Require a Reviewer Field on a Compliance-Tagged Task Before Completion
Scoped specifically to tasks tagged compliance/SOX (distinct from the deploy-tagged guard in Production Guardrails) — this makes sure a task in that category is either closed by a human directly or carries an explicit reviewer tag, never auto-closed by the tool that opened it.
1. Save this as the hook script
#!/usr/bin/env python3
"""TaskCompleted hook — blocks auto-completion of a compliance/sox-tagged
task without a reviewer tag."""
import json, re, sys
data = json.load(sys.stdin)
task = data.get("task") or {}
text = f"{task.get('title', '')} {task.get('description', '')}"
auto_triggered = data.get("was_triggered_by_tool", False)
if re.search(r"(?i)\b(compliance|sox)\b", text) and auto_triggered and not re.search(r"(?i)reviewer:", text):
print("BLOCKED: this compliance/SOX task was completed by a tool call, "
"not a human, and has no reviewer: tag.", file=sys.stderr)
sys.exit(2)
sys.exit(0)
Save to a path inside your project, e.g. .claude/hooks/require-reviewer-field-compliance-task.sh, then chmod +x it.
2. Wire it into .claude/settings.json
{
"hooks": {
"TaskCompleted": [
{
"hooks": [
{"type": "command", "command": "python3 .claude/hooks/require-reviewer-field-compliance-task.py"}
]
}
]
}
}
Before you use this
A hook runs with your local shell's permissions — review the script above before adding it, the same way you'd review any script you didn't write yourself. See our guide on hook security risks for the specific CVEs this category of feature has already produced.
Related hooks