other
Claude Code lifecycle hook that runs before a tool executes and can return a permissionDecision of deny to block the call.
No evidence-backed relationships are recorded.
A 29-session test on Claude Code v2.1.273 ran the same protected-directory rule two ways, as prose in CLAUDE.md and as a PreToolUse hook. Both held on a plain task. The comparison that separates them rests on four runs.
Reality
Anthropic's memory documentation sets a 200-line target per instruction file and reserves real blocking for a hook. Everything written in markdown arrives as context the model weighs against your last message.
Reality
A stuck rebase made force-pushing to main the locally correct move. Reviewing agent output scales with what the agent writes; a short list of things it must never do does not.
Reality
A PreToolUse hook on an AI coding agent returned "allow" for every file under a non-ASCII directory name, for weeks, with no log line and no exception.
Reality
A developer leaked live keys into agent transcripts three times before replacing a polite memory note with a hook that denies the read outright.
Reality