The Claude enterprise control plane: compliance API, inference hooks and agent budgets

If your organisation has been holding Claude at arm’s length because you could not answer “what did people actually send it, and can we stop them sending the wrong thing”, the honest answer changed in August. What follows is what each control does, what it costs you operationally, and — the part release notes never cover — where each one stops.

What actually shipped

Transcript retrieval, including from laptops

The Compliance API already covered a good deal. In August it gained two things that change its character. On 3 August it began returning transcripts of Cowork sessions started on claude.ai web or mobile. On 11 August it extended to Cowork and Claude Code sessions running on your users’ own machines — GET /v1/compliance/apps/sessions/local lists them across the organisation, and /messages on a session id returns its transcript. Both use the Compliance Access Key you already hold, with the read:compliance_user_data scope.

That second one is the significant change. Claude Code runs locally, against local repositories, and until now what happened inside those sessions was effectively invisible to the organisation paying for it. It is now retrievable centrally.

Where it stops

It is retrieval, not prevention. The transcript exists after the fact; nothing here stops a developer pasting a credential into a prompt, it only means you can find out that they did. It is also scoped to Claude’s own surfaces — sessions run through the API by your own applications are yours to log, and always were.

And it is worth naming plainly: this is employee monitoring. A capability that returns transcripts of work happening on someone’s own laptop carries obligations in most jurisdictions — notification, proportionality, a lawful basis. The technical control arrived before most organisations’ policies did.

Inference hooks: your security server gets a veto

This is the most architecturally interesting of the four. Point Claude at your organisation’s AI security server and each governed prompt across claude.ai, Cowork and Claude Code is held for that server’s allow or deny verdict before inference proceeds. Requests are signed. Failure handling is configurable. Every denial is recorded in the compliance Activity Feed.

The shape matters more than the feature. Until now, prompt-level DLP meant intercepting traffic at the network edge and hoping you could parse it. This inverts that: Anthropic asks your system for permission and waits.

What is the failure mode if the security server is down?

Failure handling is configurable, which means the decision is yours and it is the most consequential setting in the whole feature. Fail closed and an outage in your own security infrastructure stops every employee using Claude at all. Fail open and the control silently stops being a control at exactly the moment something is wrong. Whichever you pick, the thing that makes it survivable is alerting on the transition — a hook that has quietly been failing open for a week is worse than not having one, because everyone believes prompts are being screened.

Where it stops

“Governed prompt” is doing real work in that sentence. The scope is Claude’s own surfaces under enterprise management. An engineer with a personal API key and a script is outside it, which makes key management and egress control the boundary that actually holds. And a verdict server is only as good as its rules: the mechanism is sound, but it will approve whatever your policy engine approves.

Session budgets: an agent that stops itself

You can now set a hard cap on a Claude Managed Agents session’s spend, priced at public list rates. A session that reaches its budget pauses with the budget_reached stop reason rather than starting new model requests. Changing or removing the budget resumes it. Deployments accept the same budget and apply it to each session they start.

Two details are worth pulling out. It pauses rather than failing, so a long-running job is recoverable rather than lost — raise the budget and it continues. And budget_reached is a distinct stop reason, which means your orchestration can tell “ran out of money” apart from “finished” and “errored”, and page a human accordingly.

Where it stops

It is a per-session cap, not an organisational one. Ten thousand sessions each capped at $20 is still $200,000. The budget stops one agent running away; it does not stop a scheduled deployment running away in parallel. Aggregate spend remains yours to watch.

The workspace header, which sounds boring and is not

The Claude API now returns anthropic-workspace-id, carrying the wrkspc_-prefixed id of the workspace that the request’s API key or access token resolved to, including your organisation’s Default Workspace.

In a large organisation, keys proliferate and nobody is certain which workspace a given service is actually billing to. This makes attribution a property of the response rather than an act of archaeology — which matters for chargeback, for isolating a noisy service, and for knowing which team’s controls a request was subject to.

Does any of this apply to us?

Three of the four are beta and limited to Claude Enterprise: the compliance transcript endpoints and inference hooks. Session budgets apply to Claude Managed Agents. The workspace header is on the API generally. If you are on a Team plan or building directly on the API, the governance story is still largely yours to build — with the exception of budgets, which are available wherever Managed Agents are.

What a serious implementation looks like

Not a list of features enabled — a set of decisions made, written down, and owned by someone:

• The fail mode, chosen deliberately. Open or closed for inference hooks, with alerting on the transition and a named person who gets paged.
• A lawful basis for transcript retrieval, and staff told before it is switched on rather than after.
• Budgets on every deployment, plus an aggregate spend alarm the per-session cap cannot give you.
• Workspace-per-team, so the new header resolves to something meaningful rather than everything landing in Default.
• A retirement watch. Opus 4.1 now returns an error. Anything pinned to a specific model id needs an owner and a calendar reminder, not a discovery incident.
• Egress control on API keys, because every control above is scoped to Claude’s managed surfaces and a personal key routes around all of them.

The honest summary

This is a real control plane and it closes the gap that has kept a lot of regulated organisations on the sidelines. It is also eight days old, mostly in beta, and documented in release notes rather than anywhere a CISO would naturally look. If your security team’s objection to Claude was formed before August 2026, it was formed against a different product.

The work of turning these controls into a deployment your auditors accept — the fail modes, the policy rules, the approval points, the evidence trail — is not a feature you switch on. That is the job.

One more thing landed days later and belongs in the same file: Claude now marks everything it writes with an invisible watermark, worldwide and with no opt-out. That is a governance question for your documents rather than your infrastructure, and it arrived with even less warning than these did.

Sources

Every figure and behaviour above is taken from Anthropic’s own documentation, checked on 14 August 2026:

• Claude Platform release notes — entries dated 3, 5, 7 and 11 August 2026
• Compliance API and Compliance sessions
• Inference hooks
• Session budgets
• Workspaces

This page carries a verification date because these are beta features on a platform that shipped four governance changes in eight days. If you are reading it long after that date, check the release notes before acting on it.