Prose is advice, hooks are enforcement

Why

An agent under pressure does what gets the task finished. Told in prose not to force push, it will not, most of the time. Most of the time is not a policy. Anthropic’s own guidance for Claude Code is that the instruction file is advisory and hooks are deterministic ^[13], and its engineers run agents on remote machines whose outbound network access is limited to an allow list ^[12].

The same applies to “verify before saying done”. An agent will assert success. A hook that runs the test command and refuses to let the session end while it fails does not need to be trusted.

How

The settings file is committed and shared. It has three permission lists. Allow is what runs without asking: build, test, lint, read-only git. Ask is what a human confirms each time: commit, push, open a pull request, apply a migration. Deny is what never runs: reading .env and key files, force pushes, rm -rf, every deploy command. Settings stack in a fixed order, and a deny anywhere in the stack wins, so a developer can add convenience locally but cannot remove protection. The sandbox setting limits network access to the package registries and the git host.

Three hooks ship in the kit. Each is a small shell script that receives what is about to happen as JSON, and its exit code decides what happens next.

• block-destructive.sh runs before every shell command and catches the variants the deny list misses: chained commands, sudo, flags in a different order. Exit code 2 blocks the command and the script’s message becomes the agent’s explanation.
• lint-on-edit.sh runs after every file edit, formats the file, and never blocks. A problem it finds is printed, and the agent fixes it in its next step.
• stop-gate.sh runs when the agent is about to say it has finished. If the project check fails, the agent keeps working with the failure as its next instruction.

CHECK="${PLAYBOOK_CHECK:-dotnet test --no-restore}"   # the project's real, fast check

out="$(bash -c "$CHECK" 2>&1)"
if [ $? -ne 0 ]; then
  {
    echo "Stop gate: the project check failed. Fix it before finishing."
    echo "$out" | tail -60
  } >&2
  exit 2
fi

Install is two lines: make the scripts executable, and set the check command to the project’s real one. Keep it under a few minutes to run. The full suite belongs in CI.

Identity without privileges.

The settings bound what the agent may run. They do not, by themselves, bound who the agent is. When it runs as the developer, with the developer’s git credentials, cloud logins and files, everything it can reach is everything the developer can reach. The stronger version, which JPMorgan adopted for its engineers in 2026 and Anthropic uses for its own, gives the agent its own scoped identity, keeps it away from secrets and internal systems, and caps what it can spend ^{[20, 12]}. Appendix D is the checklist for that.

What this does not do. A developer can edit any of these files locally, or skip the tool altogether. The hooks protect against the agent, not against the developer. What protects against the developer is the pull request, which is rules 8, 9 and 10. A team that wants the rule files themselves locked down follows appendix C.