Hooks: The Agent Control Plane
What Hooks Are
Hooks are pre- and post-execution interceptors attached to agent pipeline steps. They fire automatically at defined points: before a tool is called, after a model generates output, before an action is taken. For security, hooks are the control plane: (1) Input hooks — validate or sanitize retrieved content before it enters the model context. (2) Output hooks — filter or constrain model responses before they reach tool calls. (3) Action hooks — require human approval for high-consequence operations. (4) Audit hooks — write immutable logs of every agent decision, tool call, and data access. A customer asking "how do we enforce policy on our agents?" is asking for hooks, even if they do not use the word.
When to Use Hooks
Use hooks when you need cross-cutting policy enforcement without modifying every agent individually: audit logging, input validation, approval gates, and rate limiting all belong in hooks, not in agent logic. If you find yourself writing the same validation or logging code in multiple agents, you should be writing a hook. Hooks are the difference between security as a product feature and security as an architectural property.
Connectors: The Integration Layer
A connector is the adapter that bridges the agent system to an external tool or API. Where MCP is the protocol and a skill is what the agent calls, a connector is the implementation that makes an external capability MCP-accessible — handling auth, API translation, schema mapping, and error handling toward the external service. In SOAR, connectors were the pain point: every tool needed a custom integration, versioned by your team, broken on every API change. In the agentic world, vendors ship the connector as an MCP server — the Google SecOps MCP server, the GTI MCP server, and the Wiz connector are all connectors the customer does not have to write or maintain. The distinction from hooks: hooks intercept the pipeline between agents and skills; connectors bridge skills to external services. Both are infrastructure — neither belongs in agent logic. SE talking point: when a customer asks "what does it take to connect your agents to my existing tools?" — they are asking about connectors. The answer is: if the vendor ships an MCP server, there is no connector for you to own. If they do not, ask who builds and maintains it. That question immediately exposes the SOAR-era connector tax hiding inside any agentic pitch that does not address it.
Prefer slides, quizzes, and saved progress? Read this lesson in the library — free, no sign-up.