-agent-security/ai-governance/mcp-server-visibility.md)**.** The gateway only sees clients pointed at it. Review Visibility weekly for local servers and vendor URLs that bypass the gateway. *** ### Roll out in two weeks 1. **Week 1.** Policy 1 on Block. Policies 2 and 4 on Monitor. Policy 3 in shadow mode. Set up policy 5 for the remote servers you already use. 2. **Week 2.** Review policy 2 matches, then switch it to Block. After a business day of policy 3 decisions that look right, turn on Enforce verdicts in Claude and switch policy 3 to Block. 3. **Ongoing.** Review MCP Server Visibility weekly. Add new remote servers to the gateway with write and delete tools off by default. ### Which policies for your situation | Situation | Deploy | | ---------------------------------------------------------- | ------------------------------------------------------------- | | Claude Enterprise, with no laptop rollout | Policy 3, plus the Compliance API | | Claude Code, Cursor, or VS Code Copilot on managed devices | Policies 1, 2, and 4 | | Both | Policies 1 to 4, plus the Compliance API | | Remote MCP servers | Policy 5 | | Claude Code on Bedrock, Vertex, or a Console API key | Policies 1, 2, and 4. Inference Hooks do not see this traffic | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://help.nightfall.ai/data-exfiltration-prevention/ai-agent-security/ai-governance/hook-policy-recommendations.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.