CCAR-P Claude Certified Architect - Professional Questions and Answers

An ethics review must examine unsupported generalizations, stereotyping, disparate treatment, and other conclusions about people that are not justified by the evidence. It must also preserve identifiable human accountability for consequential decisions; responsibility cannot be transferred to a probabilistic system. Licensing is a legal and commercial-control question, while latency and throughput are operational requirements. Both remain important, but neither is the central ethical test presented here. Restricting review to low-confidence or threshold-triggering outputs is also inadequate because models can express harmful or biased conclusions with high confidence. Ethical review should cover representative populations, protected and intersectional groups, high-impact outcomes, override mechanisms, transparency, and channels for challenge or appeal.

Study Guide references/topics: Bias and unsupported generalization; human accountability; consequential decisions; ethical oversight.

A workflow is appropriate when processing stages and transitions are known in advance. Metadata extraction, classification, summarization, and persistence can be represented as deterministic nodes with explicit schemas, validation rules, retry policies, and failure handling. This provides predictable execution, cost, observability, and testability without paying for repeated model-driven planning. Anthropic’s Building Effective AI Agents distinguishes workflows, where predefined code paths control execution, from agents, where the model dynamically determines its process. Option A reaches the correct pattern for an incorrect reason: workflows and agents can both invoke tools. Options B and C introduce unnecessary autonomy and make unsupported claims about consistency or universal accuracy.

Study Guide references/topics: Workflow versus agentic patterns; deterministic orchestration; batch processing; structured outputs; predictable cost; error handling.

Robust guardrails require both preventive enforcement and continuous empirical validation. Per-role tool allow-lists satisfy the preventive requirement by restricting each authenticated role to explicitly authorized tools. Enforcement must occur in the orchestration or permission layer before execution; relying on the model to decide whether a tool call is authorized is not an adequate security boundary. Anthropic recommends allow-list-based validation and provides permission rules and pre-tool-use controls capable of denying calls before they execute.

Adversarial evaluation with regression tracking supplies the validation component. The evaluation set should include prompt injections, indirect injections, encoded instructions, multi-turn escalation, role-confusion attempts, and requests designed to trigger unauthorized tool use. Guardrail performance must then be measured across releases so that changes to prompts, models, tools, or orchestration logic do not silently reduce protection.

Centralized logging and user feedback are useful detective and lifecycle controls, but neither prevents an unsafe action nor proves guardrail effectiveness. Periodically refreshing refusal wording is also insufficient unless the revised behavior is evaluated against defined safety criteria. The strongest design therefore combines deterministic authorization with adversarial regression testing.

Study Guide references/topics: Claude Code permissions and pre-tool enforcement ; tool allow-list guidance ; adversarial evaluations; regression testing; least-privilege orchestration.

===============

Option A augments the existing review process without transferring final accountability to the model. Claude Code can inspect the change in repository context, identify logic defects, security weaknesses, regressions, and maintainability concerns, and publish structured findings for human evaluation. Existing branch protection then preserves required approvals and separation of duties. Automatic merging or disabling protection rules would convert an advisory capability into an uncontrolled authorization mechanism. Silent deletion would eliminate transparency and prevent authors from challenging or correcting the assessment. Anthropic’s Code Review documentation states that findings are posted as comments and do not approve or block the pull request, leaving the established review workflow intact. Claude Code Review

The correct general precedence is managed configuration, command-line arguments, local configuration, project configuration, and then user configuration.

Managed configuration has the highest authority because it contains centrally administered organizational and compliance controls that ordinary engineers must not be able to override. Command-line arguments provide temporary session-level overrides where the relevant setting permits them. Local settings apply to one user within a specific repository and take precedence over the shared project configuration. Project settings apply to every contributor using that repository and override general user preferences. User settings form the lowest tier because they provide personal defaults across projects and apply only when no higher-precedence source supplies a value.

Anthropic documents this order explicitly: managed, command line, local, project, and user. It also notes that permission rules may merge rather than behave as simple scalar overrides, and certain security-sensitive keys have specialized precedence behavior. Claude Code Configuration Scopes

The ordering allows personal customization without permitting it to defeat repository conventions or centrally mandated security requirements. Architects must still examine the merge behavior of the individual configuration property rather than assuming every array or permission rule is replaced wholesale.

Study Guide references/topics: Claude Code configuration; scope precedence; managed policies; local overrides; project settings; user defaults.

