You've deployed a customer support resolution agent using the Claude Agent SDK. It has access to four tools: get_customer, lookup_order, process_refund, and escalate_to_human. Your system prompt clearly states that customer identity must be verified via get_customer before any refund is processed.
After two weeks in production, you review the logs. In 92% of refund cases, the agent correctly calls get_customer first. In 8% of cases — specifically when the customer volunteers an order number in their opening message — the agent skips get_customer and goes directly to lookup_order followed by process_refund. Three of these cases resulted in refunds being issued to the wrong account. Your CFO is not amused.
What is the most effective fix?
Why did you pick that answer? Two or three sentences. The act of articulating it is what builds the judgment — not the click that follows.
A PreToolUse hook is programmatic enforcement, not prompt guidance. It runs deterministically, on every invocation, regardless of what the model "decides." The 8% failure rate you observed is not a prompt-quality problem — it's a category problem. Prompts produce probabilistic compliance; hooks produce deterministic guarantees. For any rule with financial or safety consequences, you want the guarantee. The hook intercepts the tool call, checks session state, and blocks execution if the prerequisite hasn't been satisfied. The model's reasoning becomes irrelevant to the enforcement — which is exactly what you want for critical paths.
This is the most tempting wrong answer because it works 92% of the time already, so "making the prompt stronger" feels like it should close the remaining gap. But clarity and compliance are different axes. A perfectly clear instruction can still be ignored by a probabilistic system, especially under the kind of distribution shift a volunteered order number creates. Few-shot examples help, but they also fail probabilistically. When three wrong refunds is already too many, "probably better" is not the right answer.
Dynamically modifying allowedTools mid-session sounds architecturally clever but introduces a subtler bug: the agent now receives inconsistent tool availability across turns, which degrades its reasoning about what it can do. It also doesn't actually solve the problem — you'd need logic to decide when to re-enable lookup_order, and that logic is itself a prerequisite check, which is what a hook is. You've just reinvented the hook, worse.
Self-check steps rely on the model to audit its own reasoning, and in the exact case where the model decided to skip verification, the self-check will often rationalize that decision ("the customer provided the order number, so identity is effectively verified"). Self-review is a useful technique in many contexts, but it's not a substitute for deterministic enforcement on critical paths.