2 min lesson
Hooks: the deterministic guardrail layer
Use "Hooks are the one truly deterministic control" to say what you would do next.
Step 1 of 3
Gates, SoDSeparation of Duties. Short for separation of duties: the rule that authoring, approving and deploying a change never sit with one person. Auditors use the acronym; the control is the same. Press Enter for the full definition. and evidence are process controls. Hooks are the one truly deterministic control - actual code, not a model's good intentions - and they're what a regulated CI/release story is missing without them.
A hook is a script that executes in the shell at a fixed point in the agent's lifecycle, in the IDE and the CLI. Because it's real code that either passes or halts, it doesn't depend on the model behaving. The core release path covers prompt submit, file read or write, MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. and terminal calls, deletion and stop. Put PIIPersonally Identifiable Information. Data that can identify a person (names, emails, SSNs); regulated and sensitive. Press Enter for the full definition. and secret scans before the prompt, path and command policy before tools act, deletion protection before removal and a final audit at stop.
Learn more
Advanced table
A cloud agent can't act if it's in violation of a hook
- Trigger point
- Prompt submit
- When it fires
- Before a prompt reaches the model
- What you'd enforce there
- Scan for PIIPersonally Identifiable Information. Data that can identify a person (names, emails, SSNs); regulated and sensitive. Press Enter for the full definition. / API keys / secrets; halt and return a custom error if found
- Trigger point
- Agent reads / writes a file
- When it fires
- Before the agent touches a file
- What you'd enforce there
- Block reads of sensitive paths; refuse writes that introduce a private key
- Trigger point
- MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. tool call / before MCP access
- When it fires
- Before an external tool runs
- What you'd enforce there
- Gate which integrations an agent may invoke
- Trigger point
- Terminal tool call
- When it fires
- Before a shell command runs
- What you'd enforce there
- Block destructive or non-allowlisted commands
- Trigger point
- File deletion
- When it fires
- Before a delete
- What you'd enforce there
- Prevent removal of protected files
- Trigger point
- Stop hook
- When it fires
- When an agent run finishes
- What you'd enforce there
- Final scan / audit log before the work is handed off
| Trigger point | When it fires | What you'd enforce there |
|---|---|---|
| Prompt submit | Before a prompt reaches the model | Scan for PIIPersonally Identifiable Information. Data that can identify a person (names, emails, SSNs); regulated and sensitive. Press Enter for the full definition. / API keys / secrets; halt and return a custom error if found |
| Agent reads / writes a file | Before the agent touches a file | Block reads of sensitive paths; refuse writes that introduce a private key |
| MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. tool call / before MCP access | Before an external tool runs | Gate which integrations an agent may invoke |
| Terminal tool call | Before a shell command runs | Block destructive or non-allowlisted commands |
| File deletion | Before a delete | Prevent removal of protected files |
| Stop hook | When an agent run finishes | Final scan / audit log before the work is handed off |
Hooks are build-once, share-across-team and they also run in cloud agents - a cloud agent can't act if it's in violation of a hook.
Learn more
Optional practice
Practice: Hooks: the deterministic guardrail layer
QA controls owner asks how you prevent a secret from ever reaching the model. What's the deterministic answer and why is it stronger than 'the model is trained not to'?
QMultiple choice: Which best describes how hooks relate to a pipeline's red gates?