By using this site, you agree to the Privacy Policy and Terms of Use.
Accept
World of SoftwareWorld of SoftwareWorld of Software
  • News
  • Software
  • Mobile
  • Computing
  • Gaming
  • Videos
  • More
    • Gadget
    • Web Stories
    • Trending
    • Press Release
Search
  • Privacy
  • Terms
  • Advertise
  • Contact
Copyright © All Rights Reserved. World of Software.
Reading: How to Build a Governance Layer for Claude Code With Hooks, Skills, and Agents | HackerNoon
Share
Sign In
Notification Show More
Font ResizerAa
World of SoftwareWorld of Software
Font ResizerAa
  • Software
  • Mobile
  • Computing
  • Gadget
  • Gaming
  • Videos
Search
  • News
  • Software
  • Mobile
  • Computing
  • Gaming
  • Videos
  • More
    • Gadget
    • Web Stories
    • Trending
    • Press Release
Have an existing account? Sign In
Follow US
  • Privacy
  • Terms
  • Advertise
  • Contact
Copyright © All Rights Reserved. World of Software.
World of Software > Computing > How to Build a Governance Layer for Claude Code With Hooks, Skills, and Agents | HackerNoon
Computing

How to Build a Governance Layer for Claude Code With Hooks, Skills, and Agents | HackerNoon

News Room
Last updated: 2026/03/13 at 2:41 PM
News Room Published 13 March 2026
Share
How to Build a Governance Layer for Claude Code With Hooks, Skills, and Agents | HackerNoon
SHARE

AI assistants don’t have “bad memory.” They have bad governance.

You’ve seen it:

  • You wrote a meticulous architecture guide. The model ignores it.
  • You said “4-layer architecture.” It outputs 3 layers.
  • You said “no el-input.” It drops <el-input v-model="value" /> like it’s doing you a favor.

This isn’t about intelligence. It’s about incentives.

In Claude Code, Skills are available context, not a hard constraint. If Claude “feels” it can answer without calling a Skill, it will. And your project handbook becomes decoration.

On our team, building a RuoYi-Plus codebase with Claude Code, we tracked it:

Without intervention, Claude proactively activated project Skills only ~25% of the time.

So 3 out of 4 times, your “rules” aren’t rules. They’re a suggestion.

We wanted something stricter: a mechanism that makes Claude behave less like a clever intern and more like a staff engineer who reads the playbook before writing code.

The fix wasn’t more prompting.

The fix was Hooks.

After ~1 month of iteration, we shipped a .claude configuration stack:

  • 4 lifecycle hooks (governance)
  • 26 domain Skills (knowledge)
  • slash commands (process orchestration)
  • agents (parallel specialists)

Result:

Skill activation for dev tasks: ~25% → 90%+ Less rule-violating code, fewer “please redo it” cycles, and far fewer risky tool actions.

This article breaks down the architecture so you can reproduce it in your own repo.


1) Why Claude Code “forgets”: Skills are opt-in by default

Claude Code’s default flow looks like this:

User prompt → Claude answers (maybe calls a Skill, maybe not)

That “maybe” is the problem.

Claude’s internal decision heuristic is usually:

  • “Can I answer this quickly without extra context?”
  • not “Do I must comply with repo rules?”

So the system drifts toward convenience.

What you want is institutional friction: a lightweight “control plane” that runs before Claude starts reasoning, and shapes the work every time.


2) The breakthrough: a forced Skill evaluation hook

We implemented a hook that fires at the earliest moment: UserPromptSubmit.

