What Is Agentic AI Hook? Intent.md Describes, the Hook Enforces

Definition: An agentic AI hook is deterministic code that runs at a fixed point in an AI agent’s loop and returns one of three answers: allow the action, block it, or stop and ask a named human. It is the one control in the agentic SDLC that decides an outcome instead of influencing one. Everything else the agent reads, from the system prompt to the rules file to a skill written in careful English, makes the agent likely to comply. A hook makes it mandatory, or it does not exist.

That is the governance question this post is really about. An intent.md tells the agent what outcome I want and where the boundary sits. The hook is what holds that boundary when the model, for whatever reason, tries to cross it. Intent describes. The hook enforces. A team that has one without the other has written a policy and called it a control.

What a hook does, mechanically

The details matter, because the enforcement lives in them. In Claude Code, hooks are commands or endpoints that fire on lifecycle events: a session starting, a prompt being submitted, a subagent finishing, and the one that matters most for control, a tool call about to run. That event is PreToolUse. It fires before the tool executes and it can stop the tool from executing at all.

The contract is small. The hook receives the pending call as JSON on standard input and returns allow, deny, or ask. Exit code 2 is a hard block that no allow decision can override. Anthropic’s documentation is careful about the default, and one line deserves quoting: “The hook can deny the call, but staying silent doesn’t approve it.” That is the whole difference between a control and a suggestion, written into an exit code.

Hooks live at user, project, local and managed levels, and the managed level is where a developer preference becomes an organizational one. An administrator can set allowManagedHooksOnly so that nothing from a laptop or a repository can add or replace a gate, and can deny bypass mode outright. Once that flag is on, the engineer the hook constrains cannot switch it off. Hold that thought. It is the test.

The shape is not one vendor’s idea. Kiro’s agent hooks use the same PreToolUse event, the same exit code 2 and the same JSON contract, and Cursor shipped an allow/ask/deny hook system in late 2025. The industry converged on this fast and without much argument, which usually means the design was obvious once somebody drew it.

Where the hook sits in the agentic SDLC

The traditional SDLC put its rigor in people. A reviewer read the pull request, a release manager signed the deploy, a retro produced action items on a wiki. The agentic SDLC cannot work that way, because the thing producing the code cannot be talked to in a standup. The rigor has to move into artifacts that carry their own enforcement, and I count exactly two that do the heavy lifting: the intent.md at the front of the loop and the hook at the back of it.

I wrote up the ten assumptions the agentic SDLC breaks, and the hook shows up in half of them. Uniform human code review becomes tiered review, with a hook deciding which changes a human sees. “Done means merged and green” becomes “done means the evidence bundle exists,” and the hook is what writes the bundle. Retro findings stop living on a wiki and land as a hook, a rule file, or a new eval case. The ceremonies survive. The artifacts change. I made that argument at length in Agile in Agentic SDLC, and the hook is the artifact I would build first.

Anthropic’s own AI-native SDLC playbook draws the same line. A skill is a control, but an advisory one, and “a policy that must always hold needs something deterministic behind the skill.” I read that sentence as the design brief for the whole enforcement layer, and I mapped it stage by stage in my take on the playbook.

Advisory or enforcing

Every control in the agent stack sorts into one of two piles, and one question does the sorting: can the person it constrains turn it off? Prompts, rules files, skills, slash commands and the intent.md itself all fail that question. So does any permission mode set inside the project, which is why Claude Code stopped honoring auto mode from project settings. A repository should not be able to grant itself privileges. Hooks in managed settings pass. So do sandboxes, because the operating system enforces them, and branch protection, because the server does.

A hook is the enforcing half of a pair. The advisory half, the skill, is covered in What Is Agentic AI SKILL.md and Why It Is Advisory and Cannot Be Enforced.

Advisory controls fail for an architectural reason, not a behavioural one. An instruction and a piece of data arrive in the same channel and the model cannot reliably tell them apart, which is why prompt injection sits at the top of the OWASP list of LLM risks and has stayed there. Simon Willison’s lethal trifecta, from June 2025, is the cleanest statement of the exposure: give an agent private data, untrusted content and a way to talk to the outside world, and the combination does the attacking for you. No amount of well-written intent in a Markdown file closes that. A deny rule in code does.

Block, ask, or tier

Here is the claim I most want to defend. The same mechanism does three different jobs, and which job it is doing tells you where a team really sits on my five-stage roadmap.

At first a hook blocks. It refuses edits to protected paths, runs the linter after every change, keeps credentials out of the diff. Fast, scoped, no human near it. That is a guardrail, and it belongs in the build phase.

Later the same hook asks. A production deploy stops until a named release manager authorizes it, the condition holds for everyone every time, and the verdict is written down with a timestamp. That is a gate. Anthropic’s playbook puts the gate at deploy rather than mid-build, because an approval prompt in the middle of the build puts a person back on the critical path of every parallel session. That one sentence is the most practical thing in the document.

Finally the hook becomes a tier boundary. In a loop that fires itself, the hook decides whether a given breach gets logged, diagnosed read-only, or acted on, and the highest tier still terminates at the gate built earlier.

So the diagnostic is one question: block, ask, or tier? A team with no deny rules and no managed settings is at Prompted, whatever the roadmap slide says. Blocking automatically is Governed. Gating with a named approver and a timestamped log is Assured. Using hooks to define blast radius is an Autonomous loop.

The bottom line

An intent.md makes a violation unlikely. A hook makes it close to impossible. In my work in regulated loan origination that gap is the whole conversation, because a control the operator can disable is not a control, it is a preference with good intentions. Instructions in, results out was IT. Intent in, outcomes out is agentic AI, and the hook is where the intent stops being a suggestion. My frameworks are laid out in full in my two books, Intent In, Outcomes Out and Earned Autonomy.

So look at your own configuration this week. Of the policies your intent.md says must always hold, how many are enforced by code the engineer cannot switch off, and how many are sentences you hope the model reads carefully?

My books go deeper on both: Intent In, Outcomes Out (mybook.to/AgenticAI) and Earned Autonomy (mybook.to/Autonomy).

Go deeper

Agentic AI Architect: control design for enterprise agents.
Agentic AI Case Studies: deployment evidence, one teardown at a time.
Agentic AI P&L: cost, payback, and risk in a CFO’s voice.
Agentic AI Governance: who owns the harness.
Substack first access: agenticaiarch.substack.com/subscribe

Dr. Harish Kotadia, Ph.D., is an Enterprise AI Architect with 20+ years of IT consulting experience serving Fortune 100 clients, specializing in agentic AI systems built on Anthropic Claude, AWS Bedrock, and Google Vertex AI.

Disclaimer: This blog post is based on publicly available academic publications, vendor documentation, open standards, and news items from reputed media sources linked above. This post is intended for educational purposes, to help the enterprise agentic AI community build a shared vocabulary from public, authoritative sources.

Views and opinions expressed here are my own and do not represent those of any employer or client, past or present. The analysis presented is my independent interpretation of the published sources linked above and does not constitute legal, financial, or consulting advice of any kind.

What is Agentic AI Hook? Control an Agent Cannot Talk Its Way Past