Chapter 9: Hooks and Guardrails¶

Everything you've built so far has one dependency you haven't addressed: you remembering things. Verify before committing. Run the wrap routine. Keep the agent off the no-touch files. You've been the enforcement mechanism — and humans are wonderful, inconsistent enforcement mechanisms.

This chapter reduces that dependency. Hooks can trigger checks at configured events; validation harnesses give the agent evidence to test itself against; permission policy records some of your boundaries in configuration. Together they make selected checks repeatable, while human review remains necessary for intent and risk.

What you will learn

Explain why guardrails-as-mechanism beat guardrails-as-discipline.
Configure hooks that fire at session events: after edits, before commands, at session end.
Build a validation harness — tests, checks, formatters — that lets the agent self-correct.
Codify permissions: allowlists, deny rules, and the policies from Chapter 8 as settings.

Builder principle

Discipline is what you do when you remember. Mechanism is what happens either way. Ship on mechanism.

Read with this chapter

Claude Code docs — hooks and settings — the current syntax reference; hooks are config, and config docs age fast, so always check the source.

Real talk¶

Ask anyone who ships software for a living where quality actually comes from. It's never "we're careful." It's the boring machinery: the test that blocks the merge, the check that runs every time, the permission nobody can fat-finger past. Careful is a mood. Machinery is a decision — made once, paying forever. This chapter is you making it.

Lessons in this chapter¶

Chapter checkpoint¶

Complete Chapter 9: Guardrail that proves itself, save the evidence, then score your first attempt with the shared rubric.