PreToolUse hooks for deterministic compliance enforcement (FERPA, workflow gates)

PreToolUse hooks for deterministic compliance enforcement (FERPA, workflow gates)

Problem Statement

In compliance-critical workflows (educational grading with FERPA, healthcare with HIPAA, government data handling), instruction-based compliance is insufficient. Agents can inadvertently violate policies because enforcement relies on LLM judgment rather than deterministic system controls.

Real-world failure case:

Grading workflow (Canvas LMS integration):

• AGENTS.md instructs: "Show _all_comments.md for instructor review before pushing grades"
• Agent creates feedback, immediately runs grader_push.py --push without showing instructor
• Result: "AI drafted, instructor reviewed" tag is false - no review occurred

FERPA protection:

• AGENTS.md instructs: "NEVER READ .deid_master.csv, .keymap.json, submissions_raw/* (FERPA Zone 2)"
• Agent has Read tool access to these files
• Nothing physically prevents violation - relies on agent following instructions

Root Cause

From "Reason Less, Verify More" (arXiv 2607.07405):

"78% of observed failures are silent wrong-state failures... The model should not be responsible for enforcing its own constraints. That responsibility belongs to the surrounding system."

LLM agents exhibit "silent policy-violation failures" - they violate constraints without raising errors because probabilistic reasoning replaces deterministic enforcement.

Proposed Solution: PreToolUse Hook Enforcement

1. Grade Review Gate

{
  "hooks": {
    "PreToolUse": [{
      "matcher": "Bash(.*grader_push.*--push.*)",
      "hooks": [{
        "type": "command",
        "command": ".claude/hooks/require-review.sh"
      }]
    }]
  }
}

Hook logic:

• Check .reviewed file exists
• Check modified within last N minutes (prevents stale reviews)
• Check _all_comments.md exists OR user gave explicit approval
• If fail → exit 2, stderr: "Cannot push grades without instructor review"

2. FERPA File Protection

{
  "hooks": {
    "PreToolUse": [{
      "matcher": "Read(.*)|Grep(.*)|Bash(cat.*|head.*|tail.*)",
      "hooks": [{
        "type": "command",
        "command": ".claude/hooks/ferpa-guard.sh"
      }]
    }]
  }
}

Hook checks file path against:

• .*/.deid_master.*\.csv
• .*/\.keymap\.json
• .*/\.review.*\.csv
• .*/.known_names.txt
• .*/submissions_raw/.*

If match → exit 2, stderr: "FERPA violation blocked: cannot read {file}"

Why This Matters

From ACM Queue "Guardians of the Agents":

"No serious distributed system would ever allow a probabilistic engine to directly control production infrastructure without external verification layers, yet many AI agents do exactly that."

Educational, healthcare, and government sectors need neurosymbolic safety (LLM reasoning + deterministic symbolic rules) for compliance.

Research Links

LLM Agent Safety Architecture:

• Reason Less, Verify More: Deterministic Gates Recover Silent Policy-Violation Failures - CMU research on deterministic verification layers
• Guardians of the Agents - ACM Queue - Why probabilistic enforcement fails
• AI Agent Guardrails: Rules That LLMs Cannot Bypass - AWS deterministic control patterns
• Governance Architecture for Autonomous Agent Systems - Framework for verifiable safety

FERPA Compliance for AI:

• FERPA Compliance for AI in Healthcare Education - Technical enforcement requirements
• FERPA & COPPA Compliance Guide for School AI - Industry standards
• Responsible AI: Navigating FERPA and HIPAA - Multi-regulation compliance

Poka-Yoke (Mistake-Proofing) Principles:

• Poka-yoke - Wikipedia - Manufacturing quality principles applied to software
• Tool Design for Agents — Deep Expertise Track - Mistake-proof tool interface design

Documentation Enhancement

Claude Code docs should include:

1. Compliance workflows section - Examples of FERPA/HIPAA/SOC2 enforcement patterns
2. Hook recipes - Common pre-tool-use guards for sensitive operations
3. Neurosymbolic architecture guide - When to use hooks vs instructions

Current Workaround

Users must implement custom hooks (which we will now do), but this pattern should be:

1. Documented as best practice
2. Possibly built into Claude Code for common compliance scenarios
3. Referenced in educational/healthcare deployment guides

---

Impact: Makes Claude Code viable for compliance-critical workflows in education, healthcare, and government sectors by providing deterministic enforcement that instruction-based compliance cannot guarantee.