Deterministic Hooks as Approval Gates (Stage 5: Deploy)

Deterministic Hooks as Approval Gates (Stage 5: Deploy) A workflow diagram generated by Archify. 01 / Claude Code Runtime 02 / PreToolUse Interceptor 03 / Managed Policy Engine 04 / OpenTelemetry Audit Tool Intent Dispatch Policy Evaluation & Gate Execution & Audit Agent Command Request · PreToolUse bash invocation · Claude Code Runtime › Tool Intent Dispatch · intercepted Agent Command Request PreToolUse bash invocation intercepted Sandboxed Execution · allowed domains & creds · Claude Code Runtime › Execution & Audit · isolated runner Sandboxed Execution allowed domains & creds isolated runner PreToolUse Hook · production-gate.sh · PreToolUse Interceptor › Tool Intent Dispatch · gatekeeper PreToolUse Hook production-gate.sh gatekeeper Block & Exit 2 · prohibited / no ticket · PreToolUse Interceptor › Policy Evaluation & Gate · abort op Block & Exit 2 prohibited / no ticket abort op Managed Policy Engine · deny / ask / allow rules · Managed Policy Engine › Policy Evaluation & Gate · enterprise rules Managed Policy Engine deny / ask / allow rules enterprise rules Human Approval Gate · release authorization · Managed Policy Engine › Policy Evaluation & Gate · human sign-off Human Approval Gate release authorization human sign-off Audit & Telemetry · OpenTelemetry export · OpenTelemetry Audit › Execution & Audit · tamper-proof Audit & Telemetry OpenTelemetry export tamper-proof bash command match command deny rule match production deploy exit 2: explain reason release approved safe inner loop log execution Legend User UI Agent logic Policy Context / trace Cloud service

Deterministic Enforcement

  • • PreToolUse hooks chan command truoc khi chay tren he thong hoac network
  • • Exit 2 chan action va phan hoi ly do chi tiet de agent hieu nguyen nhan

Enterprise Governance

  • • Managed settings ngan engineer bypass hoac override bang command line flags
  • • Toan bo quyet dinh allow/block duoc export ve he thong OpenTelemetry