The business rule is portable.

Video caption

The business rule is portable. Pre-call in two hosts can mean different observed paths. Re-run canaries after host upgrades. Narration uses Eric's authorized AI voice clone. #EricFieldNotes

Full written post / accessibility read

Staging identity may not mutate production is one invariant. A hook event, exit code, matching rule and JSON payload are host-specific implementation details. Copying one config file across coding products does not establish equivalent coverage or failure behavior.

One host may expose a shell event, another an MCP event, and another a delegated worker event. The question is not whether both advertise hooks. It is whether the installed version observes and blocks every route that holds authority over the target.

Store the invariant and target oracle once. For each host adapter, test allowed staging, forbidden production, callback crash, delegated call and alternate route. Record version, exact event payload, host decision and target receipt. Mark a route not observed when it cannot be exercised.

Version the adapter like any dependency. Keep the service authorization rule as the final backstop. Use host hooks for early denial and explanation, then use target receipts to verify the business invariant. That is a defensible comparison even when products change.

Narration uses Eric's authorized AI voice clone.

#EricFieldNotes

Four-beat scene transcript

1. The business rule is portable.

Staging identity may not mutate production is one invariant. A hook event, exit code, matching rule and JSON payload are host-specific implementation details. Copying one config file across coding products does not establish equivalent coverage or failure behavior.

Visual: The callback schema is not.

2. Feature names hide route differences.

One host may expose a shell event, another an MCP event, and another a delegated worker event. The question is not whether both advertise hooks. It is whether the installed version observes and blocks every route that holds authority over the target.

Visual: Pre-call in two hosts can mean different observed paths.

3. Keep adapters small and tested.

Store the invariant and target oracle once. For each host adapter, test allowed staging, forbidden production, callback crash, delegated call and alternate route. Record version, exact event payload, host decision and target receipt. Mark a route not observed when it cannot be exercised.

Visual: Replay the same five probes on each actual installation.

4. Compare observed enforcement.

Version the adapter like any dependency. Keep the service authorization rule as the final backstop. Use host hooks for early denial and explanation, then use target receipts to verify the business invariant. That is a defensible comparison even when products change.

Visual: Re-run canaries after host upgrades.

Research and claim limits

• OWASP Authorization Cheat Sheet (S229)
• Claude Code hooks reference (S232)
• Cursor hooks (S233)

The examples identified as illustrative or simulated are design probes, not reported incidents. Vendor specifications do not establish workload performance.