A hook list is not a control map.

Short video caption

Compare Cursor, Claude Code, Grok Build and Codex by the action routes your team actually uses: pre-call veto, failure behavior, credential scope and independent state readback. Vendor docs are a starting map; canary each runtime. #EricFieldNotes

Full written post / accessible read

Coding agents can use hooks, rules and permissions to move quickly inside boundaries. Comparing products by the number of hook names misses the real question: which path can still perform the action your policy forbids?

A local shell hook may catch a deployment command while a hosted tool or cloud run follows a different path. A green local demo cannot establish coverage elsewhere. Vendor docs describe the surfaces; only a canary in your actual setup proves the route.

For each product, inventory the enabled tools and runtimes. Record whether a pre-call veto fires, what happens when the hook fails, which credential the call uses, and how you verify the outside state. Do not assume the event names imply identical semantics.

Choose the harness that covers your actual workflow, then run a harmless blocked-action canary in each runtime and remove authority from routes you cannot prove. Do this because governance follows the reachable action path, not the marketing checklist.

#EricFieldNotes

Evidence and boundary

On-screen boundary: PRODUCT DOCS + TEST DESIGN. The sources below support documented mechanisms and specifications; illustrative scenarios are not presented as measured incidents.