hook != security boundary

matcher → if → handler

workflow policy -------- ------ formatting force-push protection logging production writes nudging secrets context destructive operations

hooks permissions.deny