Require a Change-Ticket Reference Before Editing the Model Inventory
An SR 11-7 model inventory is the one artifact every model-risk exam asks for first. This blocks a Write/Edit on the configured inventory path unless a ticket-ID pattern (e.g. MRM-1234) shows up somewhere in the session's own context — a cheap, concrete way to force the real change-control step to happen before the file moves.
1. Save this as the hook script
#!/usr/bin/env python3
"""PreToolUse hook — blocks edits to a model-risk inventory file unless a
ticket-ID pattern is present in the tool input. Wire to Write|Edit."""
import json, re, sys
data = json.load(sys.stdin)
tool_input = data.get("tool_input") or {}
path = tool_input.get("file_path", "")
content = json.dumps(tool_input)
if "model_inventory" not in path.lower():
sys.exit(0)
if not re.search(r"\b[A-Z]{2,6}-\d{2,6}\b", content):
print(f"BLOCKED: edit to {path} has no change-ticket reference "
f"(expected a pattern like MRM-1234) in the tool input.", file=sys.stderr)
sys.exit(2)
sys.exit(0)
Save to a path inside your project, e.g. .claude/hooks/require-ticket-ref-model-inventory-edit.sh, then chmod +x it.
2. Wire it into .claude/settings.json
{
"hooks": {
"PreToolUse": [
{
"matcher": "Write|Edit",
"hooks": [
{"type": "command", "command": "python3 .claude/hooks/require-ticket-ref-model-inventory-edit.py"}
]
}
]
}
}
Before you use this
A hook runs with your local shell's permissions — review the script above before adding it, the same way you'd review any script you didn't write yourself. See our guide on hook security risks for the specific CVEs this category of feature has already produced.
Related hooks