Hooks as approval gates

Why it matters

An approval that a prompt asks for can be talked around. One that a hook enforces before the tool runs holds every time, for everyone — the kind of control 5.1 places in front of a harmful effect.

What to practise

Read a PreToolUse hook whose matcher catches an MCP release tool and returns permissionDecision as allow for dev, ask for staging and deny for production unless an approved change ticket exists. Notice who sees each reason: the person on an ask, Claude on a deny, so the block names the route to approval. Note that a non-interactive run denies an ask, which is why the gate allows staging from the pipeline on main, where the approved merge is the approval. Then read the managed settings that make the gate unremovable — allowManagedHooksOnly, disableBypassPermissionsMode, and a sandbox with failIfUnavailable.

How it fits

The gate is 5.1.3’s fail-closed approval in working form, and its unknown-tool default is a deny. The managed settings are 5.1.5’s centrally enforced runtime. Compare the hook’s deterministic check with the semantic classifiers 5.1.2 prices.