EntPEP
Four steps, on every request.
The same loop runs whether the request comes from an agent on a laptop or a chat session in the browser. Nothing about the AI is trusted by default — each action is decided as it happens.
Intercept
Catch the action before it runs — a tool call via a PreToolUse hook, or a request through the browser proxy.
Evaluate
Check it against centrally managed policy: what this user, on this endpoint, in this company is allowed to do.
Enforce
Allow, block, or hold for approval — right on the desktop or at the server, before anything happens.
Log
Record the session — who, which agent, which model, what was allowed and what was stopped — as an auditable trail.
One control plane, three roles.
EntPEP is multi-tenant: each company manages its own people, endpoints, and policy. Authority flows down the chain — each role invites the next.
One grant. Three surfaces. Per user.
A short walk-through: the same policy governs Claude Code, Claude.ai in the browser, and the Claude desktop app. Block before a tool runs, grant access to a person, and every one of their surfaces opens — then closes again on revoke.
Turn on the record.
Sign in to the console to enroll an endpoint, set policy, and watch sessions land in real time.