CCAR-P Claude Certified Architect - Professional Questions and Answers

Control A directly constrains the outbound action surface. An allow-list limits which tools and destinations may receive data, while per-call review introduces an approval boundary before information leaves the controlled environment. These measures therefore address data exfiltration through outbound tool calls, making Option C correct. Anthropic’s security guidance recommends least privilege, narrowly scoped permissions, sandboxing, and limiting access to sensitive information and actions so that a compromised agent can cause minimal damage. Mitigate Jailbreaks and Prompt Injections

Control B addresses model-version drift. Running a stable adversarial evaluation set after each version change creates a consistent comparison baseline and detects regressions that might otherwise remain invisible during routine testing. This correctly maps Control B to silent quality drift, making Option E correct. Anthropic’s migration guidance repeatedly calls for workload reevaluation because instruction following, style, reasoning, and agent behavior can differ between versions. Model Migration Guide

Control A may limit the consequences of successful prompt injection, but it does not prevent or directly detect adversarial instructions in retrieved content. Control B measures behavioral performance but does not impose outbound authorization controls. Each control must therefore be mapped to the risk it most directly mitigates.

Study Guide references/topics: Tool governance; least privilege; exfiltration controls; adversarial evaluations; model-change regression testing; defense in depth.

===============

The request is not yet design-ready because it lacks a defined failure, affected user journey, supported decision, target population, and measurable outcome. The architect should therefore facilitate structured discovery rather than prematurely selecting an AI pattern or model.

Discovery should identify where the current customer journey breaks down, who experiences the problem, what decision or task requires assistance, what data is available, and which metric would demonstrate improvement. The team can then establish baseline performance, target thresholds, operational constraints, risks, and explicit non-goals. Anthropic’s evaluation guidance states that an LLM application should begin with clearly defined success criteria and a method for measuring them. Define Success Criteria and Build Evaluations

Option A abandons the sponsor instead of helping translate a business concern into an actionable problem. Option B risks producing a generic demonstration unrelated to a validated customer need. Option C substitutes the architect’s assumptions for stakeholder evidence and may commit the organization to the wrong scope.

Competent delegation begins by defining the decision, intended outcome, authority boundaries, and target metric before determining which responsibilities should be assigned to Claude, conventional software, or human reviewers.

Study Guide references/topics: Structured discovery; delegation competency; problem definition; target metrics; decision support; measurable business outcomes.

===============

An evaluation set must represent the populations, operating conditions, and use cases that the deployed system will encounter. A dataset drawn from only one geographic region and one tenure band cannot reliably demonstrate that the hiring-support tool performs consistently across its intended users. Expanding the evaluation set enables architects to identify regional performance differences, tenure-related errors, unsupported generalizations, and potentially discriminatory outcomes before broader deployment. The system should then be rescored using the expanded dataset, with results examined across relevant population slices rather than relying only on an aggregate score. Options A and B preserve or worsen the representation gap. Option D is also inappropriate because qualitative feedback can supplement structured evaluation but cannot replace measurable, repeatable testing of accuracy, fairness, and reliability across the intended deployment population.

Effective documentation begins with audience analysis and structural planning. Identifying the audience determines the required technical depth, terminology, decision context, and operational emphasis. Defining the questions the guide must answer prevents sections from becoming generic descriptions. The outline then establishes complete coverage across architecture overview, component responsibilities, interface contracts, dominant flows, operational runbooks, and known limitations. Translation occurs only after stable source content exists. Implementation-team validation also follows an initial draft because there must be material to review. Version control, reviewers, and cadence are important governance controls, but they do not replace the two content-planning activities required before section drafting. The guide should be planned around the decisions and tasks its intended readers must perform.

Role-based access control directly supports HIPAA’s access-control and minimum-necessary principles. The retrieval and orchestration layers must verify the authenticated user’s role before protected health information enters the model context. Authorization should be applied to individual records, data sources, tools, and actions, with audit events recording the requesting identity, accessed resource, purpose, and result. Model instructions alone are not a security boundary.

Patient information must also remain within services and processing activities covered by the organization’s Business Associate Agreement. Anthropic states that PHI processing requires a HIPAA-ready organization and an accepted BAA, and that only specified eligible services and configurations are covered. Patient data must not be submitted through training, feedback, beta, third-party, or integration pathways that fall outside the applicable agreement. A BAA is not blanket authorization; architects must verify feature eligibility and disable inappropriate data-sharing mechanisms.

Reducing max_tokens, selecting a more capable model, and enabling streaming affect output length, quality, or latency. They do not establish authorization, contractual coverage, minimum-necessary access, or compliant PHI handling.

Study Guide references/topics: Anthropic Business Associate Agreement requirements; HIPAA-ready services; PHI access control; minimum necessary; eligible-service boundaries; auditability.

