inference-hooks-configuration changedmanage-claude/inference-hooks-configuration
Recorded here
Lines+15added
Lines−1removed
From line
107
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits19to this page, all time
### Inspect only selected roles
The whole hunk
from line 107, old and new numbered
/
from line 107
107107
108108## Exclusions
109109
110Under **Exclusions**, select roles whose members are not covered by Inference hooks: their prompts are never sent to your AI security server. Only custom roles your organization created can be excluded; the built-in roles aren’t offered. Select them in the role selector, whose placeholder reads **Select roles to exclude**, and manage who holds each role from the roles admin page (**Manage roles**); changing exclusions requires identity management permission. The list is empty by default, and with no roles excluded, every governed request is inspected.
110Under **Who is inspected**, with **Limit by role** turned on, select roles whose members are not covered by Inference hooks: their prompts are never sent to your AI security server. Only custom roles your organization created can be excluded; the built-in roles aren’t offered. Select them in the role selector, whose placeholder reads **Select roles to exclude**, and manage who holds each role from the roles admin page (**Manage roles**); changing exclusions requires identity management permission. The list is empty by default, and with no roles excluded, every governed request is inspected, unless **Inspect** is set to **Only selected roles**.
111111
112112Exclusion applies to a user’s interactive sessions. Changes to the exclusion list are recorded in your organization’s [Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed) as role permission changes (`rbac_role_permission_added` and `rbac_role_permission_removed`).
113
114### Inspect only selected roles
115
116Everything in the **Who is inspected** section sits behind one switch, **Limit by role**. When you turn the switch on, **Inspect** starts on **Everyone except excluded roles**, and the excluded roles are selected under it as described above.
117
118To try Inference hooks on part of your organization first, turn on **Limit by role**, set **Inspect** to **Only selected roles**, and select the roles in the dialog box that opens. From then on, only members who are set to **Custom roles** and are assigned a selected role are inspected. Members set to any other role, such as **User** or **Owner**, are not inspected, even if they are assigned a selected role. That includes you if you are set to **Owner** or **Primary owner**. Remove every excluded role before you switch: an organization uses exclusions or selected roles, not both. After the switch, add or remove roles in the role selector under **Inspect**. To go back to inspecting everyone, turn **Limit by role** off: after you confirm, this removes every excluded role and turns **Only selected roles** off.
119
120While **Only selected roles** is set:
121
122* A custom role whose **Capability access** is **All capabilities** or **All generally available** counts only if you select it, like any other role.
123* If no member set to **Custom roles** is assigned a selected role, no member is inspected.
124* Requests with no member behind them are not inspected, such as requests made with API keys, and Claude Tag conversations in Slack.
125
126The switch and changes to the inspected roles are recorded in your organization’s [Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed).
113127
114128## Custom blocked prompt message
115129
No line in this hunk matches that.