building-hooks

Policy enforcement with hooks involves creating event-driven rules that validate tool invocations before they execute. Use PreToolUse hooks to run validation scripts, return a decision object (allow/block), and enforce standardized behaviors across projects without manual intervention.

Claude Code supports PreToolUse, PostToolUse, UserPromptSubmit, Stop, and SessionStart events. Each event fires at specific points in the workflow, letting you intercept and control tool invocations, prompts, and session lifecycle for logging, validation, and orchestration.

Yes. Command hooks run bash scripts for fast validation and system integration, while prompt hooks invoke the LLM for semantic decision-making. Both return control-flow values (continue, decision, reason, systemMessage) and can be combined within the same hook configuration.

Hooks enforce a JSON schema that validates matchers and hook structures. Deploy hooks at project-level or directory-level scopes to apply standardized configurations automatically. The schema validation catches misconfigurations before runtime.

Hooks have access to tool invocations and prompts, so validate input rigorously, avoid exposing sensitive data in logs, and use matchers to scope hooks narrowly. The metadata includes security guidance for safe hook design and preventing policy bypass.

Basic bash and JSON knowledge helps but aren't strictly required. The Skill provides templates and reference patterns for command and prompt hooks. Quick-start examples show how to validate a PreToolUse event with a simple script and decision object.