The control point for coding agents is the deny list, not the diff

A developer who has been running Claude Code as a daily driver for about three months reports that the agent once wanted to force-push to main, and wanted to for a good reason: the rebase was stuck, and force-pushing would have unstuck it ^[1][2]. The interesting part is the absence of recklessness, because every link in that chain of reasoning was sound, which makes it a locally correct decision with a non-local consequence, the exact category of mistake human code review is worst at catching, since the diff looks fine ^[3][4]. The author's first response was to read everything: every diff, every command, hand hovering over Ctrl-C ^[5]. That fails for an arithmetic reason rather than a discipline one, in their account: the cost of reviewing output scales with how much the agent writes, and that number is not going down ^[6]. So they inverted it and wrote down what the agent must never do, and found the list short enough to fit on a napkin ^[7][8]. There are six items ^[9]: a credential read an hour ago inlined into a source file; `git push --force origin main` as the fastest route to a green terminal; `rm -rf "$BUILD_DIR/"` on the one machine where `BUILD_DIR` never got set; a version bump typed straight into `package-lock.json`, because that is the file the version number is visibly in; a failing test quietly growing a `.skip` so CI goes green; and `cat .env` "just to see which variables exist" ^[10]. None of these require the model to be stupid. Each is a reasonable move by something that cannot see two feet past the command it is about to run ^[11]. The enforcement point is `PreToolUse`, a hook that fires before any tool call and hands a script the whole payload on stdin, including session id, working directory, tool name, and the command string itself ^[12]. The script can return a `permissionDecision` of `deny` along with a `permissionDecisionReason` ^[13]. The part worth stealing is what the author says they found about that reason string: the agent reads it and acts on it ^[14]. Per their account, saying "blocked" gets you retries with slightly different syntax, while saying "change the manifest and run `pnpm add`" gets compliance on the first try ^[15]. So every guard they wrote answers two questions rather than one: what is wrong, and what to do instead ^[16]. The guards are published as `claude-guardrails`, described as zero dependencies, nothing to configure, Node reading a JSON payload and occasionally saying no ^[17]. The sharpest inversion is about direction of travel. The author started by guarding the write path, then noticed that the write path already has a code review in front of it and the read path has nothing ^[18]. When an agent runs `cat .env` to check which variables exist, it gets a reasonable answer to a reasonable question, `git diff` stays empty, and every value in that file is now sitting in a transcript, and transcripts get stored, synced, and occasionally pasted into a bug report by someone being helpful ^[19]. That guard blocks the read and suggests `grep -o "^[A-Z_]*=" .env` instead: same question, answered ^[20]. The limits show up in the author's own writeup. They wanted a guard that stops an agent editing a migration the database has already run, and hit the fact that a hook has no idea what state your production database is in ^[21]. That is the boundary of this whole approach: it works where the danger is legible in the command string, and degrades where the danger lives in state the hook cannot inspect. Worth watching whether the deny reason stays a teaching channel or becomes an injection surface, since it is untrusted-adjacent text the model demonstrably acts on ^[14][15].