Known Limitations
For CISOs: where our agent governance ends, your controls begin. ADLC enforces agent behavior deterministically in 5 domains (git mutations, cloud APIs, secrets, test results, and compliance logs). This page documents five structural limits where enforcement is advisory-only — your security team must own the residual control. Knowing these boundaries lets you sign off confidently: you understand exactly where agent guardrails are deterministic vs. rule-based, and where human approval remains essential.
Five structural limits of Claude Code and AI agents. Transparency earns trust. These are cited from official documentation — neither hidden nor exaggerated.
Text output is not hookable
Agent text responses bypass enforcement hooks. Rules provide advisory guidance, not deterministic blocking.
Source: code.claude.com/docs/en/hooks
CLAUDE.md is advisory
Instructions shape behavior but are not a hard enforcement layer. Hooks provide deterministic enforcement.
Source: code.claude.com/docs/en/memory
Subagents get frontmatter only
Specialist agents receive only their system prompt, not the full ADLC governance context. The orchestrator holds governance; specialists get role-specific guidance.
Source: code.claude.com/docs/en/sub-agents
Context degrades at ~95% fill
Long sessions lose instruction adherence. Mitigated by /compact and subagent delegation.
Source: code.claude.com/docs/en/best-practices
Subagent max depth = 1
Agents cannot spawn sub-agents. The orchestrator coordinates all specialist work.