CCAR-P Questions and Answers

The 80,000-token filing is a large, stable prefix reused across fourteen requests, making prompt caching the strongest optimization. The first request creates the cache; subsequent identical-prefix requests use lower-priced cache reads while retaining the complete filing, preserving the evidence available to Claude. Anthropic documents cache reads at a fraction of standard input cost and confirms that caches are isolated by organization and, on supported platforms, by workspace. Cached representations remain in memory rather than persistent storage. Options A and C may omit context through summarization or retrieval and therefore require additional quality evaluation. Option D lowers unit cost but may reduce reasoning quality. The design must preserve prefix identity, choose an appropriate TTL, and verify the tenancy configuration.

Study Guide references/topics: Prompt caching; cache isolation; stable prefixes; long-document analysis; cost optimization.

Federated authorship allows each domain team to maintain the procedural knowledge it understands while preserving organization-wide trust through a central publication gate. Team authors can update coding standards, review practices, and postmortem procedures without waiting for a single platform group to write every change. Central reviewers can validate ownership, security, tool permissions, duplication, versioning, testing evidence, and compliance before publication. Per-developer or fully decentralized publication creates inconsistent and potentially unsafe Skills. Fully centralized authorship becomes a scalability bottleneck and separates content maintenance from domain expertise. Anthropic describes Skills as packages of instructions, scripts, and resources and warns that repository Skills may grant broad tool access, making formal review essential. Claude Code Skills

High-impact AI-supported decisions must retain clearly assigned human accountability. Claude may provide recommendations, classifications, or generated content, but responsibility for consequential outcomes cannot be transferred to the model. An ethics review should also investigate whether outputs make unsupported generalizations about individuals or groups, because such behavior can produce discriminatory, misleading, or harmful outcomes. Therefore, B and E directly address ethical accountability and fairness. Licensing in option A is an important legal and procurement concern, but it is not the strongest ethics-focused control presented. Latency and throughput in option D are operational performance requirements. Option C is inappropriate because ethics risks are not limited to outputs above a confidence threshold; confidence values may also be poorly calibrated and do not prove that an output is fair, accurate, or ethically acceptable.

================

An ADR must preserve not only the selected decision but also the context, alternatives evaluated, and trade-offs consciously accepted. Without this information, future engineers cannot determine whether the decision remains valid after requirements, Claude models, costs, security controls, or integration capabilities change. Option B completes the record while retaining the valid technical detail already documented. Option A destroys useful evidence and replaces durable documentation with unreliable organizational memory. Option C produces an incomplete record that cannot support audits, onboarding, or later architectural review. Option D changes the decision without evidence or a decision-making process. For Claude solutions, ADRs should typically capture the chosen model and integration pattern, rejected alternatives, evaluation evidence, security implications, operational consequences, and conditions that would trigger reconsideration.

================

The procedure should have one authoritative implementation and one accountable owner. Packaging it as a compliance-owned Skill allows the instructions, examples, templates, and prohibited patterns to be maintained together. Referencing that same Skill from all three workflows ensures that updates propagate consistently without requiring separate prompt changes. Embedding copies in multiple system prompts or allowing workflow teams to rewrite the procedure creates configuration drift and inconsistent regulatory behavior. A retrieval corpus is appropriate for searchable reference material, but the requirement concerns a fixed operational procedure that Claude must follow, making a Skill the stronger abstraction. The Skill should be versioned, reviewed, tested, and released through a controlled publication process. Claude Code Skills

Claude Code constructs the model context before the first user message. That initial context can include the system prompt, project instructions, subagent configuration, MCP server instructions, and tool definitions expressed as JSON schemas. When numerous MCP servers expose many tools and Tool Search is disabled, those schemas must be loaded upfront. A large collection of verbose tool descriptions and parameter schemas can therefore consume tens of thousands of tokens before the engineer enters any text.

Tool Search is specifically designed to prevent this form of context inflation. With Tool Search enabled, Claude initially receives only server instructions and compact tool-identification information; full tool schemas are deferred until a relevant tool is discovered and required. Anthropic consequently describes Tool Search as the mechanism for keeping MCP context consumption low as integrations scale.

