Inside the hooks PEP: deny-closed policy inside Claude Code
How a PEP classifies every Claude Code hook event into gating, context, or observe, wires the correct output schema per event, and deny-closes unknown events.
Topic
policy-as-code
Explore policy-as-code articles from the Olivares AI blog on self-hosted governance, security and operations for enterprise AI agents.
Least-privilege drift: catching over-privileged AI agents before an incident
How to spot least-privilege drift in AI agents by comparing permitted access with observed behavior and enforcing policy at access time.