Two related upgrades to the enforcement surfaces:
-
'ask' as a PreToolUse decision. Today a guard can allow or deny. Claude Code's hook protocol also supports asking the user to approve the specific action. For policies where the right answer is "a human decides" — committing text that looks like process notes, touching agent config — deny-with-override-pragma works but approve-in-place is the better experience.
-
A first-class commit-message gate kind. The catalog's protect-commit-privacy policy currently ships as a guard script; a declarative commit_message gate kind (pattern + allow-pragma + message) would let policies of this family be authored without shell, replay in evals like any other gate, and compile to both the git hook and the PreToolUse surface from one declaration.
Two related upgrades to the enforcement surfaces:
'ask' as a PreToolUse decision. Today a guard can allow or deny. Claude Code's hook protocol also supports asking the user to approve the specific action. For policies where the right answer is "a human decides" — committing text that looks like process notes, touching agent config — deny-with-override-pragma works but approve-in-place is the better experience.
A first-class commit-message gate kind. The catalog's
protect-commit-privacypolicy currently ships as a guard script; a declarativecommit_messagegate kind (pattern + allow-pragma + message) would let policies of this family be authored without shell, replay in evals like any other gate, and compile to both the git hook and the PreToolUse surface from one declaration.