CLAUDE.md rules are instructions Claude reads and chooses to follow. If the model is having a bad turn, it might still edit .env even when your CLAUDE.md says not to.
Hooks are different: a PreToolUse hook that exits with code physically blocks the tool call. Exit code allows, and code blocks.
There are hook event types. The ones I use most: PreToolUse fires before a tool call and can block it, while PostToolUse fires after completion.
Stop fires when Claude finishes, and SessionStart fires when a session opens. Configure hooks in ~/.claude/settings.json (global) or .claude/settings.json (project). The matcher field is a regex, so "Edit|Write" catches both write tools.