Keyboard layouts, font rendering, and display scaling operate outside the language-model context and cannot generate API input tokens. Likewise, model behavior does not silently reserve 50,000 tokens for personal preferences. The diagnostic action is to inspect configured MCP servers and tool counts, determine whether Tool Search has been disabled, and remove or defer unnecessary definitions.

Study Guide references/topics: [MCP Tool Search and context scaling](https://docs.anthropic.com/en/docs/claude-code/mcp); MCP server configuration; subagent context budgeting; tool-schema optimization.

===============

Robust guardrails require both preventive enforcement and continuous empirical validation. Per-role tool allow-lists satisfy the preventive requirement by restricting each authenticated role to explicitly authorized tools. Enforcement must occur in the orchestration or permission layer before execution; relying on the model to decide whether a tool call is authorized is not an adequate security boundary. Anthropic recommends allow-list-based validation and provides permission rules and pre-tool-use controls capable of denying calls before they execute.

Adversarial evaluation with regression tracking supplies the validation component. The evaluation set should include prompt injections, indirect injections, encoded instructions, multi-turn escalation, role-confusion attempts, and requests designed to trigger unauthorized tool use. Guardrail performance must then be measured across releases so that changes to prompts, models, tools, or orchestration logic do not silently reduce protection.

Centralized logging and user feedback are useful detective and lifecycle controls, but neither prevents an unsafe action nor proves guardrail effectiveness. Periodically refreshing refusal wording is also insufficient unless the revised behavior is evaluated against defined safety criteria. The strongest design therefore combines deterministic authorization with adversarial regression testing.

Study Guide references/topics: Claude Code permissions and pre-tool enforcement; tool allow-list guidance; adversarial evaluations; regression testing; least-privilege orchestration.

===============

Executive sponsors generally need architecture decisions translated into business significance. The briefing should explain what outcomes the retrieval architecture enables, why the chosen approach is valuable, which material trade-offs were accepted, and what major risks require awareness or sponsorship. This allows the executive to assess strategic alignment, investment value, and organizational exposure without becoming immersed in component-level implementation details. Option A is more appropriate for architects and engineering teams conducting a technical review. Option C is primarily suited to product and program stakeholders managing features, scope, and roadmap dependencies. Option D is designed for security, compliance, and risk-governance audiences requiring detailed control evidence. Although those perspectives remain important, option B provides the concise, outcome-oriented framing needed for an executive architectural decision summary.

================

Requirements must first establish what the capability is expected to accomplish, who will use it, and which constraints bound the solution. Option B captures the business purpose, success criteria, and intended user population. Option E identifies critical non-functional requirements that will influence model selection, integration patterns, deployment boundaries, evaluation design, and operational controls. These inputs must exist before stakeholders can validate whether the captured requirements accurately represent their needs. Architecture decision records are produced after meaningful alternatives and design decisions exist. Detailed traceability is important but follows the initial elicitation and consolidation process. Rollout scheduling occurs later, after requirements and architecture have been validated. Anthropic likewise recommends defining measurable success criteria and empirical evaluation methods before optimizing prompts or finalizing the implementation. Anthropic: Prompt engineering overview

================

Adversarial tests directly evaluate behavior under attack, including prompt injection, malformed records, malicious document content, credential-extraction attempts, and unauthorized tool requests. Integration tests provide the complementary coverage required by the question: they verify authentication, retrieval, prompt construction, model invocation, validation, logging, and downstream actions as one end-to-end system. Regression, smoke, and unit testing remain valuable, but they do not jointly satisfy the two stated objectives. A stable regression set measures previously established behavior; smoke tests provide shallow availability confirmation; and prompt-rendering unit tests cover only one component. Anthropic recommends explicit prompt-injection defenses and task-specific evaluations that represent both normal and edge-case traffic. Prompt-injection mitigation

