Developer Moves AI Agent Safety Controls Into Pre-Execution Hooks After Prompt Gaps Found

A developer running a fleet of autonomous AI agents discovered that permission prompts provided no protection during unattended, headless jobs since those sessions were designed to skip prompts entirely. To close the gap, they implemented a shell-script hook that intercepts every tool call before execution, regardless of session type or permission mode. The hook enforces two classes of rules: hard blocks requiring human action for sensitive operations like credential access or package releases, and redirects that refuse a dangerous move while suggesting a safe alternative so the agent can continue without interruption. A previous rule system failed because it was tied to a specific working directory, meaning sessions rooted elsewhere faced no restrictions at all while health checks falsely reported compliance. The developer also established a throughput-first principle, ensuring new rules only qualify if they fire rarely or prevent cross-session damage, so frequent low-risk operations like branch creation or deleting build output are never blocked.