===============

Option D defines a measurable performance characteristic rather than a business capability. The requirement specifies a percentile-based latency threshold—under 800 milliseconds at the 95th percentile—and ties that threshold to the expected workload volume. It therefore describes how well the system must operate under defined conditions.

Options A, B, and C are functional requirements. They describe actions the solution must perform: extracting fields and creating a downstream record, producing an editable draft, and assigning tickets to categories. Functional requirements define observable system behaviors or outputs.

A strong non-functional requirement must include a metric, threshold, measurement method, and operating condition. For Option D, the architect should further define whether latency is measured end-to-end or only at the model API, the test duration, concurrency, input-size distribution, cache state, timeout behavior, geographic region, and treatment of failed requests. Without those details, teams may report incompatible results while claiming to satisfy the same requirement.

Non-functional requirements for Claude solutions commonly address latency, availability, throughput, cost, privacy, security, recoverability, observability, scalability, and regulatory compliance.

Study Guide references/topics: Structured discovery; functional requirements; non-functional requirements; p95 latency; workload conditions; measurable acceptance criteria.

===============

The evaluation metrics must map directly to the two stated requirements. Role-based access-control enforcement rate, tested against a red-team dataset, measures whether requests from unauthorized identities, roles, or access paths are consistently denied. It converts the privacy and authorization requirement into an observable security metric and exposes bypass conditions that ordinary functional tests may miss. Because the requirement says patient data must never reach unauthorized roles, the acceptance threshold should be effectively 100% enforcement across representative and adversarial cases.

Per-query token cost directly measures compliance with the financial constraint. The metric should include uncached input, cache reads and writes where applicable, output tokens, thinking tokens, and any other billable components attributed to the request. Results can then be compared with the defined ceiling across normal, boundary, and worst-case inputs.

Anthropic’s evaluation guidance identifies privacy preservation and price as distinct success criteria and emphasizes that criteria must be specific, measurable, and relevant to the application. Define Success Criteria and Build Evaluations

BLEU may assess textual similarity but does not test authorization or cost. Throughput and percentile latency are valuable operational metrics, yet neither directly answers the two requirements in the scenario.

Study Guide references/topics: Multidimensional evaluation; privacy preservation; authorization testing; red-team datasets; token-cost measurement; requirement-to-metric traceability.

===============

Robust guardrails require both preventive enforcement and continuous empirical validation. Per-role tool allow-lists satisfy the preventive requirement by restricting each authenticated role to explicitly authorized tools. Enforcement must occur in the orchestration or permission layer before execution; relying on the model to decide whether a tool call is authorized is not an adequate security boundary. Anthropic recommends allow-list-based validation and provides permission rules and pre-tool-use controls capable of denying calls before they execute.

Adversarial evaluation with regression tracking supplies the validation component. The evaluation set should include prompt injections, indirect injections, encoded instructions, multi-turn escalation, role-confusion attempts, and requests designed to trigger unauthorized tool use. Guardrail performance must then be measured across releases so that changes to prompts, models, tools, or orchestration logic do not silently reduce protection.

Centralized logging and user feedback are useful detective and lifecycle controls, but neither prevents an unsafe action nor proves guardrail effectiveness. Periodically refreshing refusal wording is also insufficient unless the revised behavior is evaluated against defined safety criteria. The strongest design therefore combines deterministic authorization with adversarial regression testing.

Study Guide references/topics: Claude Code permissions and pre-tool enforcement; tool allow-list guidance; adversarial evaluations; regression testing; least-privilege orchestration.

===============

Per-user, scope-restricted OAuth tokens directly eliminate the shared-credential weakness. Each token represents a distinct user or delegated identity, carries only the permissions required for that user’s role, and can be revoked independently. This supports least privilege, limits the blast radius of credential compromise, and enables authorization decisions to be tied to a specific principal instead of an undifferentiated shared API key.

Actor attribution in tool-call logs directly resolves the second finding. Each audit event should record the authenticated user, delegated service identity, session or request identifier, tool name, authorization decision, relevant resource, timestamp, and outcome. This establishes accountability and permits incident investigators to reconstruct who initiated a consequential action.

Moving credentials into a server-side secret store is sound secret-management practice, but it does not by itself correct the shared-identity problem: a centrally stored key can still represent every user as the same principal. Schema validation protects downstream processing, while retrieval-layer RBAC protects information access; neither addresses the two specific audit findings.

These controls should be reinforced by short-lived tokens, server-side authorization enforcement, sensitive-field redaction, and tamper-resistant audit-log retention.

Study Guide references/topics: [Claude Code security](https://docs.anthropic.com/en/docs/claude-code/security); [MCP authentication and OAuth] (https://docs.anthropic.com/en/docs/claude-code/mcp); least privilege; identity propagation; auditable tool execution.

