Safety Hooks Pattern

The Problem

You cant manually check every API call. But you need to ensure no harmful outputs, data leaks, or unintended actions happen.

Solution: Safety Hooks

Hooks are automatic checks that run on every call.

User Input
     |
     v
[Input Validation Hook]
     |         |
     |        (Block if invalid)
     v
[Agent Execution]
     |
     v
[Output Filter Hook]
     |         |
     |        (Block/modify if unsafe)
     v
[Memory Capture Hook]
     |         |
     +----> Save to persistent storage
     |
     v
User Response

Types of Hooks

1. Input Validation Hook

• Check for forbidden words
• Validate JSON/syntax
• Check rate limits

2. Output Filter Hook

• Remove PII (Personally Identifiable Information)
• Block sensitive data (API keys, passwords)
• Format output by schema

3. Memory Capture Hook

• Save every successful call
• Log errors for debugging
• Enable future learning from past

Implementation in n8n

// n8n Function Node - Input Hook
const forbidden = ['hack', 'exploit', 'bypass'];
const input = $input.item.json.message;

for (const word of forbidden) {
  if (input.toLowerCase().includes(word)) {
    throw new Error('Input blocked by safety hook');
  }
}

return $input.item;

Best Practices

• Don't silently ignore hook errors
• Enable logging for audit trail
• Regularly update safety rules
• Reduce false positives with whitelists

Sources

• Anthropic Safety Guidelines