You can't install an agent on a surface that has no endpoint.
Claude is no longer three tools on a developer's laptop. It's a Slack bot, an Excel sidebar, a design canvas, a phone that never touches a managed device, and a hosted agent session running on infrastructure you don't own. Operant governs all of it from one policy set.
Endpoint coverage was built on an assumption that stopped holding.
Claude runs on the user's machine, so govern the machine. That held for Claude Code, the CLI, and desktop Cowork. It doesn't hold for where Claude went next — and in each case the data still leaves the organization and the agent still acts on external systems. Only the observability disappears.
The prompt is a channel message, often carrying context from people other than the user who invoked it
A phone that may be personal, unmanaged, and entirely outside MDM scope
The sensitive material is pasted data, not a file on disk
There is no endpoint. The agent executes elsewhere; the local device sees only a result
The sensitive material isn't pasted in at all — it's the workbook, contract, or inbox already open
Three enforcement paths, one policy set.
Operant applies the strongest enforcement each surface's architecture permits. Every path writes to the same policies and the same audit trail.
Redact — Operant is in the data path and strips sensitive values in flight.
Block — enforcement runs through Claude inference hooks, which return an allow or deny verdict; policy violations are stopped rather than rewritten. Both are full enforcement. Surfaces routed through Amazon Bedrock, Google Cloud Vertex AI, or Microsoft Foundry credentials fall outside inference hook coverage and are governed through the Operant gateway.
Anthropic shipped the missing primitive on August 5.
When an organization enables inference hooks, Claude sends the prompt and its surrounding context to a designated security server before the model begins generating, and waits for an allow or deny before proceeding. The same check runs on tool call responses, including tools reached through MCP connectors, skills, and plugins.
Redact where we're in the path. Block where we're not.
You define a data classification rule once at the org level. Operant applies the strongest enforcement each surface permits.
On Claude Code, the CLI, Cowork desktop, and the browser extension, the endpoint agent sits between the user and the model. PII, PHI, PCI, credentials, and API keys are stripped from the prompt before it leaves the device, and the workflow continues uninterrupted.
On Claude Tag, Claude chat, Claude Design, and Cloud Cowork, violations are blocked with the specific rule surfaced to the user, so they can revise and resubmit. The sensitive value never reaches the model. The tradeoff is a harder stop instead of a silent cleanup.
Claude inside the tools people already have open.
In an Office sidebar, a Slack channel, or a browser tab, Claude isn't a destination the user navigates to. It's a panel next to the work — and embedding changes the threat model in four specific ways.
Traditional DLP waits for an event: a paste, an upload, an attachment. A payroll workbook that was already open is in the sidebar's context by default, so a prompt as unremarkable as "update the burden rate" carries every salary in it to the model.
Context carries from Outlook to Word to Excel to PowerPoint inside one conversation — the product's central feature. Material non-public figures can surface in a deck without any file leaving any app in a way per-application DLP would recognize.
The connector can send email, manage drafts and calendar events, and create and update files in OneDrive and SharePoint. Read access risks exposure. Write access risks consequences.
The connector acts on behalf of each user and reaches only what that user could already reach — which is the correct design, and which also means an over-permissioned employee becomes an over-permissioned agent.
Hooks give you the beginning and end of a story with the plot missing.
Cowork plans, reads and writes files, loads skills and plugins, drives a browser, calls MCP servers, spawns sub-agents, retries, and self-corrects across dozens of iterations before producing the response the user sees. Indirect prompt injection doesn't appear in the user's prompt — it appears at step 14, in a document the agent decided to open.
The Operant plugin instruments the loop itself. Every step is captured and policy-evaluated as it happens:
What the agent decided to do, and in what order, before it acts
Each call, its arguments, and its result — not a rolled-up summary
Reads, writes, and what data moved between them
Surfaced and reputation-scored before execution, with policy held against them
Inspected for exfiltration patterns, destructive operations, and reverse shell indicators before it runs
The child's loop traced under the same policy and session identity
Iteration counts, retries, and self-corrections — often the first signal an agent has been redirected
Because the plugin runs inside the loop rather than in front of it, it isn't constrained to a binary verdict. It can halt a specific step, scope a tool call, or block a command while the session continues.
Blocking is a harder stop than redaction.
Roll out accordingly.
The shadow window is what keeps the first enforcement day from being a support incident.
Let Operant inventory every Claude surface, MCP connection, skill, plugin, and agent in active use, including which credentials each embedded integration routes through
A signed WebSocket endpoint and a shared secret, set once at the Claude organization level
Verdicts evaluated against live traffic without blocking anything, so you see what would have been denied
With role-based exclusions before going to full enforcement
It binds to the same policy set