===============

Tool Search applies progressive discovery to a large tool catalog. Instead of inserting every MCP tool’s complete JSON schema and description into the initial context, Claude receives limited discovery information and loads the full definitions only when a task requires them. This preserves the available context for instructions, repository content, conversation history, and tool results without removing the underlying capabilities.

Anthropic’s Claude Code documentation states that Tool Search keeps MCP context usage low by deferring tool definitions until Claude needs them. Only the tools actually selected enter the working context. Claude Code MCP Tool Search

Anthropic’s advanced-tool-use guidance also describes conventional multi-server configurations consuming tens of thousands of tokens before work begins, while on-demand discovery substantially reduces that overhead. Advanced Tool Use

Option B solves context pressure by destroying required functionality. Option C worsens the constraint by adding more prompt tokens. Option D expands the exact source of context bloat.

The team should also improve server and tool descriptions so discovery returns the correct tools, monitor tool-selection quality, and keep frequently required foundational tools non-deferred only when evaluations justify the additional context cost.

Study Guide references/topics: MCP scaling; Tool Search; progressive discovery; deferred schemas; context-budget management; tool-selection accuracy.

===============

Least privilege means granting the exact capabilities required for the defined responsibility—no more and no less. Option B permits the assistant to read the approved knowledge base and write only to the draft queue. Enforcing the allow-list at the orchestration layer creates a deterministic authorization boundary outside the model’s prompt and reasoning.

The rule should also be role-specific so different users or operational roles receive only the tools and data scopes they require. The knowledge-base tool should remain read-only, while the draft-queue tool should be restricted to draft creation rather than external sending, approval, or production publication.

Option A exposes every globally readable tool, creating unnecessary access to unrelated information. Option C relies on voluntary model behavior instead of enforceable authorization. A mistaken tool selection or successful prompt injection could therefore invoke an inappropriate capability. Option D minimizes permissions by eliminating the assistant’s required functionality and is not a viable least-privilege implementation.

Anthropic’s permission guidance distinguishes allow, ask, and deny rules and confirms that these controls are enforced by Claude Code rather than by model instructions. Configure Permissions

Study Guide references/topics: Least privilege; per-role authorization; orchestration-layer enforcement; capability scoping; read/write separation; tool allow-lists.

===============

Claude Code constructs the model context before the first user message. That initial context can include the system prompt, project instructions, subagent configuration, MCP server instructions, and tool definitions expressed as JSON schemas. When numerous MCP servers expose many tools and Tool Search is disabled, those schemas must be loaded upfront. A large collection of verbose tool descriptions and parameter schemas can therefore consume tens of thousands of tokens before the engineer enters any text.

Tool Search is specifically designed to prevent this form of context inflation. With Tool Search enabled, Claude initially receives only server instructions and compact tool-identification information; full tool schemas are deferred until a relevant tool is discovered and required. Anthropic consequently describes Tool Search as the mechanism for keeping MCP context consumption low as integrations scale.

Keyboard layouts, font rendering, and display scaling operate outside the language-model context and cannot generate API input tokens. Likewise, model behavior does not silently reserve 50,000 tokens for personal preferences. The diagnostic action is to inspect configured MCP servers and tool counts, determine whether Tool Search has been disabled, and remove or defer unnecessary definitions.

Study Guide references/topics: [MCP Tool Search and context scaling](https://docs.anthropic.com/en/docs/claude-code/mcp); MCP server configuration; subagent context budgeting; tool-schema optimization.

===============

Option C addresses both components responsible for the excessive cost. Anthropic prompt caching allows stable, repeatedly submitted prompt material—such as system instructions, tool definitions, and reusable background information—to be placed in a consistent prefix. After that prefix is written to the cache, qualifying subsequent requests can reuse it at the lower cache-read cost instead of repeatedly processing the same content at the standard input-token rate.

Retrieval must be optimized separately. Supplying an entire document collection or excessively deep search results increases cost, consumes context capacity, and may reduce answer quality by surrounding the relevant evidence with distracting material. Retrieval should select the smallest set of authoritative passages that provides sufficient evidence for the current query. This typically requires relevance scoring, deduplication, metadata filtering, reranking, and explicit token-budget limits.

Increasing retrieval depth or expanding the repeated system prompt directly worsens the identified cost driver. Moving every request to a heavier model changes the unit economics but does not correct inefficient context construction. The recommended optimization therefore combines prefix caching with query-specific context pruning, followed by evaluation to confirm that reduced context does not lower task accuracy.

