Zenity Launches Universal Runtime Control for Claude Enterprise

Anthropic's Inference Hooks update lets security teams validate Claude's tool calls before they run. Zenity supports it across Claude's surfaces, so teams can approve write-capable connectors, Model Context Protocol (MCP) servers, and wider Claude Code rollouts with policy on each action.

Anthropic’s recent Inference Hooks update adds a security checkpoint before each tool call Claude proposes. Now, with “Validate tool calls” enabled, every call goes to the organization’s security server, which allows or denies it before it runs.

That turns inference hooks from a DLP feature into an active cybersecurity control. Zenity supported these hooks for data protection from the start. With this update, we’ve expanded our support to let security teams control Claude’s actions and block unsafe behavior before it happens.

This makes it easier to approve autonomous AI use within Zenity Boundaries and opens up new use cases. Security teams can decide whether Claude can write to the CRM, run a shell command, or connect to a new MCP server. Decisions that previously depended on device-level controls can now be enforced per action, even on devices with no security software installed and no local hooks attached to the harness.

The “Point-of-Action” Is Where Policy Belongs

An agent’s permissions and tools determine its blast radius. A proposed tool call shows how it intends to use that access, including the operation, the data involved, and any destination. Inspecting prompts and tool results can catch exposed credentials or malicious instructions hidden in a Jira ticket. Inspecting the action gives security teams another chance to stop an unauthorized operation when earlier checks miss an attack or a legitimate task goes off course.

Previously, Inference Hooks exposed tool calls in the next request, after execution. A denial could stop further processing, but it could not prevent the completed action. Anthropic’s update lets Zenity inspect supported tool calls and block prohibited actions before execution. Zenity already provided inline prevention through native coding-agent hooks. This integration adds a checkpoint within Anthropic’s infrastructure and enforces Zenity’s allow-or-deny decision, without requiring hooks or an agent on each user’s device.

How the Checkpoint Works

With tool-call validation enabled, Anthropic’s tool_call event sends proposed calls to Zenity and holds them for an allow-or-deny verdict. Zenity evaluates the calls against policy, and Anthropic enforces the decision before execution. A call that would send sensitive data to a prohibited destination can therefore be blocked before the data leaves.

One configuration governs supported conversations across claude.ai on web, desktop, and mobile, as well as Cowork, Claude Code, Claude for Microsoft 365, Claude in Chrome, Claude's built-in browser, and Claude Tag in Slack. No Zenity endpoint agent or browser extension is required for this integration. Anthropic provides the checkpoint, and Zenity provides the verdict.

What Zenity Enforces

Zenity Boundaries evaluate what an operation does, which tool provides it, and whether injected instructions influenced the action.

Read and write controls

Boundaries classify supported calls as reads or operations that write, update, delete, or execute. A policy can allow Claude to read a shared-drive file while blocking deletion. Classification does not depend on tool names, which vary across connectors and versions. At the pre-execution checkpoint, a Boundary configured to Prevent blocks the prohibited operation.

Tool provenance

Tool-call metadata identifies the provider as the platform, the Claude application, a third-party server, or the client. Client tools include bash and local MCP servers in Claude Code. Third-party metadata can also include the server’s origin and whether Anthropic has verified it.

Where those signals are available, Boundaries can restrict access to reviewed servers and connectors or block origins that policy disallows. These controls depend on the metadata supplied with each call.

Actions influenced by prompt injection

When Zenity detects an injected instruction in content Claude reads, it marks the session as tainted. If a later tool call acts on that instruction, the Boundary blocks it before execution. The user sees the denial reason in Claude, and the security team can review the chain of events in Zenity. Claude’s Activity Feed records the denial with a reference to the finding.

Anthropic applies one verdict to the entire group of tool calls in a response. A denial stops every call in that group and ends the response. Teams should account for this when tuning policies: one prohibited operation can also stop permitted calls submitted alongside it.

This integration extends Zenity’s existing Claude coverage with centrally managed pre-execution enforcement. Its Compliance API integration supports the subsequent audit and investigation.

What Security Teams Can Approve Now

With a pre-execution verdict, each capability below can stay enabled, with policy on the actions it takes.

What's Next

Anthropic has indicated that more hook events are coming, and each new checkpoint is another place Zenity's existing policies can run without a new deployment. See Zenity for Claude Enterprise for the full integration.

Zenity customers can ask their account team to enable tool-call enforcement. If you're not yet a customer, book a demo, and we'll show you an out-of-policy tool call stopped before it runs.