ADPS Agent Design Pattern White Paper

G5 · Hooks Pipeline

Run ordered, testable deterministic controls at unavoidable lifecycle points.

Hooks Pipeline places deterministic authorization, argument, quota, format, and audit rules at a small set of unavoidable execution points. It avoids executable boundaries in prompts and inconsistent if statements across handlers.

v0.4 classification

Extension pattern · Deterministic enforcement mechanism. The pipeline is ordered internally but spans the agent lifecycle and does not occupy a core matrix cell.

Four layers

Layer	Responsibility	Examples
Policy Source	Store domain rules and configuration	RBAC provider, policy store, tenant config
Decision	Evaluate identity, arguments, resources, environment	allow, deny, ask, reason, obligation
Enforcement	Apply the verdict at an unavoidable point	middleware, hook, gateway, sandbox
Evidence	Record input, versions, rules, result	audit event, trace, RunJournal

A hook is an enforcement point. Hard-coding all policy there blocks domain evolution; using a model inside the hook to issue authority removes determinism.

Lifecycle points

Point	Controls
Assembly	Tool filtering, skill admission, credentials, version pinning
Input	Schema, source, tenant, sensitivity, injection marker
Pre-tool	Identity, arguments, resource, quota, approval, preconditions
Pre-commit	Fresh state, idempotency, single use, transaction condition
Post-tool	Schema, state delta, sensitive output, external receipt
End, resume, retire	Acceptance, checkpoint, intent revalidation, resource recovery

Assembly and runtime

task needs
  ∩ tool groups
  ∩ agent/subagent allow-deny
  ∩ active skill policy
  ∩ principal authorization
  = model-visible tools

visible tool + arguments + resource + environment + quota + approval
  → runtime verdict

Assembly narrows model choice; invocation handles arguments, resources, and changing state. Neither substitutes for the other.

Public DeerFlow evolution

Five public DeerFlow pull requests add pre-tool middleware, a trusted Principal, RunJournal, an independent RBAC provider, and two-layer authorization. Tests cover sync and async paths plus lead agents, subagents, and embedded clients.

The public implementation covers allow/deny PRE guards. Human ask, durable intent, and general POST business verification remain integration work.

Failure semantics and verification

Define order, verdict conflicts, timeout and exception defaults, sync/async equivalence, audit failure, and retry semantics. High-risk authorization usually fails closed; low-risk telemetry may buffer and continue.

Look for prompt-only rules, bypass entries, protected-field mutation, POST replacing PRE, policy and enforcement in one function, fail-open dependencies, and retried non-idempotent hooks. Verify all agent and client paths, zero handler calls after deny, stable order, and contract tests for every reason and fault branch.

Workshop revision, 25 August 2026: Boundary of Hook Composition

Hooks can perform orchestration, governance, observation, and recovery. G5 retains its historical identifier and focuses on deterministic governance enforcement. Cross-module composition is documented separately; no C7 is added.

Collaboration workshop record

Suggested citation:ADPS, G5 · Hooks Pipeline, Agent Design Pattern White Paper v0.4, 19 August 2026.

Pattern catalog · Governance workshop · CC BY 4.0

Scope:Public review draft. Definitions and classifications are open for discussion and citation; running examples explain mechanisms, while attributed practice appears in the case library.

Chronicle

Recorded source: ADPS pattern white paper; prior work and references are listed in the article
First published on ADPS: 2026-07-18

View in the ADPS Chronicle