There's nowhere to install an agent when Claude isn't running on a device.
Claude used to mean a few tools on a developer's laptop. Today it's also a Slack bot, a sidebar in Excel, a design canvas, an app on personal phones, and hosted agent sessions on servers you don't control. Operant covers all of them with one set of policies.
Endpoint security was built on an assumption that's no longer true.
The idea was simple: Claude runs on the user's machine, so secure the machine. That worked for Claude Code, the CLI, and Cowork on desktop. It doesn't work for where Claude went next. Data still leaves the company and the agent still acts on outside systems. You just can't see it anymore.
The prompt is a channel message, and it often includes context from people other than the person who tagged Claude
Often on a personal, unmanaged phone that MDM never sees
Sensitive data gets pasted in, so there's no file on disk to catch
There's no endpoint to protect. The agent runs somewhere else, and the local device only sees the result
Nothing needs to be pasted. The sensitive data is the workbook, contract, or inbox the user already has open
Three ways to enforce, one set of policies.
Each Claude surface is built differently, so Operant uses the strongest control each one allows. All three paths share the same policies and the same audit trail.
Redact: Operant sits in the data path and removes sensitive values before they're sent. Block: enforcement runs through Claude inference hooks, which return allow or deny. Requests that break policy are stopped instead of edited. Both count as full enforcement. Surfaces that use Amazon Bedrock, Google Cloud Vertex AI, or Microsoft Foundry credentials aren't covered by inference hooks, so the Operant gateway handles them.
On August 5, Anthropic released the piece that was missing.
With inference hooks turned on, Claude sends the prompt and its context to a security server the organization chooses. The model doesn't start generating until that server says allow or deny. Tool call responses get the same check, including tools reached through MCP connectors, skills, and plugins.
Redact where we're in the path. Block where we're not.
Write a data classification rule once for the whole organization. Operant then applies it as strictly as each surface allows.
On Claude Code, the CLI, Cowork desktop, and the browser extension, the endpoint agent sits between the user and the model. It removes PII, PHI, PCI data, credentials, and API keys from the prompt before it leaves the device, and the user keeps working without interruption.
On Claude Tag, Claude chat, Claude Design, and Cloud Cowork, a request that breaks policy is blocked and the user sees which rule it broke, so they can fix it and try again. The sensitive value never reaches the model. The tradeoff is that the user has to stop and edit instead of having it cleaned up for them.
Claude now lives inside the apps people already use.
In an Office sidebar, a Slack channel, or a browser tab, Claude isn't somewhere the user goes. It sits right next to the work. That changes the risk in four ways.
Traditional DLP waits for something to happen, like a paste, an upload, or an attachment. But a payroll workbook that's already open is part of the sidebar's context by default. A simple request like "update the burden rate" sends every salary in that file to the model.
In a single conversation, context moves from Outlook to Word to Excel to PowerPoint. That's the main point of the product. It also means material non-public figures can end up in a slide deck without any file leaving any app in a way per-app DLP would notice.
The connector can send email, manage drafts and calendar events, and create or edit files in OneDrive and SharePoint. With read access, data can leak. With write access, the agent can also act on it.
The connector acts for each user and can only reach what that user can reach. That's the right design, but it also means an employee with too much access becomes an agent with too much access.
Hooks show you how the story starts and ends, but not what happens in the middle.
Before the user sees a reply, Cowork may go through dozens of steps. It plans, reads and writes files, loads skills and plugins, uses a browser, calls MCP servers, starts sub-agents, and retries when something fails. Indirect prompt injection won't show up in the user's prompt. It shows up at step 14, inside a document the agent chose to open.
The Operant plugin runs inside that loop and checks each step against policy as it happens:
What the agent plans to do, and in what order, before it does it
Every call with its inputs and results, instead of a summary
What was read, what was written, and what data moved between files
Shown and given a reputation score before they run, then checked against policy
Checked for signs of data theft, destructive actions, and reverse shells before they run
Each sub-agent is traced under the same policy and session identity
Iteration counts, retries, and self-corrections. These are often the first sign that an agent has been pushed off course
Since the plugin works inside the loop, it isn't limited to allow or deny. It can stop one step, restrict a tool call, or block a command, and the rest of the session keeps going.
Blocking interrupts people more than redaction does. Roll it out gradually.
A week in shadow mode keeps your first day of enforcement from turning into a flood of support tickets.
Let Operant list every Claude surface, MCP connection, skill, plugin, and agent in use, plus the credentials each built-in integration uses
You add a signed WebSocket endpoint and a shared secret once, in your Claude organization settings
Operant checks live traffic without blocking anything, so you can see what would have been denied
Use role-based exclusions along the way, then move to full enforcement
It uses the same policies as everything else