Study Guide references/topics: [Prompt caching](https://docs.anthropic.com/en/docs/build-with-claude/prompt-caching); [effective context engineering] (https://www.anthropic.com/engineering/effective-context-engineering-for-ai-agents); retrieval precision; token-cost analysis; cache-prefix stability.

===============

Prompt caching reduces repeated input processing when a stable system prefix is reused, directly lowering input cost and processing latency. Model routing provides the second optimization: routine cases can use a faster, lower-cost model, while difficult cases retain access to the more capable model. The routing policy must be validated against representative evaluations to confirm that quality remains within the required threshold. Increasing max_tokens can increase output cost and generation time. Retrieving the complete corpus and adding examples to every request both enlarge the input, worsening latency and token consumption. Anthropic identifies prompt caching as a cost-and-latency optimization and recommends selecting a model according to the workload’s quality, speed, and economic requirements. Prompt caching ; reducing latency

A steering committee needs an answer-first recommendation that states the proposed architectural decision, the business outcome it supports, and the approval or action required. After establishing that common decision frame, the document should address each stakeholder’s concerns separately.

The CFO requires implementation and operating costs, expected savings, consumption assumptions, financial exposure, and cost-control mechanisms. General counsel needs evidence concerning confidentiality, privilege, data handling, human legal review, explainability, retention, and regulatory risk. The CIO needs integration architecture, security boundaries, availability, scalability, operational ownership, technical dependencies, and lifecycle support.

Option A begins at an implementation depth unsuitable for the entire committee. Option B overweights the CFO’s concerns and delays the rationale required by the other decision-makers. Option C ignores audience-specific responsibilities and forces every stakeholder to extract relevant information from an undifferentiated narrative.

The recommended structure is: decision and executive rationale, expected outcomes, accepted trade-offs, stakeholder-specific impact sections, major risks and controls, implementation implications, success metrics, and the requested governance decision. Technical appendices can preserve component-level detail without overwhelming the principal recommendation.

Study Guide references/topics: Executive communication; stakeholder differentiation; decision-first structure; financial, legal, and technology concerns; architectural recommendations.

===============

Option B targets two major contributors to per-turn latency: retrieved-context size and repeated prompt processing. Reducing retrieval to an empirically validated top- k limits the tokens Claude must process while preserving the passages that historically provide sufficient answer coverage. Caching the stable system-prompt prefix avoids repeatedly processing identical instructions.

Anthropic’s latency guidance recommends choosing an appropriate model and reducing unnecessary input and output tokens. Its prompt-caching documentation explains that caching reusable prompt prefixes can reduce both repeated processing cost and latency. Reducing Latency , Prompt Caching

The retrieval depth must be selected through evaluation rather than arbitrary truncation. The team should compare answer quality, retrieval recall, latency, and failure rates across candidate values and retain escalation logic for complex queries requiring deeper retrieval.

Option A removes an applicable latency optimization. Option C maximizes context consumption regardless of demonstrated benefit. Option D deliberately selects the slowest model class even though routine-turn quality already meets requirements.

Study Guide references/topics: Latency optimization; top- k retrieval; prompt caching; token reduction; quality–latency evaluation; adaptive retrieval.

===============

The existing evaluation set does not represent the population or operating conditions the hiring-support system will encounter. Option B corrects this coverage defect by expanding geographic and tenure slices and requiring the system to be rescored before broader deployment.

Aggregate performance on one narrow group can conceal substantial differences among regions, experience levels, job families, languages, and other relevant cohorts. The expanded dataset should therefore support disaggregated metrics, not merely one combined score. It should also include representative, edge, and adversarial cases, with labels and grading procedures reviewed for consistency and potential bias.

Anthropic’s evaluation guidance states that evaluations should mirror the real-world task distribution and include edge cases. Success criteria should also be relevant to the application’s actual purpose and users. Define Success Criteria and Build Evaluations

Option A replaces one unrepresentative method with another. Option C deliberately narrows coverage further. Option D mistakes high performance on a restricted subset for evidence of generalization.

Because hiring is a consequential domain, the organization should combine representative quantitative evaluation, subgroup analysis, expert review, monitoring, access controls, transparency, and meaningful human responsibility for final decisions.

Study Guide references/topics: Dataset representativeness; evaluation slices; subgroup performance; bias detection; consequential-use governance; pre-release rescoring.

