You are building a customer support resolution agent using the Claude Agent SDK.

A mandatory compliance threshold must be enforced outside probabilistic model reasoning. A PreToolUse hook can inspect every attempted process_refund call before execution, compare its amount with the $500 threshold, and deny the call when the limit is exceeded. The host application can then create the human-escalation case using the validated customer and order context.

Anthropic describes hooks as deterministic controls that ensure required actions occur instead of relying on the model to choose them. Agent SDK documentation confirms that a single denying PreToolUse hook blocks the tool call, including MCP tools matched through their qualified tool names. ( https://docs.anthropic.com/en/docs/claude-code/hooks-guide )

Options A and B improve expected behavior but cannot guarantee compliance. The stated production failure rate demonstrates that prompting alone is insufficient. Option C prevents the refund from completing, but the subsequent escalation still depends on Claude correctly interpreting the returned error and invoking the human tool. It therefore enforces the financial block but not the complete escalation requirement.

Option D enforces both sides of the policy at the orchestration boundary: deny the unauthorized action and route the case to an approved human process. The escalation action should be idempotent and auditable.

Official references/topics: PreToolUse hooks, deterministic policy enforcement, MCP tool interception, human-approval controls.