Call for submissions: Platform Engineering meet-ups
Rootconf
Rootconf

Call for submissions: Platform Engineering meet-ups

Share your journey of building platforms that power engineering teams

All submissions

Powered by VideoKen

Karan Bansal

Hardening AI Coding Agents with Hooks: Enforcing Least Privilege on Autonomous Developers

Submitted Aug 20, 2026

Session type: Talk (30 mins) Submission made for: Bangalore meet-ups

Abstract

Engineering orgs are rolling out AI coding agents, and the ask lands on the platform team: make Claude Code, Cursor and Copilot agents safe to run without breaking the workflows that make them useful. Sandboxes get disabled because they break real work; permission prompts get skipped with --dangerously-skip-permissions. What holds up in practice is a policy layer the platform team ships: event-driven hooks that intercept every tool call an agent makes and allow, deny, or escalate it before execution.

This talk is the practical architecture of that layer, drawn from an open-source toolkit (claude-code-hooks, MIT, 481 stars, 1,584 tests) running in production:

  • The interception contract: PreToolUse and PostToolUse events, JSON in / JSON out, deny vs ask decisions, and why the hook being a separate process outside the model means prompt injection cannot bypass it
  • What to enforce first: rm -rf and curl-piped-to-shell blocking, .env and secret-read denial, typosquatted package installs, force pushes to protected branches, runaway token consumption
  • The performance budget: hooks run synchronously in the agent’s loop; real numbers on keeping controls under 100ms (sub-5ms regex hooks, 50-100ms Node cold starts, where Python’s 200-400ms hurts)
  • Distribution as a platform product: an installable plugin marketplace, severity levels (critical / high / strict), and a JSONL audit trail your security team can actually consume
  • The honest limits: what hooks cannot catch, and which layers cover the rest

Earlier versions of this talk were delivered at the OWASP GenAI & Agentic Security Virtual Summit (May 2026) and CodeSecCon by SecurityWeek (Aug 2026); both recordings are public. This version is re-angled for platform engineers: less threat taxonomy, more architecture and rollout.

Format

30-min talk plus Q&A; compresses to 20 min if the slot needs it. Fully online-friendly; all demos run offline.

Notes for reviewers

About the speaker

Karan Bansal is Head of AI at ArmorCode, with over 10 years in security. He previously led security and privacy at Urban Company and was a founding engineer at AvidSecure, acquired by Sophos in 2019. He authored “Claude Code’s Most Underrated Feature: Hooks” and maintains the open-source claude-code-hooks toolkit (481 stars), a collection of security hooks for AI coding agents mapped to the OWASP LLM Top 10. He also built reddit-mcp-buddy (799 stars) and curates awesome-claude-skills (492 stars). He spoke on this topic at the OWASP GenAI & Agentic Security Summit and CodeSecCon by SecurityWeek in 2026, and contributes to SGLang and vLLM.

All submissions

Comments

{{ gettext('Login to leave a comment') }}

{{ gettext('Post a comment…') }}
{{ gettext('New comment') }}
{{ formTitle }}

{{ errorMsg }}

{{ gettext('No comments posted yet') }}

Register

Hosted by

Rootconf
Rootconf
We care about site reliability, cloud costs, security and data privacy