===============

The prompt contains mutually incompatible behavioral requirements. The architect should resolve the contradiction explicitly so the model receives one coherent grounding policy. If the application requires source-supported answers, the prompt should prohibit unsupported completion, permit an insufficient-evidence response, and require citations or supporting passages. Adding another priority instruction leaves the underlying conflict in place and creates ambiguity about when speculation is permitted. Increasing temperature makes behavior more variable rather than more correct. Retaining both instructions produces inconsistent outputs across requests and model versions. Anthropic recommends clear, direct, specific prompting and notes that conflicting project instructions can cause Claude to select among them unpredictably. Prompting best practices ; project-instruction troubleshooting

Authorization must be enforced before restricted information enters model context. The retrieval service should authenticate the user, resolve role and document permissions, and filter candidate records before prompt construction. This prevents unauthorized content from appearing in prompts, model traces, cached context, tool results, or generated responses. A system-prompt instruction is behavioral guidance, not an enforceable access-control boundary. Post-generation filtering is also inadequate because the model has already received and processed the restricted data, creating exposure through output, logging, or indirect inference. Relying on general refusal behavior provides no deterministic authorization. The correct architecture treats RBAC as an application and data-layer control, with the model receiving only information the requesting principal is entitled to access.

Study Guide references/topics: Retrieval-layer RBAC; authorization before inference; least privilege; sensitive-context isolation.

The evaluation metrics must map directly to the two stated requirements. Role-based access-control enforcement rate, tested against a red-team dataset, measures whether requests from unauthorized identities, roles, or access paths are consistently denied. It converts the privacy and authorization requirement into an observable security metric and exposes bypass conditions that ordinary functional tests may miss. Because the requirement says patient data must never reach unauthorized roles, the acceptance threshold should be effectively 100% enforcement across representative and adversarial cases.

Per-query token cost directly measures compliance with the financial constraint. The metric should include uncached input, cache reads and writes where applicable, output tokens, thinking tokens, and any other billable components attributed to the request. Results can then be compared with the defined ceiling across normal, boundary, and worst-case inputs.

Anthropic’s evaluation guidance identifies privacy preservation and price as distinct success criteria and emphasizes that criteria must be specific, measurable, and relevant to the application. Define Success Criteria and Build Evaluations

BLEU may assess textual similarity but does not test authorization or cost. Throughput and percentile latency are valuable operational metrics, yet neither directly answers the two requirements in the scenario.

Study Guide references/topics: Multidimensional evaluation; privacy preservation; authorization testing; red-team datasets; token-cost measurement; requirement-to-metric traceability.

===============

Haiku is the appropriate starting point because the workload is high-volume, latency-sensitive, and based on a stable closed set of moderation labels. These characteristics favor a fast, cost-efficient model capable of consistent classification without incurring the additional inference time and expense associated with deeper reasoning.

Anthropic’s model-selection guidance requires architects to balance capability, speed, and cost rather than automatically selecting the most capable model. Its content-moderation guidance specifically identifies Haiku as a cost-effective option for processing moderation workloads at substantial scale. Choosing the Right Model , Content Moderation

Opus is disproportionate to a routine closed-set classification problem. Sonnet may become justified if evaluation demonstrates that Haiku fails materially on complex policy distinctions, multilingual ambiguity, or adversarial edge cases, but it should not be selected merely because it is larger. Enabling extended thinking on every request would further increase latency and token consumption without evidence that the additional reasoning improves the defined success metrics. The correct architectural practice is to establish a representative moderation evaluation set, validate Haiku against accuracy and safety thresholds, and escalate only the cases that genuinely need deeper reasoning.

Study Guide references/topics: Model selection; capability–latency–cost trade-offs; classification workloads; evaluation-driven routing; moderation architecture.

===============

Role-based access control directly supports HIPAA’s access-control and minimum-necessary principles. The retrieval and orchestration layers must verify the authenticated user’s role before protected health information enters the model context. Authorization should be applied to individual records, data sources, tools, and actions, with audit events recording the requesting identity, accessed resource, purpose, and result. Model instructions alone are not a security boundary.

Patient information must also remain within services and processing activities covered by the organization’s Business Associate Agreement. Anthropic states that PHI processing requires a HIPAA-ready organization and an accepted BAA, and that only specified eligible services and configurations are covered. Patient data must not be submitted through training, feedback, beta, third-party, or integration pathways that fall outside the applicable agreement. A BAA is not blanket authorization; architects must verify feature eligibility and disable inappropriate data-sharing mechanisms.