The prompt contains mutually incompatible behavioral requirements. The architect should resolve the contradiction explicitly so the model receives one coherent grounding policy. If the application requires source-supported answers, the prompt should prohibit unsupported completion, permit an insufficient-evidence response, and require citations or supporting passages. Adding another priority instruction leaves the underlying conflict in place and creates ambiguity about when speculation is permitted. Increasing temperature makes behavior more variable rather than more correct. Retaining both instructions produces inconsistent outputs across requests and model versions. Anthropic recommends clear, direct, specific prompting and notes that conflicting project instructions can cause Claude to select among them unpredictably. Prompting best practices; project-instruction troubleshooting

An operational SLA must be objectively measurable and enforceable. Option B defines the metric, percentile, threshold, and observation window, allowing both parties to determine whether service performance complied with the agreement. A complete SLA also defines what follows a breach, such as escalation, remediation, service credits, capacity changes, or architectural review. Percentile latency is preferable to an average because it exposes degraded tail performance experienced by a meaningful portion of users. Anthropic provides usage, cost, and operational data that can support monitoring and alerting through the Usage and Cost API. Options A and C are subjective. Option D remains incomplete because neither assessment periods nor breach handling can be applied consistently.

Study Guide references/topics: SLA construction; p95 latency; thresholds; evaluation windows; breach consequences; operational measurement.

A dedicated subagent is justified when specialization is recurring and operationally valuable. Option A allows the team to encode a database-review role once, including its system prompt, triggering description, permitted tools, model, and review criteria. This improves consistency across sessions, isolates specialized context, and applies least privilege by withholding unrelated capabilities. Anthropic’s custom subagent documentation supports task-specific prompts, model selection, tool allowlists, permission modes, hooks, skills, and persistent memory. A one-time question does not justify the maintenance overhead of a reusable agent definition, while Options C and D explicitly provide no specialization requirement. The subagent should also have clear invocation conditions, evaluation cases, ownership, and lifecycle review.

Study Guide references/topics: Claude Code subagents; task specialization; context isolation; model routing; scoped permissions; reusable automation.

Option C addresses both components responsible for the excessive cost. Anthropic prompt caching allows stable, repeatedly submitted prompt material—such as system instructions, tool definitions, and reusable background information—to be placed in a consistent prefix. After that prefix is written to the cache, qualifying subsequent requests can reuse it at the lower cache-read cost instead of repeatedly processing the same content at the standard input-token rate.

Retrieval must be optimized separately. Supplying an entire document collection or excessively deep search results increases cost, consumes context capacity, and may reduce answer quality by surrounding the relevant evidence with distracting material. Retrieval should select the smallest set of authoritative passages that provides sufficient evidence for the current query. This typically requires relevance scoring, deduplication, metadata filtering, reranking, and explicit token-budget limits.

Increasing retrieval depth or expanding the repeated system prompt directly worsens the identified cost driver. Moving every request to a heavier model changes the unit economics but does not correct inefficient context construction. The recommended optimization therefore combines prefix caching with query-specific context pruning, followed by evaluation to confirm that reduced context does not lower task accuracy.

Study Guide references/topics: [Prompt caching](https://docs.anthropic.com/en/docs/build-with-claude/prompt-caching); [effective context engineering] (https://www.anthropic.com/engineering/effective-context-engineering-for-ai-agents); retrieval precision; token-cost analysis; cache-prefix stability.

===============

Sound human-in-the-loop design places review before a high-impact or irreversible action occurs. The reviewer must receive sufficient context and explicit approval criteria so that the checkpoint functions as a meaningful control rather than a ceremonial step. This is especially important when Claude outputs could initiate financial transactions, publish sensitive material, alter access rights, affect employment decisions, or trigger other consequential actions. Option A provides only retrospective auditing and cannot prevent harm. Option C may support monitoring or quality measurement, but random sampling does not protect every case that requires mandatory approval, particularly when review criteria are undefined. Option D removes the accountability and intervention mechanism entirely. Therefore, B provides the strongest design by combining risk-based placement, human authority, and clearly defined verification requirements before execution.

