How Claude Code hooks can enforce strict directory boundaries for unattended agents

Claude Code offers two mechanisms to restrict where an AI agent can write files, but they serve different purposes and are not interchangeable. The permissions.deny setting works as a block-list, but cannot replicate an allow-list because its precedence rules cause a blanket deny to override any exceptions. For finer control — such as limiting an agent to a specific subdirectory within a project — developers need to implement a PreToolUse hook, a command that intercepts file-writing tool calls before they execute. The hook receives the pending operation as JSON on stdin and can respond with an allow, deny, ask, or defer decision, along with a reason passed back to the model. This approach provides binding, code-enforced scope control that remains active even when no human is monitoring the agent.