Recommended Free Tools
Deny rules are not a security boundary. In Claude Code and Codex, they are checks inside the agent’s own execution path. They can block specific calls, but they do not remove the agent process’s access to files, networks, or credentials. A policy hook adds a useful decision point before a tool call runs, and it is worth building. For sensitive work, though, the enforcement that matters has to sit outside the agent, in an environment the agent cannot reconfigure.
Application-level control versus an operating-system boundary
The difference between these two kinds of control determines what a policy can promise.
![Claude AI for Beginners Bible: [5 in 1] The Ultimate Guide to Automate Your Work, Save Hours Every Week, and Use AI for Real-World Results](https://m.media-amazon.com/images/I/415+fSJacsL._SL160_.jpg)
As an Amazon Associate I earn from qualifying purchases.
An application-level control runs inside the agent product. A permission rule, a PreToolUse hook, or a Codex lifecycle hook sees a tool call or event, evaluates it, and returns a decision. The control is only as complete as the product’s ability to show it every relevant action in the form it expects. If a command is written in a form the matcher does not recognize, or a subprocess touches a file outside the rule’s reach, the application-level check may never see the risky part.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →An operating-system-enforced boundary restricts what a process can do regardless of what the agent asks for. Filesystem mounts, user accounts, network egress rules, and separate credentials apply to every process in the environment, including child processes the agent spawns. The kernel or the container runtime enforces them, not the agent’s configuration file.
#1 Best Overall
Use both, but do not confuse them. An in-agent check is good at consistency, audit trails, and stopping ordinary mistakes early. It is weak at guaranteeing containment against a determined or confused process that takes an unanticipated route.
What Claude Code deny rules cover, and where they stop
Claude Code’s permission documentation separates two kinds of deny configuration, and the difference matters for how much you can rely on them.
A bare tool deny versus a scoped rule
A bare tool deny removes the tool from Claude’s available context, so the model is not offered that capability at all. A scoped rule such as Bash(rm *) leaves the tool available and blocks calls that match the pattern. Scoped rules are useful for narrowing common actions, for example preventing routine destructive deletes, but they are pattern matches against a command string or path, not a complete description of what a shell can do.
Known coverage gaps
The current permissions page says that some command forms and some arbitrary subprocess file access are not covered by Read and Edit rules, and it points to the sandbox for OS-level restrictions across processes. Read that page for the concrete examples it gives of recognized commands and paths that fall outside particular checks, and write your policy with those examples in mind. Do not describe a string or path rule as comprehensive mediation. Claude Code permissions
How a PreToolUse hook blocks a tool call in Claude Code
A PreToolUse hook runs before a tool executes and can return a blocking decision. Before you write one, understand how it sits alongside the permission system, because the precedence rules determine what a hook can and cannot change.
- A hook that exits successfully without a decision leaves the normal permission flow in place.
- A hook returning allow does not override a deny or ask permission rule. Permission rules still apply.
- A handler starts only when both the event matcher and any narrower
ifcondition match the call. - A command hook runs as your user. It can read whatever files that account can read, so the hook is itself a privileged piece of code.
Those four points define the design. A hook can add a stricter check, but it cannot grant an exception to a deny rule. Its scope is the calls it is wired to see.
Step 1: Decide which calls the hook should see
Start with the tools and command forms that matter for your environment, such as Bash for shell commands and Edit or Write for file changes. Keep the matcher narrow enough that the handler runs only where you want it to, and wide enough that the hook does not silently skip the calls you care about.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Step 2: Place the configuration in a trusted, reviewed source
Hooks can come from user settings, project settings, managed policy, plugins, skills, or agents. Put the policy in a source you control and review. The configuration shape looks like this; copy the exact field names and the blocking output format from the hooks reference before you deploy it.
{
"permissions": {
"deny": ["Bash(rm *)"]
},
"hooks": {
"PreToolUse": [
{
"matcher": "Bash",
"hooks": [
{ "type": "command", "command": "~/.claude/hooks/policy-check.sh" }
]
}
]
}
}The deny entry and the hook are independent layers. The rule still applies even if the script allows the call. Keep the script in a path that your normal account cannot modify casually, and version it like code. Claude Code hooks
Step 3: Make the script’s decision explicit and auditable
The script should parse the tool input it receives, apply a small set of rules you can explain, and emit only the decision format the hooks reference specifies. Log every block and every allow with enough context to reconstruct the call. Treat the script’s own failures as part of the design, which the failure section below covers.
Claude Code and Codex hooks compared
The two products share a general idea, a hook that runs at a lifecycle point, but they do not share a schema or enforcement semantics. Do not port a Claude Code hook definition to Codex or assume one product’s failure behavior applies to the other.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11| Aspect | Claude Code | Codex |
|---|---|---|
| Events named in official docs | PreToolUse runs before tool execution and can deny a call |
PreToolUse, PermissionRequest, PostToolUse, prompt submission, compaction, subagent, stop, and session lifecycle events |
| Hook sources | User settings, project settings, managed policy, plugins, skills, and agents | User or repository config layers; matching sources load together rather than higher-precedence layers replacing lower ones |
| Trust gate | Interactive sessions hold hooks until the workspace is trusted; -p and SDK sessions treat the folder as trusted and can run hooks committed in a project settings file without the interactive trust dialog |
Non-managed hooks must be reviewed and trusted against their current definition; untrusted or changed hooks are skipped pending review |
| Managed hooks | Managed policy is a supported source (see the hooks reference for administrator controls) | Managed hooks from administrator-controlled sources are marked as managed and cannot be disabled in the user hook browser; the organization must deploy and maintain the scripts |
| Multiple matching command hooks for one event | Not stated in the Claude Code hooks reference | Launched concurrently, so one hook cannot prevent another from starting |
| Blocking decision | A PreToolUse hook can deny a call; a successful exit with no decision continues normal permission flow |
For supported remote hooks, an explicit supported denial can block the action |
| Identity | Command hooks execute with the user’s full permissions | Not stated in the Codex hooks reference for this article’s scope |
Sources: Claude Code hooks, Claude Code permissions, Codex hooks.