Risk-stratified sampling concentrates limited reviewer capacity where error consequences and uncertainty are greatest. All low-confidence and high-impact cases should receive mandatory review, while random sampling of routine high-confidence outputs provides an unbiased signal for drift, unexpected failure modes, and overconfident errors. Complaint-only monitoring discovers defects after harm occurs. Reviewing only high-confidence cases systematically ignores the most dangerous outputs. Universal review provides maximum coverage but contradicts the stated throughput constraint and may create queues that undermine service objectives. The sampling policy should define confidence calibration, impact categories, escalation thresholds, review SLAs, and periodic adjustment based on observed error rates. Reviewer decisions should feed the evaluation dataset so monitoring quality improves over time.

Progressive tool discovery preserves the complete capability catalog while limiting initial context to a curated set of common tools and a discovery mechanism. When the task requires an additional capability, Claude searches the catalog and loads only the relevant tool definitions.

Anthropic’s Tool Search mechanism implements this pattern through deferred loading. The context initially contains the search tool and any deliberately non-deferred tools; relevant definitions are expanded only when discovered. This reduces token consumption and helps maintain tool-selection accuracy in large catalogs. Tool Search Tool

Option B adds a model call and still repeatedly processes all definitions, increasing latency and cost while potentially losing important schema details. Option C treats a larger context window as permission to waste context and does not address time-to-first-response overhead. Option D reduces capability breadth because the fixed five tools may be irrelevant to a given task.

The architect should provide clear tool and server descriptions, define which high-frequency tools remain immediately available, and evaluate discovery recall, selection accuracy, latency, and context savings across representative workflows.

Study Guide references/topics: Progressive discovery; deferred tool loading; MCP scaling; context optimization; tool-selection accuracy; on-demand capability loading.

===============

Persist the validated output for downstream consumption and audit — Output Handling

Order prompt sections so cacheable content appears before per-request content — Prompt Construction

Summarize prior conversation history when full history is no longer needed — Input Preparation

Validate the model’s structured output against the expected schema — Output Handling

Move stable repeated content into a cacheable prefix at the beginning of the prompt — Prompt Construction

Trim retrieved passages to spans relevant to the user’s question — Input Preparation

Input preparation determines what evidence and history should enter the request, so summarization and retrieval trimming belong there. Prompt construction determines ordering and cache boundaries; stable repeated instructions must precede dynamic per-request content to maximize cache reuse. Output handling begins after generation and includes schema validation, persistence, auditing, and downstream delivery. Mixing these responsibilities creates inefficient prompts and weak validation boundaries. Anthropic’s context guidance emphasizes curating the smallest useful context because unnecessary tokens can reduce recall and accuracy. Prompt caching similarly depends on a stable reusable prefix, while structured outputs or schema validation protect downstream systems from malformed responses. Context windows; prompt caching

A shared project settings file is intended to be committed so that team-level configuration can travel with the repository. Consequently, it must never contain API keys, access tokens, passwords, or comparable secrets. Credentials should be injected at runtime through an approved secret-management mechanism, environment-specific credential provider, or delegated authentication flow. This separates distributable configuration from sensitive authentication material and supports rotation, revocation, auditing, and least privilege. Options A and B concern configuration precedence rather than secret handling. Option D is incorrect because MCP server definitions may legitimately be stored in project configuration; only their sensitive credential values must remain outside version control. Because the key was exposed, the operational response should also include immediate revocation or rotation and investigation of repository history. Claude Code: Settings files and precedence

================

The network-boundary requirement is a mandatory architectural constraint; therefore, Option D must be resolved before evaluating operational savings. Managed infrastructure can reduce responsibility for agent loops, sandboxes, session state, recovery, and orchestration, but those advantages are immaterial if financial data leaves the approved boundary. Anthropic describes Claude Managed Agents as a hosted agent harness and provides configurable data-residency controls. The architect must still validate inference location, session persistence, encryption, subprocessors, credential handling, auditability, and deletion behavior against the organization’s exact security policy. Options A, B, and C affect migration effort or economics, but they cannot override a non-negotiable data-governance requirement.

Study Guide references/topics: Architectural constraints; managed versus self-hosted agents; data boundaries; residency; security-gated decision-making.

