You'll finish with: Nothing spends money or contacts a client unapproved.
Writing is where a connector earns its keep and where it can hurt you. The rule is simple: it can prepare anything, it sends nothing.
Prepare versus send
The rule goes in your CLAUDE.md — it explains why, so Claude cooperates rather than working around it.
The hook makes it hold when Claude gets confused, which it eventually will.
# Connector rules
Reading: no approval needed. Look at anything.
Writing — always drafts, never final:
- Invoices: create as DRAFT. I send.
- Emails: create as DRAFT. I send.
- CRM: notes and stages are fine. Never delete a record.
- Calendar: propose times. I confirm.
If a tool has no draft state, stop and ask me instead.
"If a tool has no draft state, stop and ask" is the important line. Some connectors only do it live. For those, no automation — you do it by hand.
It is also more common than it sounds. Plenty of connectors are read-only, so there is no draft to make and nothing to gate. Xero is one of them — see the next chapter. Check what each connector can actually change before you design a workflow around it.
Ask for something that would normally go out — an email to a client, say. You get a draft you have to send yourself, or Claude stops and asks. Nothing has left the building.
If anything sent, go to Customize → Connectors and set that connector's write category to Blocked now. Fix the gate before you unblock it. And note that a rule in CLAUDE.md is a request, not a lock — the connector's own permission setting is the thing that actually holds.