AI Acceptable Use Policy: How Firms Can Now Enforce It Before A Prompt Is Answered

An AI acceptable use policy tells staff what they may and may not put into AI tools, such as client personal data or unpublished results. Until recently most firms could only train staff and hope. Controls that check each prompt before the model answers make the policy enforceable, which is the change Anthropic shipped for its enterprise customers on 20 October 2026.

What are inference hooks?

Anthropic's release notes describe inference hooks as a way to point Claude at an organisation's own AI security server. Each governed prompt across claude.ai, Cowork and Claude Code is held for that server's allow or deny verdict before inference proceeds, and the requests are signed. On 20 October 2026 the feature came out of beta for Claude Enterprise organisations.

The same day Anthropic launched user profiles, which let firms that run platforms or resell access tell Anthropic which end customer each request is for, so a safety enforcement action can apply to one end customer instead of the whole organisation. It also added organisation webhooks to the Admin API in beta.

How do you turn an AI acceptable use policy into checks?

• **Write rules a machine can test.** For example: no full client account numbers, no passport numbers, no documents marked confidential.
• **Decide allow, deny or review.** Some prompts should be blocked, others allowed with a log entry.
• **Log every decision.** Who, when, which rule and the outcome, without storing the sensitive content itself.
• **Review the denials.** A weekly look at what was blocked shows where staff need better tools rather than more warnings.

Does prompt checking replace human review?

No. A prompt check stops data leaving where it should not. It does not check whether the AI's answer is right. Work that matters, such as a client email or a reconciliation fix, still needs a person to approve it. Our explainer on human in the loop AI covers that side, and our article on AI agent security gives questions to ask vendors.

Where should a firm start?

Take your current policy and mark each line as testable or not. Start enforcing the testable ones in the AI tools staff actually use. Our Agentic AI London team builds agents that log every action and leave every decision with a person, as described on our services page, and a 14-day Proof Run shows the pattern on one workflow.