Native Audit & Governance, End to End

Native records, customer exports, and separate observation are different capabilities. Enterprise security center (beta) adds configuration assessments, Owner attestations, PDF export, and Compliance API access. Its feed records attestation changes, not every control-status change; expirations and other changes can be missing. The current-results endpoint returns no history, omits some controls and attestations, and returns no attestation comments. Passed can include accepted risk while the control is not in place. Compare status, current values, and retained events; no missing record proves that nothing changed. This is view-only guidance, not certification or proof of executed actions. Enterprise IP allowlisting and member sign-out add access controls, not universal stop controls: blocked chat work can continue for up to 24 hours, and sign-out leaves API keys, Code cloud sessions/schedules, and linked Cowork computers intact. Cowork’s local-VM EDR remains a separate observer, not a documented signed, portable action record.

Enterprise Compliance API session endpoints are stable for local and remote Cowork and local Claude Code. Unified conversations, including cloud tool work, use the chat endpoints in beta. Customers can archive these records. Code cloud sessions, including cloud scheduled tasks (formerly routines), API-key and third-party-cloud sessions remain outside Compliance session capture. Hosted Managed Agents has a separate event API and beta OTel; delivery and sampling can omit spans. Self-hosted Managed Agents (private beta) keeps history in your database and supports opt-in telemetry. Customer operation changes custody, not independent witnessing of the harness’s own records. Its signed MCP identity tokens authorize access, not attest that a tool completed. These records support audits without independently establishing every action that occurred. Retention-policy deletion of chats, projects, and published artifacts emits no corresponding Activity Feed deletion event, although policy changes are logged; a missing deletion event does not prove continued retention.

Anthropic's Access Transparency log (beta, eligible customers on request) is genuinely signed and tamper-evident: saved checkpoints and Merkle proofs let customers verify its committed history. For enrolled organizations, Access Transparency events continue to be recorded while the Compliance API is off; access resumes when it is re-enabled. Coverage remains Anthropic personnel access and content preservation, including eligible API-key Claude Code traffic, not agent tool actions. Anthropic explicitly says it does not prove every access was recorded or accurately described.

Enterprise Inference hooks, now out of beta, can route prompts and proposed tool calls to a customer-operated policy service, which can archive the frames. A server verdict is not a human approval. The delivery HMAC uses a shared secret; it does not establish independent, portable proof that a tool executed. Hook coverage excludes Platform/API organizations, including Managed Agents, and some product calls. Only selected roles mode inspects members set to Custom roles with a selected role, not owners or other built-in roles even if assigned that role; with no qualifying members, no member is inspected. Role scope, fail-open settings, sampling, and circuit-breaker gaps must be assessed.

Cowork's beta EDR integration is available on Team/Enterprise with Desktop 4.4212.0 or later on macOS/Windows, including supported third-party-cloud connections. The customer's approved security vendor observes local VM activity and receives the data separately from Anthropic; cloud sessions are excluded. The sensor can export prompts, files, and responses outside Cowork's network allowlist. Sensor coverage and evidence integrity need separate verification. The checked signature covers the installer package, not later sensor updates or action records. Generated-content provenance, customer exports, and OpenShell logs answer different questions. Code v2.1.312+ emits no safety_event; v2.1.307–311 can also stop after a feature-flag refresh. Standard sessions retain tool/permission records, with version-specific fixes such as v2.1.321’s NotebookEdit correction. Experimental Code Mode (v2.1.323+) cannot run with OTel export and is terminal-only. Its local transcript visibility does not establish Compliance capture parity. Hook failure rules also differ: some Code Mode PreToolUse failures/timeouts refuse calls even without onFailure; ordinary exit code 1 still proceeds unless configured to block. Check the mode and hook type, not just hook presence. The v2.1.316 release notes report refusal of unverified cached server-managed settings for Team/Enterprise logins. Configuration integrity is not a signed action record. Custom audit mods can stop in safe mode or after repeated crashes. The built-in guard also skips selected user-mod hooks and transcript rows; verify organization-owned installation where those events are needed. Failed or timed-out mod policy hooks are skipped and need event-appropriate refusing registration-level .catch handlers to fail closed. Agent SDK callbacks are a separate mechanism: onFailure: "block" (TypeScript v0.3.317+, Python v0.2.177+, compatible Code required) can block when a callback fails. Without it, most failures proceed to normal permission handling. PostToolUse cannot undo execution, PermissionRequest can lose the race to canUseTool, and stop/completion events ignore the option. These records and controls do not establish complete, independently witnessed execution.