On August 11, 2026, Anthropic extended Compliance API coverage to Claude Cowork and Claude Code sessions, in beta for Claude Enterprise organizations.
Compliance and security teams can retrieve prompts, responses, and tool activity for those sessions through the same interface they already use for chats, with no new key, scope, or client update. For an organization that has been governing an agentic surface without a first-party record of it, that is a material addition. Our observation is that the addition is best read for where it binds, because that determines what it can be asked to prove.
Where the capture point sits
The reference documentation states the mechanism directly. For sessions running on users’ machines, Anthropic records each conversation server-side as its requests reach the Claude API; nothing is installed on the device, and nothing is collected beyond the requests the client already sends to the Claude API. The transcript is then reconstructed from those captured calls — user prompts, assistant text, tool calls, and the text portions of tool results.
The consequence is stated in the same passage, and it is the sentence this dispatch is built around: local session transcripts show what Claude was asked to do and what it returned, not what happened on the device. File and network activity is visible only through the tool calls and tool results in the transcript, so activity that never reaches the API is not captured.
Stated precisely: the Compliance API records the inference stream and not the agent. It observes the boundary where context enters the model — bounded even there, as the omissions below set out. It does not observe the boundary where the harness commits state.
Three boundaries, and where each one binds
The enterprise now holds three instruments over a Claude agent, and each binds at a different point.
The inference hook binds at the context boundary. Because the hook runs on Anthropic’s servers, after the request leaves the client and before the model runs, it applies to every governed request uniformly, with nothing to install on user devices. Anthropic sends the conversation transcript to an AI security server the organization operates and waits for an allow or deny verdict; a denied request never reaches the model. Its verdicts are allow or deny — rewriting or redacting a prompt is not supported.
The Claude Code hook binds at the write boundary. PreToolUse fires before a tool call executes and can block it, and exit code 2 blocks the tool call. It can also rewrite rather than only refuse: updatedInput replaces a tool’s arguments before it runs, and updatedToolOutput replaces a tool’s result, which the reference names as the interception points for redaction and transformation.
The Compliance API binds at the evidence boundary — which, on the mechanism above, is the same boundary the inference hook occupies. It refuses nothing and rewrites nothing; the session endpoints are read-only, and local and remote sessions cannot be deleted through the API.
Two asymmetries in that arrangement are worth drawing out, and both come from the vendor’s own pages.
The first is reach. Hooks run wherever Claude Code runs: sessions in the terminal, IDE extensions, the Desktop app, and Claude Code on the web all fire the same hook events. One inference hook configuration governs claude.ai, Cowork, and Claude Code sessions, whether they run on the web, in the desktop app, or in the CLI. The evidence plane stops short of that: Claude Code on the web also runs in the cloud in Anthropic-managed environments, but it is not a remote session, and the remote session endpoints return Cowork sessions only.
The second is failure posture. If the AI security server is unreachable, errors, or does not respond within the timeout, the organization’s failure-handling setting decides between blocking the request and allowing it to proceed without inspection. On the harness side, a timed-out command, HTTP, or MCP-tool hook does not block the tool call — the call continues through the normal permission flow, and the reference advises against counting on a stalled hook to act as a gate. These are configuration and operational facts rather than defects, and they belong in the assurance register as such.
What the transcript does not carry
The reconstruction is deliberately bounded, and the omissions are specific. Thinking blocks are never included. The request’s system prompt is never returned; a marker message stands in for it. Tool definitions and MCP server configuration are not part of the transcript.
That last exclusion is the one with governance weight. A reviewer reading a transcript can see which tool was called and what was passed to it. The reviewer cannot reconstruct, from the transcript, what the agent was permitted to call. Authorization scope sits outside the record. The same holds at the context boundary: the AI security server never receives system prompts or Anthropic-internal context, and system prompts and tool definitions are never included in what is sent. Two instruments, and neither carries the authorization surface.
Attribution has a boundary too. Project instruction files such as CLAUDE.md appear as ordinary user-role content, and skill content appears when the client sends it as message content and is not distinguished from other user text. For an architecture that treats skills as policy artifacts, the record does not separate the policy from the prompt.
The provenance ladder
Each message carries a provenance field describing how its content was captured, and it is null for verified content captured by the Claude API, which is the common case. Where it is set, the record is present but qualified, and three rungs matter to a reviewer.
client_asserted marks assistant messages the client supplied as conversation history that could not be matched to a captured response; their authorship is not verified. synthetic_marker marks records the endpoint generated itself — including the case where the client compacts its conversation history mid-session, at which point a marker is inserted, and where the organization has a finite retention period the rewritten history itself is withheld and only the latest user turn and what follows are shown.
content_unavailable carries a reason, and one value is worth naming. not_captured means no content is available for the turn — and, in the documentation’s own words, it does not prove that no record was stored: content that Anthropic’s data-handling policies withhold from the Compliance API is reported with the same reason. A reviewer receiving that value cannot distinguish an absence from a withholding. For an instrument the documentation positions for eDiscovery exports and data loss prevention enforcement, that is a limitation to carry into any evidentiary claim built on it.