Input Preparation reduces the amount of unnecessary information before the request is assembled. Summarizing older conversation history and trimming retrieved passages preserve relevant context while reducing token consumption. Prompt Construction determines how prepared content is organized for the model. Stable instructions and repeated reference material should appear in a cacheable prefix, while variable per-request content follows afterward, improving prompt-cache reuse and lowering processing cost. Output Handling begins after Claude generates the response. Structured output must be validated against the required schema before downstream systems consume it. Once validated, the result can be persisted for later processing, audit, or compliance purposes. Correctly separating these tactics prevents validation and persistence from being confused with input optimization while ensuring that caching decisions are implemented during prompt assembly rather than during retrieval or post-processing.

Observation 1 is a direct efficiency improvement because the time required for one summarization task fell substantially. Observation 2 shows that local time savings have not yet translated into higher organizational productivity or billable output. Observation 3 is explicitly a solution-cost problem caused by unnecessary API calls. Observation 4 introduces additional human correction time and therefore partially offsets the gross efficiency gain reported in Observation 1. Option D is the only answer that keeps these value dimensions distinct. Measuring only generation speed would overstate realized value because review effort, retry costs, and downstream output must also be included. A valid post-deployment assessment should calculate net cycle time, cost per accepted summary, correction rate, and resulting business output.

A direct call to the existing stable HTTP endpoint is the simplest mechanism that satisfies the stated requirements. The interaction is stateless, requires only one tool invocation, and has a strict latency objective. Adding session management, message-bus translation, or another model-mediated agent would introduce unnecessary network hops, operational dependencies, failure modes, and processing latency.

The assistant’s tool implementation should validate input parameters, authenticate through a server-side credential mechanism, apply narrowly scoped authorization, set explicit timeouts, and validate the pricing response before returning it to Claude. Credentials must never be supplied by or exposed to the model. Appropriate logging should capture request attribution, endpoint outcome, and timing without unnecessarily recording sensitive data.

Anthropic describes the Claude API as a RESTful interface and supports custom tools in which the application executes the requested function or API operation. Claude API Overview, Tool Use Overview

MCP could be justified when standardized discovery or reuse across clients is required, but the scenario already supplies a stable API and does not establish that additional requirement.

Study Guide references/topics: Protocol selection; direct API integration; stateless calls; latency minimization; scoped credentials; avoiding unnecessary agentic complexity.

===============

Model identity and version are essential diagnostic dimensions. Without them, operators cannot correlate a behavioral change with a model migration, reproduce the conditions of a failed turn, compare performance among model versions, or distinguish model drift from prompt, retrieval, and application defects. Therefore, the omission described in Option D is a genuine observability gap.

Option E is equally significant. A multi-agent execution normally crosses orchestration, model, agent, MCP, and tool boundaries. If the request-scoped correlation identifier or distributed trace context is lost at any boundary, the resulting spans cannot reliably be reconstructed into one end-to-end transaction. Anthropic’s monitoring guidance explains that distributed tracing links a user prompt to the API requests and tool executions it initiates; it also documents propagation of W3C trace context to supported subprocesses and outbound MCP requests. Claude Code Monitoring

Options A and B describe healthy telemetry coverage rather than gaps. Option C is also appropriate because recording tool interactions supports investigation, while redaction reduces the risk of exposing sensitive data in logs.

Study Guide references/topics: Integration—observability challenges at scale; distributed tracing; correlation identifiers; model-version attribution; privacy-aware tool telemetry.

===============

Transaction value is only one component of risk. Even a small refund can create fraud exposure, discriminatory outcomes, contractual violations, account compromise, policy inconsistency, or cumulative financial loss. Delegation should therefore depend on the nature, detectability, reversibility, and aggregate impact of failure—not a monetary threshold alone. Option B supports risk-stratified automation: routine, well-evidenced cases may proceed automatically, while anomalous, identity-sensitive, disputed, or policy-edge cases require review or escalation. Anthropic’s trustworthy-agent principles emphasize maintaining meaningful human control rather than imposing universal review or unrestricted autonomy. Option A is unnecessarily absolute; Option C prioritizes efficiency over governance; and Option D prohibits potentially safe, controlled automation without risk analysis.

