A rule in a prompt is only a habit

Working with an agent means interacting with text and voice most of the time. In a way, it feels almost natural to do the same when setting up your security defenses. You give Claude Code access to your machine, API keys, connected online services. And the defenses you can set up around it? A line in CLAUDE.md, a mod that limits the blast radius and hooks.

Look at these 3 options again. One of the three is just pose.

If you are lost:

• Claude Mods are in-process JavaScript or TypeScript function plugins that customize how Claude Code looks, renders, and behaves
• Hooks in Claude let you run shell commands before or after Claude Code actions
• Blast radius is the maximum potential impact or extent of damage caused by a single security breach, operational failure, or system deployment

Most of the time is the problem

An instruction in CLAUDE.md or in an agent file is followed most of the time. That is real value, and it is also the whole problem. Most of the time across one session is fine. Across a routine that runs every night for a year, the rare miss becomes a date on the calendar. Long sessions make it worse: the instruction from the start of the conversation gets diluted as the context fills up.

There is at least one widely reported case of a coding agent deleting a production database while under an explicit instruction to leave it alone. The instruction was there. Nothing enforced it.

Security's bane is "most of the time".

What a control looks like

A control stops the action even when the agent forgets the rule. In Claude Code there are three you can ask for without writing any code yourself:

• A permission deny: a line in the settings file that blocks a tool or a command outright, like any push to GitHub or any delete outside the workspace.
• A hook: a small script that runs before a tool is used and can refuse it, like a check that no outgoing message contains a key.
• A script that refuses: the step that sends or publishes checks a condition first and stops when it is not met.

Your agent can write all three for you. The skill is in asking for them, and in asking which of your rules still rest on memory alone.

Start with the one that would hurt most

You will not turn every rule into a control, and you do not need to. Pick the one whose failure would hurt most, usually a send, a publish or a delete, and make that one a lock. Then the next one.

Show me every security rule in my CLAUDE.md, agent files and skills.

For each one, say what enforces it other than you remembering: a hook, a permission deny, a script that refuses. Mark every rule that rests on memory alone.

Then pick the one whose failure would hurt most and propose the smallest hook or deny rule that would enforce it.

Do not change anything yet.