Anthropic's new safeguards put AI misuse review in the customer's queue

Anthropic has announced Enterprise Frontier Safeguards (EFS), a forthcoming option that keeps AI monitoring data in cloud infrastructure controlled by the customer while Anthropic's automated systems look for patterns of misuse. When the system finds a pattern that needs attention, the signal goes to the customer rather than to an Anthropic human reviewer.

That design can remove a provider-custody objection for sensitive work, but it gives the customer a new operational job. A security team must be able to receive the signal, restrict who can examine the underlying activity, investigate across systems, act when necessary, and preserve a defensible result. This article explains what Anthropic has announced and what to test before treating EFS as a usable control.

What did Anthropic announce?

Anthropic announced EFS on September 1. The company says the option will roll out in phases starting later this fall, with broad availability as the goal for later in the fall. It is therefore a planned rollout, not a generally available control that every customer can enable today.

Anthropic says it developed EFS with more than 100 customers and its cloud partners at AWS, Google Cloud, and Microsoft Azure. The named support plan covers Claude Code, Claude Enterprise, the Claude Platform, Amazon Bedrock, Claude Platform on AWS, Google's Agent Platform, and Microsoft Foundry. Customers should still confirm the date, region, product surface, and account eligibility that apply to their deployment.

The stated mechanism has three parts. Monitoring data remains in the customer's cloud environment; customer-managed encryption keys can keep key control with the customer; and automated systems look for misuse patterns. Anthropic says customer-owned storage, customer-managed keys, and fully automated review are each opt-in.

This is not the same as keeping no monitoring history anywhere. Anthropic's premise is that sophisticated misuse may be distributed across tasks, sessions, and accounts, so analyzing one interaction and immediately discarding it can miss the pattern. EFS is meant to preserve enough history for correlation while moving storage custody and the review decision to the customer.

Why does the review queue matter more than the storage location?

Customer-controlled storage answers an important question: who holds the monitoring data? It does not answer who notices a signal at 2 a.m., which identities may open related records, or who can suspend an account while an investigation is incomplete.

Anthropic says EFS uses automated safety monitoring with no Anthropic human review required. It also says signals are sent directly to customers, who control how the detected activity gets reviewed. Those statements make the customer's security operation part of the control path rather than an observer outside it.

A signal without an owner can sit unread. A signal delivered to a broad support queue can expose sensitive code, legal material, health information, or customer records to people who were never approved to see them. A signal that cannot be joined to identity, application, and cloud evidence may identify suspicious behavior without giving investigators enough context to reach a decision.

The buying question is therefore not only whether EFS keeps data in the preferred account. It is whether the organization can operate the handoff after automated detection.

What should be connected before EFS handles sensitive work?

Start with the destination. Identify the service or queue that will receive EFS signals, the on-call group responsible for it, and the severity rules that determine when a person must respond. Confirm the signal can reach that destination without being copied into a less restricted collaboration or ticketing system.

Then define investigation access. The announcement says customers control review, but it does not publish a universal alert schema or state exactly which content every reviewer will need. Grant access according to the material the AI workflow may process, not according to the convenience of an existing security group. Privileged legal work, source code, health data, and payment information can require different cleared reviewers even when the automated detector is the same.

Next, connect the signal to customer evidence. An investigator may need the workload identity, user, application, model surface, cloud account, time window, tool activity, and the customer's own policy decision. Preserve correlation identifiers and relevant security events without making an uncontrolled duplicate of every prompt and response.

Finally, name the available response. Depending on the event, that may be revoking a credential, stopping an agent run, isolating an integration, restricting a user, or escalating to a specialist team. EFS can supply a signal as Anthropic describes it; the public announcement does not claim that it performs every customer-side containment or recovery action.

How should a team test the handoff?

Ask Anthropic or the applicable cloud provider for a supported test method rather than attempting real misuse against a production model. The test should produce a non-sensitive signal that follows the same delivery and access path planned for production.

Measure the complete path, not only alert arrival. Record when the test activity occurs, when the signal reaches the customer, when the assigned responder acknowledges it, which evidence is available, what response is permitted, and how closure is recorded. If a required field or event is not available in the public product description, mark it unresolved rather than filling it with an assumption.

Run the test with the responder's real permissions. Confirm an authorized investigator can reach the necessary customer-held records and that an ordinary application administrator cannot. Also test an absent primary responder, an expired credential, and a destination outage so the escalation path does not depend on one person or one integration.

Recheck the boundary after adding a Claude surface or cloud environment. Anthropic says equivalent controls are planned across direct and cloud-partner access, but equivalent product controls do not prove that each customer account has identical routing, identity, storage, and review configuration.

What will EFS cost and what remains unknown?

Anthropic says it will not charge for EFS and that the option does not change model behavior, API pricing, or rate limits. A customer that stores monitoring data in its own cloud account will still pay its cloud provider for storage, reads, writes, and data egress. “No EFS charge” should not be translated into “no operating cost.”

The public announcement does not provide alert-volume estimates, false-positive rates, service-level targets, a supported-region matrix, a standard retention period inside every customer account, or staffing guidance. It also does not establish that EFS makes a deployment compliant with any particular rule. Those are procurement and implementation questions to close against the final documentation and the organization's own obligations.

Anthropic explains that it introduced 30-day retention with Fable 5 because detection across time requires history, while some regulated customers found provider retention difficult. That background should not become an assumed EFS setting. Confirm the effective retention, deletion, legal-hold, backup, and key-revocation behavior in the customer-controlled environment before sensitive data enters it.

Customer custody makes response readiness visible

EFS addresses a real tension: stronger models may need monitoring across interactions, while sensitive organizations may be unable to place those records in a model provider's custody. Anthropic's proposed split keeps monitoring data and review authority with the customer while its automated system operates the detection.

The result is useful only when the customer side is ready. Before adoption, prove that a test signal reaches a named responder, related records stay restricted, the investigator has enough context, an authorized response can occur, and closure leaves evidence. BaristaLabs helps teams connect AI controls to practical operations through data security. If EFS is part of a planned sensitive workflow, review one monitoring path before rollout.

Sources

• Anthropic, “Developing Enterprise Frontier Safeguards with our customers”, published September 1, 2026.
• Anthropic Claude Code documentation, “Security”, accessed September 3, 2026.

Anthropic supplies the product, rollout, architecture, and pricing descriptions cited here. BaristaLabs supplies the incident-response interpretation and test recommendations. The cited sources do not establish availability for a particular account, successful detection, a response service level, legal compliance, or the security of a customer implementation.