A court clerk project must prevent Claude from calling a file-delete tool until an archive action is confirmed. Which Agent SDK mechanism provides that deterministic guardrail?

Hooks that intercept and block destructive tool calls before execution provide the deterministic guardrail a court clerk project needs to prevent Claude from calling file-delete until an archive action is confirmed. Hooks sit in the Agent SDK control path around tool execution: the model may propose delete, but the hook evaluates preconditions (archive confirmation present, role authorized) and can deny the call before it touches records. That is a server-side deadbolt, not a suggestion.

Reduced temperature so Claude thinks more carefully before each action fails by concept: temperature only changes sampling randomness, not authorization, so a lower setting makes delete calls no less possible and cannot deterministically block execution. Detailed audit logs that record file-delete calls after execution fail because they only record the action after it occurs; they do not intercept or block the call, so they cannot deterministically prevent an unarchived deletion. System prompt instructions describing archive checks before file-delete tools fail because they are only guidance to the model, not server-side enforcement—without a hook, Claude can still call the delete tool without a confirmed archive.

Exam caveat: hooks enforce runtime policy; they must be tested for bypass paths (alternate tools, direct API calls). Pair deny decisions with clear operator-facing errors and audit events.

Operational check: implement a pre-tool hook on delete that requires a verified archive confirmation token, log allow/deny with clerk ID and case ID, attempt deletes without archive in staging (must fail), and periodically review denied destructive calls in court IT audits.