Study Guide references/topics: Delegation competency; human control; risk classification; reversibility; cumulative exposure; escalation design.

Iteration is an evidence-driven lifecycle phase. Option D combines three essential inputs: production telemetry, sampled output evaluation, and stakeholder feedback. Telemetry exposes latency, cost, errors, tool failures, retrieval behavior, and operational anomalies. Output sampling identifies quality, safety, grounding, or consistency failures that infrastructure metrics may not reveal. Stakeholder feedback establishes whether the system continues to satisfy real business and user needs.

The architect should prioritize the highest-impact validated problem, define the intended improvement, and test the proposed change against the existing evaluation framework and reference set. Anthropic emphasizes that evaluations make behavioral changes visible before they affect users and that their value compounds throughout an agent’s lifecycle. Demystifying Evals for AI Agents

Option A replaces targeted iteration with unnecessary redesign. Option B incorrectly treats deployment as the end of measurement. Option C removes the baseline needed to distinguish genuine improvement from regression or noise.

A mature iteration cycle preserves evaluation continuity, adds production failures as new test cases, validates changes offline, conducts controlled rollout, monitors results, and updates documentation and known limitations.

Study Guide references/topics: Production iteration; telemetry; sampled evaluation; stakeholder feedback; regression testing; evaluation continuity; change prioritization.

===============

The required control is best implemented through layered prevention. The system prompt should explicitly classify personalized investment recommendations as out of scope, instruct Claude not to recommend particular securities or transactions, and provide standardized refusal language. Fixed refusal behavior reduces ambiguity and gives the model a clear alternative response when users request prohibited advice or attempt to reframe it indirectly.

An output classifier supplies an independent enforcement layer after generation but before delivery. It should detect prohibited recommendation language, individualized buy-or-sell instructions, portfolio allocations, and equivalent regulated content. A detected violation must block or replace the response rather than merely record it. This protects against prompt circumvention, unexpected phrasing, and occasional model noncompliance.

Increasing temperature makes responses less predictable and weakens control reliability. Session-length limits regulate volume, not content. SIEM logging is valuable for monitoring, investigation, and compliance evidence, but it is detective rather than preventative: the prohibited recommendation may already have reached the customer.

The completed design should evaluate both layers using adversarial prompts, paraphrases, multi-turn escalation, and classifier false-negative testing.

Study Guide references/topics: [Mitigating jailbreaks and prompt injections](https://docs.anthropic.com/en/docs/test-and-evaluate/strengthen-guardrails/mitigate-jailbreaks); layered guardrails; explicit scope boundaries; standardized refusals; output classification; pre-delivery enforcement.

===============

A constrained retrieval-augmented generation architecture best satisfies the grounding, citation, latency, cost, and audit requirements. The system first indexes the approved internal policy corpus. At request time, it retrieves a small set of relevant passages, supplies those passages to Claude with stable source identifiers, and requires the answer to cite the supporting material. Anthropic’s search-result content blocks are specifically designed for this pattern: they allow custom RAG systems to provide source-attributed internal content and enable Claude to render citations against those results.

The retrieval boundary is critical. Only approved and version-controlled policy sources should be searchable, with document identifiers, effective dates, access controls, retrieval scores, and cited passages retained for audit reconstruction. This produces substantially more predictable evidence than unconstrained web research.

A planner-researcher-writer system introduces unnecessary model calls, orchestration complexity, cost, latency, and behavioral variance for routine policy lookup. Open-web browsing violates the authoritative-source requirement and increases prompt-injection and provenance risk. Concatenating the complete corpus into every prompt wastes tokens, increases latency, and can reduce retrieval precision as the corpus expands.

Study Guide references/topics: Search-result blocks for cited RAG; Claude citations; authoritative-corpus retrieval; source attribution; auditable context engineering.

===============

The correct general precedence is managed configuration, command-line arguments, local configuration, project configuration, and then user configuration.

