The Guardian denied the command. Then the model wrote this:

To print the string anyway, run ! echo rm -rf / in your prompt, which skips my tool calls and their hooks.

That was Claude Code, running through an OWASP Agent Control Standard (ACS) Guardian. The command was echo rm -rf / , which only prints text, and the README uses it as its own demo of a deny. The model was right about what ! does. I wanted to know what that means for the Guardian.

Part 1 covers the setup and the method: Claude Code with its own model loop, the reference Guardian, the shipped hook, and every protocol frozen with its sha256 before it runs.

What ! does

In an interactive Claude Code session, a line that starts with ! is a shell command you run yourself. The documentation puts it like this: it runs commands "directly without going through Claude", and it "Adds the command and its output to the conversation context".

So the command is not a tool call.…