The Claude Code hooks reference states the identity point directly: “Command hooks execute shell commands with your full user permissions.”
Building a Codex policy hook
Codex’s hook model is built around review and trust. The main practical consequences are that a hook you write is not active until it has been reviewed, and that matching hooks run in parallel.
- Write the hook for the lifecycle event you need, most often
PreToolUse, and keep its logic small enough to review. - Place it in the user or repository config layer that matches your deployment. Remember that matching sources load together.
- Open the hook review interface in Codex and review the hook against its current definition. Until you trust it, the hook is skipped.
- Test the behavior in a disposable repository. Confirm that the expected tool call is blocked and that a benign call still runs.
- Re-review after any change to the command or its arguments. A changed definition is treated as untrusted again.
Because matching command hooks run concurrently, do not design two hooks that depend on each other’s ordering. If you need a single gate, put the decision logic in one hook.
Rank #4
For organization-wide policy, use managed hooks. Those are marked as managed and cannot be disabled in the user hook browser, but the scripts they reference must be deployed and maintained by your team. Codex hooks
When a policy hook is skipped, untrusted, or fails
A hook is only as good as the conditions under which it runs. There are four states to plan for: the hook is skipped, the hook is not trusted, the hook returns an error or times out, and the hook explicitly denies. Each product handles them differently, and some behavior is not documented in the sources used here.
- Skipped or not loaded. In Claude Code, an interactive session holds hooks until the workspace is trusted. In Codex, a non-managed hook that is untrusted or changed is skipped pending review. In both cases, the tool call proceeds under the other controls that remain, so a skipped hook is not a block.
- Silent success. In Claude Code, a handler that exits successfully without a decision leaves the normal permission flow in place. The hook has allowed nothing and denied nothing.
- Callback error, timeout, or malformed response. In Codex, for supported remote hooks, these can fail the hook without blocking the tool. Claude Code’s failure behavior for timeouts and malformed output is not stated in the hooks reference reviewed for this article.
- Explicit denial. A supported denial blocks the action in Codex’s remote hook model, and a
PreToolUsedenial blocks the call in Claude Code.
The practical lesson is that a crash in your policy script can be a silent allow. Do not assume fail-closed behavior. Choose the behavior you want, make the script exit or emit a denial on its own internal errors where the product’s semantics allow it, and test those paths explicitly: remove the script, break its syntax, make it sleep past the timeout, and make it emit output in the wrong format. Record what the agent did in each case.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What enforcement belongs outside the agent
For sensitive work, the policy hook is one layer. The controls below do not depend on the model complying with a rule or on a hook running correctly.
- Isolated execution. Run the agent in a container, VM, or separate host with only the repository and tools it needs. Anthropic’s sandboxing engineering article describes sandboxing as a way to restrict filesystem and network access for Claude Code. In its October 20, 2025 engineering article, Anthropic reports that sandboxing reduced permission prompts by 84%. That is an internal usage finding from Anthropic, not an independent benchmark, and it is not a guaranteed result for other users. Anthropic sandboxing article
- Filesystem limits. Mount only the directories the task requires, and make everything else read-only or absent. Keep writable paths narrow.
- Network egress. Allow outbound connections only to destinations the workload needs. An allowlist at the network layer covers subprocesses that a command-string rule would miss.
- Least-privilege identity. Run the agent as a dedicated low-privilege account, not as the developer’s everyday user, so that a command hook and any child process inherit only what that account can reach.
- Credential separation. Keep broad application keys out of any environment the agent can read. Issue short-lived, narrowly scoped credentials for the specific task.
- Human review. Require explicit approval for ambiguous or high-risk side effects, such as production writes, data deletion, or outbound transfers.
OpenAI’s sandbox security guidance says that generated code can access the files, credentials, and network available to its environment, and recommends isolated compute, network restrictions, and separation of credentials. Its guardrails and approvals guidance calls for independent filesystem, network, and identity boundaries and for human review of high-risk actions. OpenAI sandbox security, OpenAI guardrails and human review
A policy hook records intent and blocks many accidental actions. The boundary is the environment you give the agent.
The product details above reflect the official documentation as checked on 2026-10-07 UTC. These tools change quickly, so confirm field names, events, trust behavior, and managed-policy options on the linked pages before you roll out a policy.
This sentence is intentionally removed
Tested behavior is not claimed here. Everything in this article comes from the official documentation, not from a live installation.
Start with isolation, then add the hook as a consistent audit and deny layer.
Quick Recap
Nothing else needs to be added.
“
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
