Lesson 3 · Domain 1 — Agentic Architecture & Orchestration (27% of exam)

Hooks: Guaranteed Compliance vs. Probabilistic Guidance

This is the single most-tested distinction in Domain 1, and it shows up disguised in half a dozen different scenarios: a prompt instruction is a suggestion; a hook is a guarantee. Knowing which one a situation actually needs is the skill.

Prompts have a non-zero failure rate

Telling the model in a system prompt that "customer verification via get_customer is mandatory before order operations" will work most of the time. Most of the time is not good enough when the downstream action is a financial one. The official exam guide's own numbers make this concrete: a support agent skips get_customer and calls lookup_order on the customer's stated name alone in 12% of cases — occasionally misidentifying accounts and issuing refunds to the wrong person.

No amount of stronger wording or additional few-shot examples drives that number to zero, because prompt-based compliance is probabilistic by nature. The fix isn't a better sentence — it's removing the possibility entirely.

Programmatic prerequisites

A programmatic prerequisite gate blocks a tool call outright until an earlier one has produced a required result — no model judgment involved:

// Guard executed before any process_refund call is allowed through.
// This is enforced in code, not requested in a prompt.
function canCallProcessRefund(state: { verifiedCustomerId: string | null }): boolean {
  return state.verifiedCustomerId !== null;
}

if (toolCall.name === "process_refund" && !canCallProcessRefund(state)) {
  throw new Error("process_refund blocked: get_customer has not returned a verified ID yet");
}

Hooks: interception at two points

Agent SDK hooks give you the same guarantee at two different moments in the loop:

• Result interception (PostToolUse) — rewrite a tool's result before Claude ever reasons about it. Classic use: normalizing inconsistent data formats coming from different MCP tools.
• Call interception — inspect an outgoing tool call and block it if it violates a policy, before it executes at all.

// PostToolUse hook: normalize timestamp formats before Claude sees them.
// Different MCP tools return Unix epoch, ISO 8601, or locale strings —
// the model shouldn't have to reconcile that itself.
function postToolUse(event: ToolResultEvent): ToolResultEvent {
  if (event.toolName === "lookup_order") {
    event.result.createdAt = normalizeToIso8601(event.result.createdAt);
  }
  return event;
}

// Call-interception hook: block a policy-violating refund before it runs.
function preToolUse(call: ToolCallEvent): ToolCallEvent | Blocked {
  if (call.toolName === "process_refund" && call.input.amount > 500) {
    return { blocked: true, reason: "Refunds over $500 require human approval" };
  }
  return call;
}

When a human takes over mid-process

If a hook blocks an action and escalates, the human agent picking it up usually has no access to the conversation transcript. The handoff has to be self-contained: customer details, root cause, the specific action that was blocked, and a recommended next step — not "see chat history."

Why this matters beyond the exam

Primary source: read Anthropic's Agent SDK overview for the hooks API surface (PostToolUse and related lifecycle events) — this lesson compresses Task Statements 1.4 and 1.5 from the official exam guide, including its own worked example.

Check your understanding

Curious how hook-based interception compares to the MCP-side structured error responses coming up in Domain 2? Ask any time.