It prints a short policy block that Claude sees before doing anything else:

  • Evaluate each Skill: yes/no + reason
  • If any “yes”: call Skill immediately
  • Only then: proceed to implementation

The “forced eval” hook (core logic)

We keep it deliberately dumb and deterministic:

  • detect slash commands (escape hatch)
  • otherwise print the evaluation protocol
// .claude/hooks/skill-forced-eval.js (core idea, simplified)
const prompt = process.env.CLAUDE_USER_PROMPT ?? "";
​
// Escape hatch: if user invoked a slash command, skip forced eval
const isSlash = /^/[^s/]+/.test(prompt.trim());
if (isSlash) process.exit(0);
​
const skills = [
 &nbsp;"crud-development",
 &nbsp;"api-development",
 &nbsp;"database-ops",
 &nbsp;"ui-pc",
 &nbsp;"ui-mobile",
 &nbsp;// ... keep going (we have 26)
];
​
const instructions = [
 &nbsp;"## Mandatory Skill Activation Protocol (MUST FOLLOW)",
 &nbsp;"",
 &nbsp;"### Step 1 — Evaluate",
 &nbsp;"For EACH skill, output: [skill] — Yes/No — Reason",
 &nbsp;"",
 &nbsp;"### Step 2 — Activate",
 &nbsp;"If ANY skill is Yes → call Skill(<name>) immediately.",
 &nbsp;"If ALL are No → state 'No skills needed' and continue.",
 &nbsp;"",
 &nbsp;"### Step 3 — Implement",
 &nbsp;"Only after Step 2 is done, start the actual solution.",
 &nbsp;"",
 &nbsp;"Available skills:",
 &nbsp;...skills.map(s => `- ${s}`)
].join("n");
​
console.log(instructions);

What changes in practice

Before (no hook):

“Build coupon management.” Claude starts coding… and ignores your 4-layer architecture or banned components.

After (forced eval hook):

Claude must first produce an explicit decision table, then activate Skills, then implement.

The behavioral shift is dramatic because you’re eliminating “optional compliance.”


3) Why 90% and not 100%?

Because we intentionally added a fast path.

When a user knows what they want, typing a command like:

  • /dev build coupon management
  • /crud b_coupon
  • /check

should be instant. So the hook skips evaluation for slash commands and lets the command workflow take over.

That’s the tradeoff:

  • Governance for free-form prompts
  • Speed for structured commands

4) Hooks as a lifecycle control plane (the 4-hook stack)

Think of hooks as a CI pipeline for an agent session—except it runs live, in your terminal.

We use four key points:

4.1 SessionStart: “look at the repo before you talk”

When a session starts, we show:

  • current git branch
  • uncommitted changes
  • open TODOs / status
  • common commands

Example output:

🚀 Session started: RuoYi-Plus-Uniapp
Time: 2026-02-16 21:14
Branch: master
​
⚠️ Uncommitted changes: 5 files
📋 TODO: 3 open / 12 done
​
Shortcuts:
  /dev &nbsp;  build feature
  /crud &nbsp; generate module
  /check  verify conventions

Why it matters: Claude stops acting like it’s entering a blank room.


4.2 UserPromptSubmit: forced Skill evaluation (discipline)

This is the “must read the handbook” gate.


4.3 PreToolUse: the safety layer (tool governance)

Claude Code is powerful because it can run tools: Bash, write files, edit code.

That’s also how accidents happen.

PreToolUse is your last line of defense before something irreversible.

We block a small blacklist (and warn on a broader greylist):

// .claude/hooks/pre-tool-use.js (conceptual)
const cmd = process.env.CLAUDE_TOOL_INPUT ?? "";
​
const hardBlock = [
 &nbsp;/rms+(-rf|--recursive).*s+//i,
 &nbsp;/drops+(database|table)b/i,
 &nbsp;/>s*/dev/sd[a-z]b/i,
];
​
if (hardBlock.some(p => p.test(cmd))) {
 &nbsp;console.log(JSON.stringify({
 &nbsp; &nbsp;decision: "block",
 &nbsp; &nbsp;reason: "Dangerous command pattern detected"
  }));
 &nbsp;process.exit(0);
}
​
// Optionally: warn/confirm on sensitive actions (mass deletes, chmod -R, etc.)

This isn’t paranoia. We’ve seen models “clean temp files” with rm -rf in the wrong directory. You want a guardrail that doesn’t rely on the model being careful.


4.4 Stop: “close the loop” with next-step guidance

When Claude finishes, we:

  • summarize file changes (new vs modified)
  • suggest next actions (run tests, docs updates, commit)
  • optionally trigger agents (code review)

Example:

✅ Done — 8 files changed
​
Next steps:
- @code-reviewer for backend conventions
- SQL changed: sync migration scripts
- Consider: git commit -m "feat: coupon module"

The goal: eliminate the “it worked in the chat” gap.


