My coding agent may forget contents of CLAUDE.md, but it can't skip a hook.
There is one global CLAUDE.md that every project follows, plus one per project. Works most of the time. Not always. After a long session the agent drifts and does exactly what the file says you are not to do.
So I put anything that must never happen into a hook. There are 62 of them at the moment that run before the command and just stop it.
They include things such as DROP, rm -rf, editing files directly on a production server or clicking into a password field on the browser. The permission list contains 71 allows and 25 denies on top of that.
I record what happened and why when things go wrong. There are 97 of those notes at present. Some have become hooks through this process.
What rules do you actually enforce, and what rules do you just mention in instructions?
Replies
I went the other way, at least so far. My guardrails are almost all text: one global CLAUDE.md, one per project, and a folder of topic notes the agent has to read before touching that area. No blocking hooks at all yet. What makes me sleep fine is that the rules that really can't break don't live on the agent's side. The app never writes its own credits, the database rules simply reject it, whatever the agent or the client tries. Same with App Check on every callable. So my split is: if breaking it costs money or data, the system refuses it on its own; if it's about style or workflow, it goes in the notes and I accept some drift. Your 97 incident notes turning into hooks is a nice pipeline though. Which hook fires the most?
@gbasovv Counted it from my logs for the last 30 days. By far the most is the one that makes it answer me in Japanese, around 540 times. After a long stretch of English work it slips into English with me. Second is the one that blocks publishing anything I haven't approved, about 160.
@hisashispace 540 in a month is a lot for a rule that sounds so simple, that's exactly the kind of thing that drifts after a long English stretch. I have the mirror case: I write to the agent in Russian, but the product is English first, so it has to answer me in Russian and still keep every string, commit and store text in English. It mostly holds, and when it slips it's always the commit messages. The publishing block makes total sense too, that's the one I'd want as a hook before anything else.