Where privacy posture subtracts assurance
The retention page states the interaction plainly: the Compliance API does not capture local sessions for which zero data retention is in effect, or any local sessions from organizations with HIPAA readiness enabled. Sessions under ZDR are excluded from list results, and the retrieve and messages endpoints return 404 for them.
Three further facts from the same page shape what an architect does with that. HIPAA readiness is enforced at the organization level, and organizations needing both HIPAA-ready and general-purpose access are directed to use separate organizations. Claude Code is not covered under HIPAA readiness. And once HIPAA readiness is enabled for an organization, the configuration is permanent and cannot be disabled by an administrator.
Read together: a regulated enterprise can make a one-way organizational decision that removes the agent evidence channel for both Cowork and Claude Code, for a product the arrangement does not extend to. The architecture question — which organizations exist, and which workloads land in each — is decided before enablement, because it cannot be decided after.
Retention carries a second dependency. Local session transcripts are stored for six years by default, or for the organization’s custom conversation retention period when a finite one is set, and where more than one custom period is configured, the shortest applies. A change takes effect asymmetrically: the endpoints stop returning activity older than the current period as soon as the setting changes, whereas each captured message is stored for the period in effect when it was captured, so lengthening the period later does not restore content that has already expired. Remote session transcripts are retained for six years. The evidence window for agent sessions is therefore governed in part by a data-privacy setting, and it is not symmetric under change.
What the enterprise owns
The documentation is candid about the integration work that sits on the customer’s side, and four items belong in any assurance map built on this instrument.
Truncation defaults are consequential. Tool inputs and each tool result text entry are truncated to 10,000 bytes by default, and a truncated tool_use input is no longer valid JSON, so tool inputs should be parsed only from untruncated blocks or refetched at a raised cap. A pipeline that parses tool inputs will not fail loudly at default settings.
Polling has a documented loss mode. A bound set to the exact previous run’s time silently and permanently drops a session whose final call was still indexing at that moment, because once the bound advances past that call no later run returns it. The documented remedy is to set each run’s lower bound a few minutes earlier than the previous run’s start and to deduplicate on id.
Identifiers move. For local sessions, created_at is the timestamp of the session’s earliest retained call, so as older calls age past retention it advances accordingly, and callers are directed to deduplicate on id when re-walking the list.
Scope filters exclude more than they appear to. On the remote session list, the user filter matches the session’s owning user, so agent-owned sessions are excluded whenever it is set. A hold scoped to a named custodian therefore omits the agent-owned runs that custodian initiated, which the record identifies separately through started_by_user.
One further observation sits at the level of the instrument rather than its parameters. The Compliance API documentation supplies curl and points to security and compliance platforms that have built integrations on top of it; it references no first-party client library for the endpoints. Both governance instruments in this readout are specifications the enterprise implements — the AI security server on the enforcement side, and the polling, pagination, deduplication, and retention handling on the evidence side.
The hard claim
Enforcement reaches the surface that observation does not. One inference hook configuration governs Claude Code on the web, and the harness fires the same hook events there as in the terminal. The session endpoints do not return those sessions at all. An enterprise operating that surface can stop a tool call it will never be able to retrieve a transcript of.
That inverts the assumption an assurance program usually rests on — that whatever cannot be prevented can at least be reviewed. Here the reverse holds, and it holds because the evidence boundary is co-located with the context boundary rather than the write boundary. A record taken where requests reach the API can attest to what Claude was asked and what it answered. It cannot attest to what the harness committed. Consolidating evidence at the context boundary does not produce evidence of the write.
None of which is a criticism of the instrument. A vendor can evidence what reaches its own API, because that is what it can see; Anthropic states that nothing is installed on the device and nothing is collected beyond the requests the client already sends. The boundary of the record is the boundary of the vendor’s knowledge. Assurance spans further than that, and the enterprise owns it — the instrument is supplied, the guarantee is not.
The next dispatch in this line takes up what decides visibility in the first place: authentication path, platform, and privacy posture, none of which is a property of what the agent did.
The Compliance API records the inference stream and not the agent. Enforcement reaches the surface that observation does not: one inference hook configuration governs Claude Code on the web, and the session endpoints do not return those sessions at all.
A record taken where requests reach the API can attest to what Claude was asked and what it answered. It cannot attest to what the harness committed.
