A preToolUse hook evaluates the proposed command before the shell tool executes it. The hook can inspect command arguments and return permissionDecision: "deny" when a pattern indicates a high-risk operation, while allowing low-risk commands to continue automatically.
This is the correct enforcement point because the requirement is preventive. A policy banner only informs the user or agent; it cannot block execution. Logging submitted prompts provides audit information but does not evaluate the actual shell command. Ignoring the hooks directory simply removes the repository-scoped enforcement mechanism.
The hook should use precise matching rules. For example, it can deny sudo, destructive recursive deletion, and piping untrusted remote content into a shell, while allowing commands such as git status, package metadata inspection, and test execution. Rules should avoid broad string matching that blocks harmless commands merely because they contain similar text.
Study-guide topics: pre-execution guardrails, shell-command approval, policy enforcement, and autonomous tool safety. Reference: GitHub Copilot-Hooks reference.