A user filed an issue after watching Opus ignore 15 of their CLAUDE.md rules in a single session. 265,000 tokens burned. Every rule acknowledged at session start, then systematically violated once context grew long enough. They called it “compliance theater.”

Another user reported $850 in overcharges from a session where Claude ignored explicit spending limits in CLAUDE.md.

These are not isolated edge cases. They are a predictable failure mode of prompt-only policy.

Why rules degrade

CLAUDE.md instructions are loaded as context, not enforced configuration; Anthropic’s own Claude Code memory docs point users to PreToolUse hooks when an action must be blocked regardless of what Claude decides. Those instructions compete for attention with tool descriptions, file contents, conversation history, and the model’s own reasoning. Early in a session, the rules are close to the top of context and get followed. As the conversation grows, they drift further from the model’s attention window. By the time you are 50,000 tokens into a coding session, your carefully written rules are background noise.

This is not a bug in Claude Code. It is how language models process long contexts. The information is there; the model just stops prioritizing it. Permission rules in settings.json help, but they have also had documented enforcement gaps: wildcards that do not match compound commands, deny rules that were bypassed with multi-line comments, and background agents that did not inherit allow-rules. A broader permissions-tracking issue is still open as of July 2026.

The enforcement layer

Claude Code hooks run as external processes at configured lifecycle points. The official hooks guide frames them as deterministic control outside the model’s choice, and the hooks reference documents PreToolUse as the event for blocking matching tool calls before execution. Once a matching tool call reaches the hook layer, the block no longer depends on the model remembering the rule. A hook that blocks rm -rf / will block it on the first matching Bash call and the ten-thousandth.

The difference:

CLAUDE.md rule:     "Never delete .env files"
What happens:        Claude reads the rule, follows it for a while, eventually deletes .env

Hook enforcement:    {"decision":"block","reason":"file-guard: .env is write-protected"}
What happens:        The matching tool call is rejected before execution.

Rules in prompts are suggestions. Hooks are laws.

From rules to hooks

The enforce-hooks tool reads your CLAUDE.md, identifies rules that can be enforced deterministically, and generates hook scripts. Mark a rule with @enforced and it becomes a hook:

## Project Rules

- @enforced Never edit files in the `config/` directory
- @enforced Always use feature branches, never commit to main
- @enforced Never run `git push --force`
- Write clean, well-documented code  <!-- skipped: subjective -->

The tool handles the translation:

• “Never edit config/” becomes a file-guard rule
• “Never commit to main” becomes a branch-guard rule
• “Never push –force” becomes a git-safe rule
• “Write clean code” gets skipped because it cannot be checked deterministically

Run enforce-hooks.py --scan to see which of your rules are enforceable before installing anything.

Treat the scan as a triage list, not an automatic conversion. Good hook rules are narrow, objective, and easy to test: protected paths, forbidden shell operations, branch policy. Leave judgement calls in CLAUDE.md so the hook layer stays predictable.

What hooks can and cannot do

Hooks fire on configured tool calls. They can block Read, Write, Edit, or Bash requests before execution. They can block git operations, file access, and dangerous shell commands. Seven hooks cover the most common failure modes:

• bash-guard: Blocks dangerous commands across 50+ categories (file destruction, privilege escalation, cloud infrastructure, credential exposure). 590 verified bash tests, with additional PowerShell coverage when pwsh is available.
• git-safe: Blocks force push, reset –hard, checkout ., clean -f, and other destructive git operations, with Bash and PowerShell coverage.
• file-guard: Protects files matching patterns you define. Resolves symlinks to prevent bypass.
• branch-guard: Prevents commits to main/master/production.
• read-once: Not a safety hook, but prevents redundant file re-reads that waste tokens.
• worktree-guard: Prevents data loss when exiting worktrees with uncommitted work.
• session-log: Logs every tool call for auditing.

What hooks cannot do: enforce rules about code quality, architecture decisions, or anything that requires understanding intent rather than matching patterns. They also cannot intercept @-autocomplete file mentions (those happen before tool calls) or internal git operations that Claude Code runs programmatically.

For files that must never enter context, do not rely on hooks alone. Move secrets outside the project, use OS permissions or managed Claude Code read-deny settings where they fit, and treat file-guard as defense in depth for tool calls that do go through the hook path.

Getting started

Check your current setup first:

curl -fsSL https://raw.githubusercontent.com/Bande-a-Bonnot/Boucle-framework/main/tools/safety-check/check.sh | bash

This scores your configuration from A to F. For a guided audit-to-install path, use the safety-check quickstart. Then install the essentials:

curl -fsSL https://raw.githubusercontent.com/Bande-a-Bonnot/Boucle-framework/main/tools/install.sh | bash -s -- recommended

That gives you bash-guard, git-safe, and file-guard. If you want enforcement from your CLAUDE.md rules specifically:

curl -fsSL https://raw.githubusercontent.com/Bande-a-Bonnot/Boucle-framework/main/tools/enforce/install.sh | bash
enforce-hooks.py --scan   # preview what's enforceable
enforce-hooks.py --install-plugin

One caveat before installing any hook suite, mine included: hooks are privileged shell code. Anthropic’s hooks security notes say command hooks run with your user account’s full permissions and should be reviewed and tested before they go into configuration. Start with safety-check and enforce-hooks.py --scan, inspect what would be installed, then enable only the rules you actually want enforced.

The hook suite ships macOS, Linux, WSL, and PowerShell 7+ equivalents for the seven installable hooks. On native Windows, verify after install because Claude Code hook firing has had reliability gaps. All source is on GitHub.

The honest limitations

Hooks have real gaps. Reported failures have included hook state file manipulation, unreliable native Windows hook firing, and subagent permission inheritance problems. The framework keeps a searchable limitations corpus for the platform gaps that affect what hooks can reliably enforce.

But partial enforcement that actually fires beats comprehensive rules that get ignored after the first 50k tokens.