5) Skills: the knowledge layer you can actually enforce

Once activation is deterministic, Skills become what they were supposed to be: a domain-specific knowledge base.

We built 26 Skills across:

  • backend (CRUD, API, DB, annotations, error handling)
  • frontend (PC component policy, state management)
  • mobile (UI kits, uniapp platform constraints)
  • integrations (payments, WeChat, OSS)
  • quality (perf, security, bug detective)
  • engineering management (architecture, git workflow, tech decisions)

A Skill file structure that scales

Every SKILL.md follows the same skeleton:

# Skill Name
​
## When to trigger
- Keywords:
- Scenarios:
​
## Core rules
### Rule 1
Explanation + example
​
### Rule 2
Explanation + example
​
## Forbidden
- ❌ ...
​
## Reference code
- path/to/file
​
## Checklist
- [ ] ...

This consistency matters because the model learns how to consume Skills.


6) Commands: workflows, not suggestions

Skills solve “what is correct.”

Commands solve “what is the process.”

6.1 /dev: a 7-step development pipeline

We designed /dev as an opinionated workflow:

  1. clarify requirements
  2. design (API + modules + permissions)
  3. DB design (SQL + dictionaries + menus)
  4. backend (4-layer output)
  5. frontend (component policy + routing)
  6. test/verify
  7. docs/progress update

It’s basically: “how seniors want juniors to work” encoded as a runnable script.

6.2 /crud: generate a full module from a table

Input:

/crud b_coupon

Output (example set):

  • Entity / BO / VO
  • DAO + Query wrapper rules
  • Service + Controller (no forbidden patterns)
  • Mapper
  • Frontend API + page scaffold

Manual effort: 2–4 hours Command-driven: 5–10 minutes (plus review)

6.3 /check: full-stack convention linting (human-readable)

This is where we turn Skills into a verifier:

  • backend: layering rules, forbidden inheritance, query wrapper policy
  • frontend: banned components, wrapper usage
  • mobile: component kit, units, imports

7) Agents: parallel specialists (don’t overload the main thread)

Some tasks should be handled by a dedicated subagent:

  • @code-reviewer: convention checks with a strict checklist
  • @project-manager: update status docs, TODOs, progress metrics

The advantage isn’t “more intelligence.” It’s separation of concerns and reduced context pollution in the main session.

A practical pattern:

  1. main agent generates code
  2. Stop hook suggests review
  3. you invoke @code-reviewer
  4. reviewer returns a structured diff + fixes list

8) The full system: governance + knowledge + process + division of labor

This is the architecture in one sentence:

Hooks enforce behavior, Skills provide standards, Commands encode workflows, Agents handle parallel expertise.

And yes—this is how you turn a “general AI assistant” into a “repo-native teammate.”


9) Minimal reproducible setup (copy-paste friendly)

If you want the smallest version that still works, build this:

.claude/
  settings.json
  hooks/
 &nbsp;  skill-forced-eval.js
 &nbsp;  pre-tool-use.js
  skills/
 &nbsp;  crud-development/
 &nbsp; &nbsp;  SKILL.md

Minimal settings.json (UserPromptSubmit hook)

{
 &nbsp;"hooks": {
 &nbsp; &nbsp;"UserPromptSubmit": [
 &nbsp; &nbsp;  {
 &nbsp; &nbsp; &nbsp; &nbsp;"matcher": "",
 &nbsp; &nbsp; &nbsp; &nbsp;"hooks": [
 &nbsp; &nbsp; &nbsp; &nbsp;  {
 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"type": "command",
 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"command": "node .claude/hooks/skill-forced-eval.js"
 &nbsp; &nbsp; &nbsp; &nbsp;  }
 &nbsp; &nbsp; &nbsp;  ]
 &nbsp; &nbsp;  }
 &nbsp;  ],
 &nbsp; &nbsp;"PreToolUse": [
 &nbsp; &nbsp;  {
 &nbsp; &nbsp; &nbsp; &nbsp;"matcher": "",
 &nbsp; &nbsp; &nbsp; &nbsp;"hooks": [
 &nbsp; &nbsp; &nbsp; &nbsp;  {
 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"type": "command",
 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;"command": "node .claude/hooks/pre-tool-use.js"
 &nbsp; &nbsp; &nbsp; &nbsp;  }
 &nbsp; &nbsp; &nbsp;  ]
 &nbsp; &nbsp;  }
 &nbsp;  ]
  }
}