Reducing max_tokens, selecting a more capable model, and enabling streaming affect output length, quality, or latency. They do not establish authorization, contractual coverage, minimum-necessary access, or compliant PHI handling.

Study Guide references/topics: Anthropic Business Associate Agreement requirements ; HIPAA-ready services; PHI access control; minimum necessary; eligible-service boundaries; auditability.

===============

An actionable runbook must connect detection, diagnosis, containment, recovery, and escalation. Option B supplies that complete operational chain: alerts identify abnormal conditions; triage procedures guide initial investigation; dashboards and logs provide evidence; escalation paths assign authority; and rollback procedures restore a known-safe state. The runbook should cover model errors, latency degradation, rate limits, tool failures, prompt regressions, cost anomalies, data-governance events, and dependency outages. Anthropic’s operational materials demonstrate incident workflows in which alerts lead responders to logs and runbooks before corrective action. Options A, C, and D each omit information required for an on-call engineer to progress from notification to controlled resolution. Procedures should be tested through exercises and updated after incidents.

Study Guide references/topics: Claude operational and observability patterns ; incident response; triage; escalation; rollback; operational readiness.

Progressive tool discovery preserves the complete capability catalog while limiting initial context to a curated set of common tools and a discovery mechanism. When the task requires an additional capability, Claude searches the catalog and loads only the relevant tool definitions.

Anthropic’s Tool Search mechanism implements this pattern through deferred loading. The context initially contains the search tool and any deliberately non-deferred tools; relevant definitions are expanded only when discovered. This reduces token consumption and helps maintain tool-selection accuracy in large catalogs. Tool Search Tool

Option B adds a model call and still repeatedly processes all definitions, increasing latency and cost while potentially losing important schema details. Option C treats a larger context window as permission to waste context and does not address time-to-first-response overhead. Option D reduces capability breadth because the fixed five tools may be irrelevant to a given task.

The architect should provide clear tool and server descriptions, define which high-frequency tools remain immediately available, and evaluate discovery recall, selection accuracy, latency, and context savings across representative workflows.

Study Guide references/topics: Progressive discovery; deferred tool loading; MCP scaling; context optimization; tool-selection accuracy; on-demand capability loading.

===============

Option A combines the contractual, technical, and operational measures relevant to a defensible GDPR posture. For commercial services, the Data Processing Addendum defines processor obligations and incorporates safeguards such as Standard Contractual Clauses where applicable. Anthropic states that its DPA is incorporated into its Commercial Terms, while the customer remains responsible for determining lawful purposes, issuing processing instructions, and fulfilling controller obligations.

A defined retention configuration ensures personal data is not retained indefinitely without a documented purpose. Redacting personal information that is unnecessary for the task implements data minimization and reduces exposure in prompts, logs, retrieval stores, and model outputs. Documented data-subject-rights procedures support access, correction, deletion, restriction, and other applicable requests by ensuring the organization can locate and act on relevant records.

Enterprise deployment alone does not establish compliance; the organization must configure and govern the service consistently with its processing activities, risk assessment, lawful basis, and contractual commitments. Options B, C, and D intentionally remove those controls or promote excessive collection.

Study Guide references/topics: [Anthropic Data Processing Addendum guidance](https://privacy.anthropic.com/en/articles/7996862-how-do-i-view-and-sign-your-data-processing-addendum-dpa); [commercial data-retention practices] (https://privacy.anthropic.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data); GDPR data minimization; retention governance; data-subject-rights procedures.

===============

Federated authorship allows each domain team to maintain the procedural knowledge it understands while preserving organization-wide trust through a central publication gate. Team authors can update coding standards, review practices, and postmortem procedures without waiting for a single platform group to write every change. Central reviewers can validate ownership, security, tool permissions, duplication, versioning, testing evidence, and compliance before publication. Per-developer or fully decentralized publication creates inconsistent and potentially unsafe Skills. Fully centralized authorship becomes a scalability bottleneck and separates content maintenance from domain expertise. Anthropic describes Skills as packages of instructions, scripts, and resources and warns that repository Skills may grant broad tool access, making formal review essential. Claude Code Skills

Alignment is an ongoing governance process rather than a one-time approval. Option D creates a predictable cadence for reassessing objectives, constraints, assumptions, risks, service levels, and success measures as business and technical conditions change. Option E requires disagreements to be surfaced and reconciled explicitly, preserving decision traceability and preventing unresolved conflicts from reappearing during implementation or operation. The routine should document decisions, owners, accepted trade-offs, action items, and conditions that trigger reconsideration. Recording meetings may improve accessibility but does not itself produce alignment. Rotating facilitation is optional and may weaken accountability. Automatically escalating every disagreement to an executive sponsor bypasses normal architectural negotiation and should be reserved for material deadlocks.

