One read of Claude Developer Platformapi-20261028T210710Z
2 pages moved out of 821 read.
Pages moved
2
significant first
Pages read
821
in this capture
Captured
21:07 UTC
Corpus hash
f24694a388ea
corpus-hash
What this read moved
1-2 of 2manage-claude/inference-hooks-configuration Changed · +15 / -1 lines
### Inspect only selected roles
from line 107
107107
108108## Exclusions
109109
110Under **Exclusions**, select roles whose members are not covered by Inference hooks: their prompts are never sent to your AI security server. Only custom roles your organization created can be excluded; the built-in roles aren’t offered. Select them in the role selector, whose placeholder reads **Select roles to exclude**, and manage who holds each role from the roles admin page (**Manage roles**); changing exclusions requires identity management permission. The list is empty by default, and with no roles excluded, every governed request is inspected.
110Under **Who is inspected**, with **Limit by role** turned on, select roles whose members are not covered by Inference hooks: their prompts are never sent to your AI security server. Only custom roles your organization created can be excluded; the built-in roles aren’t offered. Select them in the role selector, whose placeholder reads **Select roles to exclude**, and manage who holds each role from the roles admin page (**Manage roles**); changing exclusions requires identity management permission. The list is empty by default, and with no roles excluded, every governed request is inspected, unless **Inspect** is set to **Only selected roles**.
111111
112112Exclusion applies to a user’s interactive sessions. Changes to the exclusion list are recorded in your organization’s [Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed) as role permission changes (`rbac_role_permission_added` and `rbac_role_permission_removed`).
113
114### Inspect only selected roles
115
116Everything in the **Who is inspected** section sits behind one switch, **Limit by role**. When you turn the switch on, **Inspect** starts on **Everyone except excluded roles**, and the excluded roles are selected under it as described above.
117
118To try Inference hooks on part of your organization first, turn on **Limit by role**, set **Inspect** to **Only selected roles**, and select the roles in the dialog box that opens. From then on, only members who are set to **Custom roles** and are assigned a selected role are inspected. Members set to any other role, such as **User** or **Owner**, are not inspected, even if they are assigned a selected role. That includes you if you are set to **Owner** or **Primary owner**. Remove every excluded role before you switch: an organization uses exclusions or selected roles, not both. After the switch, add or remove roles in the role selector under **Inspect**. To go back to inspecting everyone, turn **Limit by role** off: after you confirm, this removes every excluded role and turns **Only selected roles** off.
119
120While **Only selected roles** is set:
121
122* A custom role whose **Capability access** is **All capabilities** or **All generally available** counts only if you select it, like any other role.
123* If no member set to **Custom roles** is assigned a selected role, no member is inspected.
124* Requests with no member behind them are not inspected, such as requests made with API keys, and Claude Tag conversations in Slack.
125
126The switch and changes to the inspected roles are recorded in your organization’s [Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed).
113127
114128## Custom blocked prompt message
115129
manage-claude/user-management Changed · +1 / -1 lines
from line 2212
22122212
22132213`GET /v1/organizations/rbac_roles/{rbac_role_id}/permissions` returns the role’s permissions. Each permission pairs a `resource` (what it applies to: the organization’s product features, a connector tool, a connector OAuth scope, one connector, or every connector) with an `action` (what it grants on that resource). Rows for features not enabled for your organization are omitted, so a page might contain fewer than `limit` rows while `has_more` is `true`. Requires the `read:members` scope.
22142214
2215Two `action` values need special care: an `organization` permission whose action is `capability_access_all` (every product feature) or `capability_access_all_ga` (every stable product feature, that is, every feature not labeled beta or research preview) is a blanket grant (one that covers neither model access nor the `permission_`-prefixed admin-panel permissions) and is listed as that single row rather than expanded. When you tally what a role grants, treat a blanket row as covering everything its variant describes, not just the features named in other rows.
2215Two `action` values need special care: an `organization` permission whose action is `capability_access_all` (every product feature) or `capability_access_all_ga` (every stable product feature, that is, every feature not labeled beta or research preview) is a blanket grant (one that covers neither model access nor the `permission_`-prefixed admin-panel permissions, nor `inference_hooks_inspection`, which a role holds only through a row that names it) and is listed as that single row rather than expanded. When you tally what a role grants, treat a blanket row as covering everything its variant describes, not just the features named in other rows.
22162216
22172217For complete parameter details and response schemas, see [List role permissions](https://platform.claude.com/docs/en/api/beta/organization/rbac_roles/permissions/list) in the API reference.
22182218