Where Prompting Ends

Every lever in this course raises the odds of compliance. None guarantees it. For the rules that must never fail, stop asking — and move them outside the model entirely.

Why this, for you: the most important judgement in prompt engineering is knowing when not to prompt. A reminder (Lesson 10) re-asks; a hook requires. This lesson draws the line: which rules belong in language the model can deprioritise, and which belong in a gate it can't reach.

Prompt instructions are probabilistic. Under task pressure — context filling, attention diverted — compliance degrades toward the ceiling and the agent reverts to training defaults. Hooks are deterministic: a pre-command hook runs outside the agent's context, and the model cannot overrule it.

1 The decision rule

Reach for a hook only when all three hold; otherwise the rule stays in the prompt.

Use a hook when compliance is non-negotiable (failure has real cost), the rule is binary (a command either violates it or doesn't), and the behaviour has a strong opposing prior in training data. Miss any one and you're back in the prompt.

Hook (deterministic)	Prompt (probabilistic)
Block `git push --force` to main	"Prefer composition over inheritance here"
Enforce `pnpm`, block `npm install`	"Raise a concern before editing auth code"
Block writes to secrets files	"Write a test for business-logic changes"

The left column is absolute, binary, and opposed by a prior. The right needs judgement and context a hook can't inspect — intent, trade-offs, architectural fit.

2 Two properties prompts can't have

Injection resistance. An injected instruction can change what the agent tries to do, not what a hook allows. Without a hook, a prompt-injection payload and your CLAUDE.md compete in the same reasoning loop — non-deterministic. With a hook, PreToolUse fires before execution — deterministic.

Zero context cost. Prompt rules occupy context and compete for attention; moving an absolute rule to a hook both improves reliability and frees the budget. And the idea predates AI agents — a pre-commit hook enforces its rule regardless of origin, whether a developer, an agent, or a script triggered it.

# probabilistic — the prompt ASKS: "Never run npm install; use pnpm." # deterministic — the hook REQUIRES: PreToolUse(Bash): match ^npm install → exit 1, feed error back

3 Hooks aren't everywhere

A hook is deterministic at the tool-call boundary — not beyond it. Four gaps narrow the rule (hooks-vs-prompts):

Substitution — block rm and the model reaches for /bin/rm or a truncating Write; each call is judged alone.
Intent-blindness — a hook sees parameters, not reasoning; it can't tell a legitimate --force on a personal branch from a dangerous one.
Execution-path gaps — only the standard session path is hooked; pipe mode, some IDE integrations, and between-call events are unreachable.
Hook-source trust — a malicious hook from an untrusted repo is just as unconditional as a trusted one; review hook configs before opening unfamiliar repos.

So rules that must hold everywhere also need CI or git-level gates. The hook is one layer, not the whole wall.

The cost of over-blocking

Determinism cuts both ways. A hook that's too aggressive blocks legitimate work, and false positives from over-blocking can cost more than the occasional non-compliance you were preventing. When a rule needs judgement to apply — "prefer X when working in Y" — that judgement is exactly what a hook lacks. Keep it in the prompt, where polarity (Lesson 2) governs how you phrase it.

↪ Your win: know which rules leave the prompt

Three-part test — non-negotiable, binary, opposed by a prior → hook. Else, prompt.
Hooks are injection-resistant — they bound what's allowed, not just what's tried.
Move absolutes out of context — a hook frees the budget and can't be forgotten.
Mind the four gaps — substitution, intent-blindness, path gaps, source trust; add CI.
Don't over-block — judgement calls and contextual guidance stay in the prompt.

Retrieval practice — recall, don't peek

Question 1A rule belongs in a hook only when it is non-negotiable, binary, and…

Question 2Against prompt injection, a hook protects by bounding…

Question 3"Intent-blindness" means a hook cannot…

Question 4Contextual guidance like "prefer X when in Y" stays in the prompt because a hook…

Question 5 · spaced recall from Lesson 10Event-driven reminders are injected as user messages, rather than added to the system prompt, mainly to…

Ask me anything. Want to sort your current rules into "hook" and "prompt" piles, or find the must-never-fail constraints still living as language? Next: The Re-read Protocol — the failure mode that erases your instructions silently, mid-session, with no error to catch.