Study Guide references/topics: Stakeholder alignment; feedback cadence; assumption management; conflict reconciliation; decision records; lifecycle governance.

The observed failure is a groundedness defect: the response contains claims that cannot be traced to retrieved evidence. Option A directly constrains generation to the supplied sources, requires visible attribution, and verifies that each material claim has supporting text. Unsupported claims should be removed, qualified, or replaced with an explicit statement that the available sources are insufficient. Regression evaluation in Option B may detect the failure but does not itself prevent unsupported claims. OAuth addresses identity and authorization, while input classifiers address malicious or unsafe retrieved content; neither verifies factual support. Anthropic recommends citations, supporting quotations, and post-generation claim verification to reduce hallucinations in document-grounded applications. Reducing hallucinations

A minimal reproduction and MCP status inspection are foundational diagnostic actions because they produce direct, interpretable evidence. A minimal reproduction removes unrelated prompts, tools, settings, hooks, and repository state while changing one variable at a time. This determines whether the failure follows a particular configuration, server, command, model request, or project artifact. It also creates a reproducible evidence package if escalation later becomes necessary.

MCP inspection addresses a common Claude Code failure domain. `claude mcp list` displays configured servers and their health states, including connected, authentication-required, pending-approval, and failed-to-connect conditions. `claude mcp get < name > ` provides server-specific details, while `/mcp` exposes status within an interactive session. These checks distinguish model behavior from transport, authentication, configuration, and workspace-trust failures.

Increasing temperature reduces repeatability and introduces additional variation, making root-cause isolation more difficult. Filing a support ticket before collecting local evidence reverses the appropriate diagnostic sequence. An immediate rollback may eventually be used as a controlled version comparison, but it changes the environment before a baseline has been captured and is therefore not a primary toolkit action.

Study Guide references/topics: [Managing and diagnosing MCP servers](https://docs.anthropic.com/en/docs/claude-code/mcp); minimal reproducible cases; controlled-variable troubleshooting; authentication and connection-state diagnostics.

===============

Progressive tool discovery preserves the complete capability catalog while limiting initial context to a curated set of common common common tools and a discovery mechanism. When the task requires an additional capability, Claude searches the catalog and loads only the relevant tool definitions.

Anthropic’s Tool Search mechanism implements implements this pattern through deferred loading. The context initially contains the search search search tool and any deliberately non-deferred tools; relevant definitions are expanded only when discovered. This reduces token consumption and helps maintain tool-selection accuracy in large catalogs. ToolTool Search Tool

Option B adds a model call and still repeatedly processes all definitions, increasing latency latency latency and cost while potentially losing important schema details. Option C treats a larger context window as permission to waste context and does not address time-to-first-response overhead. Option D reduces capability breadth because the fixed five tools may be irrelevant to a given task.

The architect should provide clear tool and server server server descriptions, define which high-frequency tools remain immediately available, and evaluate discovery recall, selection accuracy

The assistant is making recommendations without considering information that specialists regard as material. That is a direct input-scope and requirements gap, not merely a presentation issue. The 89 percent acceptance metric is also incomplete because initial acceptance does not reveal whether recommendations remain correct after users apply the omitted criteria. Production readiness requires outcome-focused evaluation, including final recommendation agreement, override reasons, financial impact, supplier risk, and performance across representative procurement scenarios. Options B and E raise possible concerns, but the scenario supplies no evidence that response rate or pilot duration is the demonstrated deficiency. Option A incorrectly treats a single proxy metric as sufficient. Anthropic recommends multidimensional, task-specific success criteria aligned with the actual user outcome. Define success criteria and evaluations

Managed configuration is designed for organization-wide security and compliance controls that individual users and repositories must not override. Applying the hardening flag centrally establishes an administrative policy boundary and prevents engineers from disabling the control through user, project, or local settings.

