Anthropic's Enterprise Frontier Safeguards proposal separates three jobs that agent systems often blur together: who holds activity data, who detects risk, and who decides what a flag means.

The Proposed Custody Split

Anthropic announced Enterprise Frontier Safeguards on September 1, 2026. It says activity data used for monitoring can remain in a customer's AWS, Azure, or Google Cloud account under customer-managed encryption keys, access policies, and audit logging.

Anthropic's automated systems analyze a rolling window of traffic for serious misuse signals, including offensive cyber or biological work and possible credential theft. The resulting flags go to the customer; Anthropic says no Anthropic employee needs to review the content.

Zero Retention And Monitoring Are Different Claims

Anthropic presents EFS as providing the privacy effect of zero data retention by the model provider while still allowing correlation across sessions and accounts. That does not mean the activity data disappears. It means custody and access move into infrastructure the customer controls.

Customer-owned storage, customer-managed encryption keys, and automated review are separate opt-in controls. The customer's own retention schedule, access governance, and incident process therefore remain part of the design.

What Is Available And What Is Not

EFS is scheduled to roll out in phases beginning later this fall, with a goal of broader availability later in the season. Anthropic says eligible customers can use zero data retention on covered models while they wait.

The announcement provides architecture, scope, and customer design feedback. It does not publish detection benchmarks, false-positive rates, independent testing, or procedures for a provider-side detection outage. Those remain open questions rather than implied product guarantees.

A Practical Custody Checklist

  • Name the legal and operational owner of agent activity logs.
  • Separate storage location, encryption control, detection access, and human review.
  • Define how long cross-session correlation data is retained and why.
  • Route flags to an accountable team with documented response times.
  • Test false positives, missed detections, provider outages, and revoked access.
  • Verify the actual cloud path before calling a deployment zero-retention.

Related: See our field notes on the OpenAI-Hugging Face evaluation incident and short-lived agent authority.