Claude Agentic Coding Playbook

Agentic Coding Playbook

Evidence-based practices for LLM-assisted software development. Built for Claude Code. The principles in best-practices.md are conceptually portable, but all hooks, skills, and scripts target Claude Code specifically.

Why This Exists

AI-assisted code contains 1.7x more issues than human-written code and introduces 10x more security findings in enterprise settings. Developer productivity gains range from -19% (experienced OSS developers) to +55% (controlled tasks) depending on task type, tool, and developer experience. The practices in this playbook are designed to capture the upside while mitigating the documented risks.

Key findings from the research:

Full details with citations: docs/best-practices.md

How This Works

Most Claude Code setups rely on CLAUDE.md instructions alone. Instructions are advisory — compliance ranges from ~50-90% in our testing (published research reports lower rates for complex instruction sets). This playbook takes a different approach:

- Designed for bypass mode. The biggest productivity gains come from running Claude Code autonomously (--dangerously-skip-permissions or bypassPermissions in settings). Without guardrails, bypass mode means no safety net — destructive commands, runaway file creation, and context exhaustion go unchecked. With this playbook's hooks, you get deterministic enforcement of safety rules even when the agent has full permissions: prompt injection is blocked, context limits are enforced, destructive git operations are caught, and PII is redacted — all without permission prompts interrupting flow.
- Hooks enforce rules deterministically. 35+ hooks — each fires on the relevant tool calls (not all on every call) — catching context exhaustion, prompt injection, sycophantic compliance patterns,…