Anthropic identifies managed scope as the appropriate location for security policies, non-overridable compliance requirements, and standardized configurations deployed by IT or DevOps. Managed values ordinarily take precedence over command-line arguments and every user-controlled settings scope. Claude Code Settings

Option A depends on every engineer maintaining the setting and allows the user to edit or delete it. Option B affects only pipeline execution and does not protect local, interactive, IDE, or other execution paths. Option D standardizes the setting within the repository but does not make it tamper-resistant; contributors with repository write access could alter the file, use higher-precedence local settings where permitted, or operate outside the repository configuration.

The implementation should also verify active policy delivery, monitor configuration-change events, and test that startup or execution fails safely if the managed setting is absent or invalid. Central definition without enforcement and verification would not fully satisfy the requirement.

Study Guide references/topics: Managed settings; non-overridable controls; enterprise hardening; policy enforcement; configuration governance; defense against local override.

===============

The evaluation specification must exist before inference begins. Option D defines what the evaluation will measure and how results will be segmented. Representative cases measure normal workload performance, edge cases test boundary behavior, and adversarial cases examine safety, security, or robustness under hostile inputs.

Option B then supplies the correctly curated and labeled dataset corresponding to those slices. Labels, expected outcomes, grading rubrics, provenance, and dataset versions must be established before the deployment generates outputs. Otherwise, evaluators risk modifying criteria after seeing results and introducing confirmation bias.

Anthropic defines an evaluation as an input combined with grading logic used to measure success. Its evaluation guidance distinguishes tasks, trials, graders, traces, outcomes, and the harness that runs and aggregates them. Demystifying Evals for AI Agents

Option E occurs after model execution because outputs must exist before they can be scored. Option A follows scoring and aggregation. Option C is an iterative improvement step performed after failure cases become available, although rubric calibration may also be conducted on separate development data.

Study Guide references/topics: Evaluation specification; metrics and slices; representative and adversarial datasets; labeling; scoring; aggregation; release gates.

===============

Per-user, scope-restricted OAuth tokens directly eliminate the shared-credential weakness. Each token represents a distinct user or delegated identity, carries only the permissions required for that user’s role, and can be revoked independently. This supports least privilege, limits the blast radius of credential compromise, and enables authorization decisions to be tied to a specific principal instead of an undifferentiated shared API key.

Actor attribution in tool-call logs directly resolves the second finding. Each audit event should record the authenticated user, delegated service identity, session or request identifier, tool name, authorization decision, relevant resource, timestamp, and outcome. This establishes accountability and permits incident investigators to reconstruct who initiated a consequential action.

Moving credentials into a server-side secret store is sound secret-management practice, but it does not by itself correct the shared-identity problem: a centrally stored key can still represent every user as the same principal. Schema validation protects downstream processing, while retrieval-layer RBAC protects information access; neither addresses the two specific audit findings.

These controls should be reinforced by short-lived tokens, server-side authorization enforcement, sensitive-field redaction, and tamper-resistant audit-log retention.

Study Guide references/topics: [Claude Code security](https://docs.anthropic.com/en/docs/claude-code/security); [MCP authentication and OAuth] (https://docs.anthropic.com/en/docs/claude-code/mcp); least privilege; identity propagation; auditable tool execution.

===============

Unrestricted Bash access exposes filesystem, credential, process, network, package-management, and potentially infrastructure-administration capabilities across every repository. Option C applies least privilege by identifying the commands genuinely required by approved workflows and permitting only those patterns. Explicit deny rules should protect destructive commands, sensitive files, credential stores, deployment systems, and other prohibited operations.

Anthropic’s permission system supports allow, ask, and deny rules, with deny evaluated before ask and allow. It also warns that command patterns intended to constrain network utilities can be fragile, so stronger controls such as WebFetch domain restrictions, hooks, and sandbox boundaries may be required. Claude Code Permissions

Enterprise configuration should combine managed baseline restrictions with project-specific permissions where necessary. High-impact commands should remain subject to confirmation, and sandboxing should provide operating-system-level filesystem and network containment.

Options A and D deliberately enlarge the attack surface. Option B treats configuration simplicity as more important than enterprise security and fails to account for prompt injection, accidental commands, compromised repositories, or excessive human approval. The configuration should be narrow, auditable, centrally governed, and validated against real development workflows.

Study Guide references/topics: Claude Code permissions; Bash restrictions; least privilege; managed controls; explicit deny rules; sandboxing; enterprise rollout security.

===============