Out of the box, memory-lock gates the common destructive verbs — delete, money, reset, credentials, bulk. But your business has its own “don’t do this without me” moments: retract a post, merge a channel, bill a client. You don’t need an update for that. Here is how to bring your own actions under the same gate — done on your side, nothing changes on the server.
There are two different steps in the loop:
detect_high_risk_action suggests “this looks risky, should you gate it?” — it runs locally against a built-in list.verify_dynamic_code authorises — it checks that a real person approves before you proceed. It doesn’t care about the wording of the action at all.The simplest path — no files to edit. When you first ask your AI to watch a specific action, state the rule yourself:
From now on, treat “retract a post” as a high-risk action. Before you retract a post, show me exactly what you are about to do, call verify_dynamic_code, and only proceed if I give you the current 6-digit code from the memory-lock mini program.
Most assistants keep this in the session while it stays open. To make it persist across sessions, move it one level deeper (next).
So the rule survives restarts, put it where the client reads standing rules:
CLAUDE.md / project memory file read at the start of each session.clinerules) or a system/persona promptSTANDING RULE — my high-risk watch-list: retract a post, merge the upload folder, bill a client. For any of these: pause, show the command, call verify_dynamic_code, and run only after my 6-digit code passes. Never treat a watch-list action as “safe” just because it is not in the built-in detector.
If it just runs: your wording didn’t stick. Restate it (Step 1) in the same sentence, and check Step 2 actually loads before the session.
默认情况下，记忆之锁能把常见的破坏性动词挡住——删除、资金、重置、权限、批量。但你的业务总有自己「没我点头不许做」的时刻：撤回投稿、合并渠道、给客户开账单。这些你不需要等一次更新。下面讲怎么让你的专属动作也走进同一条闸 —— 全程在你本机做，服务器端什么都不用动。
这套流程里其实是两步，性质不一样：
detect_high_risk_action 负责建议：“这看着有风险，要不要拦？”——它在本地对着内置清单判断。verify_dynamic_code 负责授权——它只确认「是不是有真人在放行」，根本不在乎动作本身用的是什么词。最快的方式——一个文件都不用改。第一次让 AI 盯某个专属动作时，自己把规则说清楚：
从现在起，把「撤回投稿」当作高危操作。 撤回一篇投稿前，先把你准备做什么完整列给我， 调用 verify_dynamic_code 校验，只有我从小程序 报出当前 6 位动态口令并通过，你才能执行。
多数助手会在当前会话里一直记得它。想让它在重启之后仍然有效，就再往下放一层（见下一步）。
让规则扛得住重启，把它放进客户端每次都会读的「常驻规则」里：
CLAUDE.md 或项目记忆文件，会话开始时读取.clinerules）或系统/人格提示词常驻规则 —— 我的高危关注清单： 撤回投稿、合并上传文件夹、给客户开账单。 碰到以上任一动作：先暂停，列出要执行的命令， 调用 verify_dynamic_code，只有我的 6 位动态口令 通过才能动手。绝不要因为某动作不在内置词库里， 就当它是「安全」的直接执行。
要是它直接就干了：说明你的话没被记住。用第 1 步的原话重说一遍，并检查第 2 步的设置确实在这个会话开始前加载了。