Then iterate:

  • add SessionStart
  • add Stop
  • grow Skills only when you catch repeated “wrong behavior”
  • encode repeat workflows as commands
  • offload review/PM tasks to agents

Closing: “ability” isn’t the bottleneck — activation is

Your model is already capable.

What’s missing is a system that makes the right behavior automatic.

A smart new hire without a handbook will freestyle. A smart new hire with:

  • enforced checklists
  • clear forbidden patterns
  • repeatable workflows
  • specialists for reviews and PM

…becomes consistent fast.

Claude is the same.

Sign Up For Daily Newsletter

Be keep up! Get the latest breaking news delivered straight to your inbox.
By signing up, you agree to our Terms of Use and acknowledge the data practices in our Privacy Policy. You may unsubscribe at any time.
Share This Article
Facebook Twitter Email Print
Share
What do you think?
Love0
Sad0
Happy0
Sleepy0
Angry0
Dead0
Wink0
Previous Article Jojo’s, Plastics, Radiation: What’s New to Watch on Netflix the Week of March 13, 2026 Jojo’s, Plastics, Radiation: What’s New to Watch on Netflix the Week of March 13, 2026
Next Article AI-Recommended Music? Spotify Is Giving You the Power to Personalize AI-Recommended Music? Spotify Is Giving You the Power to Personalize
Leave a comment

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Stay Connected

248.1k Like
69.1k Follow
134k Pin
54.3k Follow

Latest News

Forget CRUD: Workflow APIs Are How Modern Platforms Actually Work | HackerNoon
Forget CRUD: Workflow APIs Are How Modern Platforms Actually Work | HackerNoon
Computing
Garmin smartwatches can now join in on the Pokémon fun, but these models miss out
Garmin smartwatches can now join in on the Pokémon fun, but these models miss out
News
Demand for NVIDIA H20 chips surges as Chinese companies adopt DeepSeek’s AI models: report · TechNode
Demand for NVIDIA H20 chips surges as Chinese companies adopt DeepSeek’s AI models: report · TechNode
Computing
Chinese narratives around Anthropic highlight contradictions for the US
Chinese narratives around Anthropic highlight contradictions for the US
News

You Might also Like

Forget CRUD: Workflow APIs Are How Modern Platforms Actually Work | HackerNoon
Computing

Forget CRUD: Workflow APIs Are How Modern Platforms Actually Work | HackerNoon

5 Min Read
Demand for NVIDIA H20 chips surges as Chinese companies adopt DeepSeek’s AI models: report · TechNode
Computing

Demand for NVIDIA H20 chips surges as Chinese companies adopt DeepSeek’s AI models: report · TechNode

1 Min Read
I Built a Project-Specific LLM From My Own Codebase | HackerNoon
Computing

I Built a Project-Specific LLM From My Own Codebase | HackerNoon

1 Min Read
Chinese expert predicts small-scale use of solid state batteries in 2027 · TechNode
Computing

Chinese expert predicts small-scale use of solid state batteries in 2027 · TechNode

1 Min Read
//

World of Software is your one-stop website for the latest tech news and updates, follow us now to get the news that matters to you.

Quick Link

  • Privacy Policy
  • Terms of use
  • Advertise
  • Contact

Topics

  • Computing
  • Software
  • Press Release
  • Trending

Sign Up for Our Newsletter

Subscribe to our newsletter to get our newest articles instantly!

World of SoftwareWorld of Software
Follow US
Copyright © All Rights Reserved. World of Software.
Welcome Back!

Sign in to your account

Lost your password?