A water-utility engineer must ensure Claude cannot open a valve-control API without dual human approval. Which mechanism best enforces that rule?
Select an answer to reveal the explanation.
Short Explanation
Opening a valve is a two-key launch, not just a system prompt instruction describing dual-approval policy—you'll ignore it. A single-operator permission callback fails because it only needs one sign-off, and a post-tool hook that logs after execution can't stop an unauthorized open—it's just an audit trail. A pre-tool hook is the second key—Claude can request the action, but approval logic decides if it runs.
Full Explanation
A pre-tool hook that requires dual human approval before valve-control calls execute best enforces that Claude cannot open a water-utility valve-control API without dual approval. Valve actuation is a physical-plant control action; enforcement must be in the execution path, not in polite language. A pre-tool hook intercepts the valve-control tool, checks for two independent approvals, and blocks execution until the dual-control policy is satisfied—like a two-key launch.
A system prompt instruction describing dual-approval policy for valve operations fails by concept: it only describes the policy without enforcement, so it is non-deterministic and bypassable under pressure. A permission callback configured for single-operator approval of valve-control tools fails because it only requires one approval, not dual, so it does not authorize or block execution according to the dual-approval policy. A post-tool hook that logs valve-control calls after execution for audit review fails catastrophically because it records the action after it happens, not before; it cannot block an unauthorized single-operator valve opening, so it does not enforce dual approval.
Exam caveat: hooks enforce policy only if all valve-control entry points go through the hooked runtime. Direct API access outside the agent must be locked down with the same dual-approval controls.
Operational check: implement pre-tool dual-approval verification with distinct approver identities, deny and audit failed attempts, penetration-test bypass attempts against the system prompt instruction describing dual-approval policy, and confirm valve tools are unreachable without hook approval in staging and production.