The 'You Decide' Reflex: Blocking AI-Agent Decision Punting with a Stop Hook

The mechanism: an AND-gate on the transcript

A Stop hook fires when the agent is about to end its turn — exactly when the punt lands, because ending the turn is handing control back. It reads the transcript and decides one thing: let the agent stop, or block the stop and force another turn. Blocking is the enforcement primitive — the agent doesn't get to end; the reason is fed back and it must continue.

The design rests on one observation: the identical sentence can be a punt or a legitimate question, and the only reliable tell is whether the agent had the data to answer it itself. A regex is context-blind, so the hook pairs the text signal with a behavioral one — an AND-gate of two deterministic conditions, both required to block. Behavioral first: did the agent gather data recently?

DATA = ("Read", "Bash", "Grep", "Glob", "WebFetch", "WebSearch")

recent_data = False

for e in entries[-10:]:                    # last ~10 transcript entries

    for b in blocks(e):

        if b.get("type") == "tool_use":

            name = b.get("name", "")

            if name in DATA or name.startswith("mcp__"):

                recent_data = True

                break

    if recent_data:

        break

if not recent_data:

    sys.exit(0)   # no data behind the question: legitimate deference, pass

No file read, shell, search, fetch, or MCP call in the window means the agent is asking from genuine ignorance — the one case where deferring is correct. Pass. Only if data was gathered do we check the text:

DEFLECT = re.compile(

    r"(which.*(do|would|should)\s+you.*(think|prefer|choose|pick|want)"

    r"|what.*(do|would|should)\s+you.*(want|prefer|choose|think)"

    # ...plus the same deflection intents in the operator's other working

    # language (Korean, glossed here): "you decide", "please pick one", "what's your opinion".

    r")", re.IGNORECASE)

if not DEFLECT.search(last_text):

    sys.exit(0)

The patterns are the surface forms of punting — "which would you prefer," "you decide," "what are your thoughts." Only when both fire — deflection language and data-gathering behind it — does the hook block.

Designing the false positive away

The AND-gate exists to keep one class of question safe: the genuine value question — because the cure is worse than the disease if overapplied. A hook that blocked every "which do you prefer?" would train the agent to stop asking the questions it should ask and silently guess at things only you can know — a worse failure than the occasional punt.

Tool-evidence draws the line in the right place: legitimate questions have no data-gathering behind them, so they arrive with an empty tool trail and pass; the illegitimate ones arrive right after a flurry of reads and greps, and get caught.

The principle is worth stating: when a rule can't be both safe and complete, bias it toward false negatives. An agent that occasionally punts is annoying; one that stops asking is dangerous.

Forcing a commit, exactly once

Blocking is half the job. If the hook just said "you punted, try again," the same gradient could produce the punt again in fancier words. So the block injects a self-correction scaffold into the next turn:

① Single recommendation: (the one answer you derived, committed to)

② One-line reason: (why this is the best choice)

③ The assumption / condition under which you'd be wrong (preserve correctability)

Line ③ is what makes committing safe: a recommendation with no failure condition is just overconfidence. Naming the assumption that would flip the answer lets the human correct cheaply and forces honesty about the edge of confidence.

Then the valve that makes it survivable: nag-once. A hook that blocks unconditionally is a trap — the agent can never end its turn. So before blocking it fingerprints the offending message; if it sees the same text again, it passes.

fp = sha1(last_text)                        # fingerprint the exact offending response

warned = Path.home() / ".claude/decision-ownership.warned"

seen = warned.read_text().splitlines() if warned.exists() else []

if fp in seen:                              # already nagged about this text

    sys.exit(0)

# state lives on disk — every hook run is a fresh process, an in-memory set would forget

warned.write_text("\n".join(seen + [fp]))   # nag once, then never again for this text

One punt, interrupted exactly once, then the hook steps aside — so whatever comes next, the loop can't form.

The honest limits, and how to tune them

A blunt instrument; be clear about the blade.

• 
  The regex is context-blind. It matches surface phrases, so it misses punts worded outside its patterns — a punt phrased as a statement ("let me know how you'd like to proceed") slips past. Treat it as a living list, not a finished spec.


• 
  Tool-evidence is a proxy. "Could the agent have derived this?" and "did it call a tool in the last ten entries?" only correlate; the ten-entry window is a knob, not a truth.


• 
  It is per-operator-tuned. The phrases are the ones my agents actually use, in the languages I work in; yours differ. This is a pattern — a Stop-hook pairing a text signal with a behavioral one — not a drop-in library.

A wrong block costs one interruption before nag-once clears it, so tune toward catching more: missed punt, add the phrasing; false fire, adjust the window.

Reproducing it

The shape, to port to your own harness:

• A Stop hook that receives the transcript path.


• Scan the last ~10 entries for a data-gathering tool call (read, shell, search, web, MCP), and pull the last assistant text.


• Block only if both fire: a deflection phrase and recent tool evidence. Either missing, pass.


• On block, inject a template demanding one recommendation, a one-line reason, and the condition under which it's wrong — and fingerprint the text so you never block it twice.

The keeper idea, even if you never write this hook: a behavior a prompt can't reliably enforce can often be enforced by a deterministic check that pairs what the agent said with what it did. Words alone are ambiguous; words plus the tool trail are not.

FAQ

Q. What is decision punting in an AI agent?

Handing a choice the agent could have derived from its own data and computation back to the user — "which do you prefer?", "you decide" — instead of committing. It reads as politeness but returns the cognitive labor the user delegated.

Q. Why isn't a system-prompt instruction enough to stop it?

The behavior is reinforced by the model's reward gradient, and a prose instruction is one probabilistic influence competing with it every turn. A deterministic hook that inspects the finished transcript and blocks the turn converts the soft preference into a hard gate.

Q. How does the Stop-hook avoid punishing legitimate questions?

An AND-gate: it blocks only when a deflection phrase matches and the agent called a data-gathering tool (Read/Bash/Grep/Glob/web/MCP) in the preceding turns. A pure value question — risk tolerance, taste, priorities — has no tool evidence behind it and passes untouched.

Q. What does the hook make the agent do instead of punting?

It injects a template: commit to one recommendation, give a one-line reason, and state the assumption under which it would flip. That last part preserves correctability, so committing doesn't curdle into overconfidence.

Q. Won't a Stop-hook that blocks trap the agent in a loop?

No — nag-once. Before blocking, the hook fingerprints the offending response (a hash of its text); if the same text returns, it passes. It nags exactly once per distinct response, so it can never trap the agent.

More notes at hexisteme.github.io/notes.