Get access
- A Claude Enterprise organization and its Owner or Primary Owner. The Admin role cannot configure inference hooks.
- A Silmaril deployment with the Claude Enterprise integration enabled.
- The complete inference URL and dedicated integration API key supplied through deployment access.
POST /integrations/claude-enterprise/inference. Use the complete URL supplied by Silmaril, including any deployment prefix. The classify and LiteLLM guardrail URLs are separate endpoints.
Anthropic requires a publicly reachable HTTPS endpoint on port 443 without redirects. Private addresses, localhost, and reverse tunnels such as ngrok are not supported. Ask Silmaril to arrange the endpoint before connecting your organization.
Connect the organization
- In Claude, open Organization settings > Data and privacy > Inference hooks and turn on Allow for your organization. This makes the settings available; inspection remains off.
- Open the inference-hook settings and select Configure. Enter the supplied Silmaril Endpoint URL, then select Next.
- Claude reveals a webhook signing secret once. Store it securely and register it with your Silmaril operator through the agreed secure secret-transfer channel. Silmaril must register it before the connection test can succeed.
- Continue to Custom request headers. Add
x-api-keywith your dedicated integration key. - Run Test connection, confirm an allow verdict and acceptable round-trip latency, then save the headers. If the synthetic prompt is denied, review the policy with Silmaril before enabling blocking.
Observe traffic
- Under Failure handling, set Mode to Shadow mode.
- Set Prompt verdict timeout (ms) above your Silmaril integration deadline, allowing time for the network exchange. Silmaril’s default deadline is 4,500 ms; Claude’s default timeout is 5,000 ms. Confirm the configured values and measured latency with Silmaril.
- Set Requests inspected (%) to 100 during verification. Check role limits and exclusions so the accounts you test are included.
- Turn on Validate tool calls and Enforce verdicts. Allow about a minute for settings to propagate before testing a new session.
Verify and enable blocking
Start a new session on each intended surface: Claude web, Claude Code, and Cowork. Send a benign prompt and perform a benign tool operation where supported. In your Silmaril dashboard, select the matching Firewall and time window and correlate the activity using its timestamp, request or reference ID, conversation, and tool name. Arrange a controlled would-block test with Silmaril. Confirm a finding while the workflow continues in Shadow mode. A returned denial in Shadow mode is evidence of a would-block decision, not confirmation that an action was stopped. Silmaril normalizes each frame into its shared trailing window and judges the final event using the same state and cache machinery as LiteLLM. Claude applies one verdict to the whole frame, including all tool calls in a tool-call frame. After reviewing the findings and legitimate workflows, choose Allow the request or Block the request under failure handling while keeping Enforce verdicts on. Both settings enforce returned denials; they differ when Silmaril is unreachable or cannot complete an evaluation. Agree on the failure policy with your security owner, then verify a controlled denial on each intended surface before expanding enforcement. To return to observation, select Shadow mode. To stop sending requests, turn Enforce verdicts off. These settings do not change separately installed Silmaril agent plugins.Coverage and limits
- Coverage applies to governed requests in the configured Enterprise organization. Personal accounts, Claude Platform API access, Amazon Bedrock, and Google Cloud traffic need separate integrations.
- Frames include transcript text, tool calls and results, and extracted attachment text. Raw file and image bytes, system prompts, tool definitions, and hidden reasoning are excluded. Image-only content is not inspected.
- Tool-call validation can omit some internal Claude tools. Voice operations and some hosted background features also have exceptions; see Anthropic’s coverage documentation.
- A tool result is visible when it returns in a subsequent governed prompt. The integration cannot undo a completed action.
- A large frame can be evaluated even when the complete original frame exceeds Silmaril’s capture budget. Unavailable evidence is marked explicitly; a verdict does not guarantee that the entire frame was retained.
- Anthropic accepts allow or deny verdicts. Native hooks do not provide Silmaril’s local-plugin warning injection or content replacement.
- Claude Code can also use the agent plugin for local lifecycle coverage. Coordinate overlapping enforcement with Silmaril.
Troubleshooting
Authentication failures, invalid signatures, oversized requests, and evaluation timeouts are failed checks, not benign verdicts. Anthropic applies the configured failure policy; sustained failures can trip its circuit breaker. See Anthropic’s failure handling and recovery guide.
Coordinate signing-secret rotation with Silmaril and use Shadow mode during the change. Claude reveals the replacement secret once and immediately starts signing new requests with it. Register the new secret securely, repeat the connection test, and confirm traffic before restoring enforcement.