PRODUCTION SCENARIO
An internal IT support agent can call a reset_mfa tool. Policy requires a verified manager ticket before any contractor account is reset, while routine employee resets have to keep working with no ticket at all. The account type and the ticket id both arrive as arguments on the tool call. In a red-team exercise, a tester talked the agent into resetting a contractor's MFA by describing an outage.
What most reliably enforces the ticket requirement?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: A PreToolUse hook that reads the account type and ticket, denying a call failing either
A PreToolUse hook runs after the tool parameters exist and before the call is processed, so it can read the account type and the ticket id out of the arguments and refuse this particular call; a rule about arguments needs code that sees the arguments. A blanket deny rule is equally deterministic and is the right answer when the tool should not be reachable from this agent, and it also stops the routine employee resets the stem keeps in scope. A policy block in the prompt is context the model weighs, which is what the red-team exercise already talked its way past. A judge on transcripts is the right design when the goal is detection and audit, and it names the violation after the MFA has been reset.
Official Source: https://code.claude.com/docs/en/hooks ↗