An agent prepares a configuration change. The file contains a secret and is about to be sent to a shared repository. A check detects the secret, but runs after transmission. The alert is correct; the information has already left its scope. Deleting the file afterwards neither removes received copies nor makes the secret unknown again.
The problem concerns more than detector quality. It depends on where the check runs, whether it can block and which paths bypass it. Triggering verification and preventing an effect are different properties.
What I call level 4
In my maturity framework, level 3 makes a method available. Level 4 connects work events to controls: before a tool call, after a change or at a defined transition. This personal framework certifies neither a product nor an architecture.
Depending on its environment, a hook can run a deterministic command, query a service or request AI analysis. It is not simply a sentence the model must remember. An environment-triggered program retains its triggering mechanism even when a model mishandles a textual instruction.
Claude Code’s hook documentation distinguishes PreToolUse, before a tool call, from PostToolUse, after execution. A post-execution check cannot retroactively prevent that call. Blocking capability and failure behaviour depend on the event and configured contract.
Move the check before transmission
For our file, a preventive check must examine the content being sent and the actual destination before emission. Its refusal must stop the operation on that path. A check covering another file version or another tool does not establish that protection.
An alert after disclosure can support its treatment. It does not establish that disclosure was prevented.
Failure of the check itself requires an explicit decision. A read error, unavailable service or incomplete result must not become “no secret found”. The process must specify whether the operation remains blocked, what state is retained and which recovery is authorised.
If transmission already occurred, the next steps concern the actual exposure: recipients, accessible copies and treatment of the secret under the applicable procedure. Repeating analysis does not undo the effect.
Event scope matters
A control on a file-writing tool does not necessarily cover a shell command, another connector or a separate process writing the same file. System permissions, protected configuration and mediated outputs remain important.
The actor being controlled should not be able to remove the hook without separate authority. Control configuration and results are themselves resources to protect. A successful detector test does not establish that separation of permissions.
AI can help interpret changes or explain an anomaly. A probabilistic answer still needs defined handling of uncertainty and errors. Automatic invocation does not make it deterministic.
Where Swarm fits
Swarm separates control observations, review decisions and transition conditions. Its Rust validation path binds receipts to the relevant control operations; missing, incomplete or incompatible observations must not become public success.
That mechanism is not a universal secret detector. This case’s check must be defined, run against the right elements and connected to the boundary authorising transmission. It establishes neither confinement of every process nor coverage of every network output.
Level 5 adds task and recovery coordination. Level 6 asks who governs the controls and what evidence establishes their effect. The Swarm source makes those contracts examinable beyond the presence of an alert.