The table splitting the three files by "does it enforce anything" is the clearest explanation of this I have seen. CLAUDE.md is context, settings.json is a list, and the hook is the only part that can actually say no. The exit 2 detail matters too, since any other non-zero code lets the action go ahead.

The find / example is a good one. An agent that does not know where a file lives will happily walk external drives and network shares, and no line in a handbook stops that. A hook does.

At Ascendra Ventures we apply the same rule when we hand an automation over to a client: anything that would cause real damage if broken goes into a check, and the handbook only explains why. One folder per job also makes it much easier to say what each piece is allowed to touch.

How many of your 25 deny rules came from a mistake you actually saw, and how many did you add up front?