Guardrails in Claude Code: tool, permissions, hooks

Each SDK control from the lesson becomes a file Claude Code reads: .mcp.json for the custom tool, permissions in .claude/settings.json for allow and deny rules, and hooks in the same file for the write boundary and the audit trail. The hooks are small TypeScript scripts that read the event JSON on stdin, so you can try them by piping a sample event into them, the same way Claude Code calls them. The decision that matters most is what the boundary compares: the real target path, after resolving .., the session's working directory and symlinks, not the string the model wrote.