Managed configuration has the highest authority because it contains centrally administered organizational and compliance controls that ordinary engineers must not be able to override. Command-line arguments provide temporary session-level overrides where the relevant setting permits them. Local settings apply to one user within a specific repository and take precedence over the shared project configuration. Project settings apply to every contributor using that repository and override general user preferences. User settings form the lowest tier because they provide personal defaults across projects and apply only when no higher-precedence source supplies a value.

Anthropic documents this order explicitly: managed, command line, local, project, and user. It also notes that permission rules may merge rather than behave as simple scalar overrides, and certain security-sensitive keys have specialized precedence behavior. Claude Code Configuration Scopes

The ordering allows personal customization without permitting it to defeat repository conventions or centrally mandated security requirements. Architects must still examine the merge behavior of the individual configuration property rather than assuming every array or permission rule is replaced wholesale.

Study Guide references/topics: Claude Code configuration; scope precedence; managed policies; local overrides; project settings; user defaults.

===============

The scenario describes indirect prompt injection: malicious instructions are embedded in third-party content that Claude processes as retrieved evidence. Option A addresses the threat at the appropriate boundary by classifying retrieved material as untrusted, screening it before use, and validating the model’s output before it can influence downstream actions.

Anthropic recommends placing untrusted third-party content in clearly identified tool-result structures, explicitly instructing Claude that retrieved content cannot override system or user instructions, screening tool output for injection attempts, and applying output validation. Mitigate Jailbreaks and Prompt Injections

Citations in Option B improve factual traceability but do not prevent embedded instructions from attempting to redirect model behavior. An outbound destination allow-list in Option C limits the damage that a compromised agent can cause through tool calls, but it does not directly detect or neutralize the injected content. Option D is valuable for detecting behavioral regression after a model change, not for controlling a specific malicious document during runtime.

A production implementation should combine content provenance, structural separation, injection screening, least-privilege tools, output-schema validation, and human confirmation for consequential actions.

Study Guide references/topics: Indirect prompt injection; untrusted retrieved content; input classification; output validation; layered runtime guardrails.

===============

A delivery team needs implementation-level direction rather than an executive architecture summary. Component responsibilities establish ownership and boundaries, while interface contracts define schemas, accepted inputs, outputs, errors, and behavioral expectations. Sequence diagrams show how components interact across dominant and failure flows. Configuration tables with defaults prevent inconsistent assumptions between environments. Operational runbooks ensure that deployment, recovery, monitoring, and routine maintenance are addressed during implementation rather than improvised after release. Options B, C, and D omit one or more elements required to translate architectural intent into a buildable and supportable system. The guide should enable normal delivery work without continuous dependence on undocumented knowledge held by the architect.

Study Guide references/topics: Implementation documentation; component contracts; sequence diagrams; configuration management; operational readiness.

Authorization must be enforced before restricted information enters model context. The retrieval service should authenticate the user, resolve role and document permissions, and filter candidate records before prompt construction. This prevents unauthorized content from appearing in prompts, model traces, cached context, tool results, or generated responses. A system-prompt instruction is behavioral guidance, not an enforceable access-control boundary. Post-generation filtering is also inadequate because the model has already received and processed the restricted data, creating exposure through output, logging, or indirect inference. Relying on general refusal behavior provides no deterministic authorization. The correct architecture treats RBAC as an application and data-layer control, with the model receiving only information the requesting principal is entitled to access.

Study Guide references/topics: Retrieval-layer RBAC; authorization before inference; least privilege; sensitive-context isolation.

Credentials must never be supplied as prompt content. Prompts can be retained in traces, debugging output, caches, or logs, and model output may inadvertently expose included secrets. Credentials should instead be resolved server-side through an approved secret store or delegated authentication mechanism. Option C is also a serious gap because post-response RBAC occurs after unauthorized data has already entered model context. Authorization must be enforced before retrieval and prompt construction. Options A, D, and E describe appropriate controls: least-privilege service identities, per-user scoped OAuth, and encrypted transport. Anthropic’s prompt-leak guidance recommends excluding unnecessary sensitive information, while Claude Code security relies on permission-based enforcement rather than natural-language instructions alone. Reduce prompt leak