The concept
- Subagent (Day 43): a helper with its own instructions, tools and context window. It does one job and returns only a summary.
- Hook: a shell command Claude Code runs at a fixed moment, such as right after a file edit. It always runs; the model doesn't have to remember.
- Permission rules: allow, ask or deny lists for tools and commands, enforced by Claude Code itself, not by the model.
Walkthrough: a gym's class-booking web app
A two-person team uses Claude Code on their JavaScript app. They add three things.
1. A code-reviewer subagent
File: .claude/agents/code-reviewer.md
At the top: a name, a description ("Reviews code for quality and security") and tools: Read, Glob, Grep. Read-only. Below: plain-English review instructions.
Ask: "Have the code-reviewer check my booking changes." It works in its own context and returns, say, 3 findings.
2. A formatter hook
In .claude/settings.json, a PostToolUse hook (runs after a tool finishes) with the matcher Edit|Write. The command passes the edited file to Prettier, a code formatter. Every edited file comes out formatted. For Python, swap in your formatter.
3. Permission rules
In the same file:
- allow: Bash(npm run *): run test and build scripts without asking.
- deny: Bash(git push *): never push.
- deny: Read(./.env): never read the secrets file (Day 51).
Deny wins: Claude Code checks deny, then ask, then allow. An allow rule can't override a deny.
Review them with /hooks and /permissions. Commit the .claude folder so the team shares the rules.
Why three tools? Instructions (CLAUDE.md, Day 70) guide what Claude tries. Hooks and permissions decide what actually happens.
Where you see it at work
- Banking: deny rules on production config and customer-data folders.
- Healthcare: a read-only reviewer that flags patient data in logs.
- Business analysis: a subagent that checks code against acceptance criteria.
Try it today (10–15 min)
1. In a practice repo, create .claude/agents/code-reviewer.md from the example in the docs: https://code.claude.com/docs/en/sub-agents
2. Add the Prettier hook from the hooks guide: https://code.claude.com/docs/en/hooks-guide
3. Add one allow and one deny rule: https://code.claude.com/docs/en/permissions
4. Ask Claude to make a small edit, then ask it to push. Watch the deny rule stop it.
In one sentence
Subagents split the work, hooks make steps automatic, and permission rules set hard limits that the model can't talk its way past.
Which rule would you set first: an allow, an ask or a deny? 👇