===============

A structured feedback session must enable informed review, traceable decisions, and accountable follow-through. Option B allows stakeholders to examine architecture diagrams, evaluation results, risk registers, or prototypes before the meeting. The focused agenda keeps discussion aligned with decisions that must be made rather than allowing the session to become an unstructured status conversation. Written decision records prevent different participants from leaving with incompatible interpretations. Assigning an owner and due date to every action converts feedback into executable delivery work. Options A, C, and D depend heavily on memory, provide inadequate preparation time, and create weak decision traceability. In-flight deployments particularly require documented feedback because accepted changes may affect scope, cost, risk, testing, and release timing.

Study Guide references/topics: Stakeholder feedback; decision records; action ownership; lifecycle alignment; communication planning.

Four distinct workflow domains indicate that the agent’s responsibilities have expanded beyond a cohesive capability boundary. Decomposing the deployment into domain-focused agents reduces each agent’s tool-selection space and produces clearer prompts, permissions, evaluations, and ownership. Option E strengthens this conclusion because placing a model-based router before the existing overloaded agent adds latency, cost, and another failure point without correcting the underlying capability sprawl. Overlapping descriptions should be clarified, while unused tools may simply be removed; neither finding alone proves that separate domain agents are required. Public documentation of a pattern is not evidence that it fits this workload. Anthropic emphasizes simple composable patterns, clearly differentiated tools, and empirical evaluation before adding orchestration complexity. Building Effective Agents

A minimal reproduction and MCP status inspection are foundational diagnostic actions because they produce direct, interpretable evidence. A minimal reproduction removes unrelated prompts, tools, settings, hooks, and repository state while changing one variable at a time. This determines whether the failure follows a particular configuration, server, command, model request, or project artifact. It also creates a reproducible evidence package if escalation later becomes necessary.

MCP inspection addresses a common Claude Code failure domain. `claude mcp list` displays configured servers and their health states, including connected, authentication-required, pending-approval, and failed-to-connect conditions. `claude mcp get < name > ` provides server-specific details, while `/mcp` exposes status within an interactive session. These checks distinguish model behavior from transport, authentication, configuration, and workspace-trust failures.

Increasing temperature reduces repeatability and introduces additional variation, making root-cause isolation more difficult. Filing a support ticket before collecting local evidence reverses the appropriate diagnostic sequence. An immediate rollback may eventually be used as a controlled version comparison, but it changes the environment before a baseline has been captured and is therefore not a primary toolkit action.

Study Guide references/topics: [Managing and diagnosing MCP servers](https://docs.anthropic.com/en/docs/claude-code/mcp); minimal reproducible cases; controlled-variable troubleshooting; authentication and connection-state diagnostics.

===============

Function-level or section-level chunking for code modules — Code or Hierarchical Specifications

Tree-aware chunking that follows code or specification hierarchy — Code or Hierarchical Specifications

Per-record chunking where each record is one chunk — Heterogeneous Short Records

Semantic chunking along clause or paragraph boundaries — Long Structured Documents

Fixed-size chunking with overlap for short records of similar length — Heterogeneous Short Records

Hierarchical chunking that mirrors document section structure — Long Structured Documents

Chunking must preserve the structural unit that carries meaning in the source corpus. Code and hierarchical specifications are best divided at function, module, class, or tree boundaries because arbitrary token cuts can separate definitions from their implementation or parent context. Heterogeneous short-record collections should generally preserve each record as an independent chunk. Fixed-size overlapping chunks are also effective when records have broadly similar lengths and lack meaningful internal hierarchy. Long structured documents benefit from semantic boundaries such as clauses and paragraphs, while hierarchical chunking preserves relationships among sections, subsections, and parent headings. Anthropic notes that chunk size, boundaries, and overlap materially affect retrieval performance; therefore, one universal chunking method is inappropriate. Anthropic Contextual Retrieval

Federated authorship allows each domain team to maintain the procedural knowledge it understands while preserving organization-wide trust through a central publication gate. Team authors can update coding standards, review practices, and postmortem procedures without waiting for a single platform group to write every change. Central reviewers can validate ownership, security, tool permissions, duplication, versioning, testing evidence, and compliance before publication. Per-developer or fully decentralized publication creates inconsistent and potentially unsafe Skills. Fully centralized authorship becomes a scalability bottleneck and separates content maintenance from domain expertise. Anthropic describes Skills as packages of instructions, scripts, and resources and warns that repository Skills may grant broad tool access, making formal review essential. Claude Code Skills

The prompt contains mutually incompatible behavioral requirements. The architect should resolve the contradiction explicitly so the model receives one coherent grounding policy. If the application requires source-supported answers, the prompt should prohibit unsupported completion, permit an insufficient-evidence response, and require citations or supporting passages. Adding another priority instruction leaves the underlying conflict in place and creates ambiguity about when speculation is permitted. Increasing temperature makes behavior more variable rather than more correct. Retaining both instructions produces inconsistent outputs across requests and model versions. Anthropic recommends clear, direct, specific prompting and notes that conflicting project instructions can cause Claude to select among them unpredictably. Prompting best practices; project-instruction troubleshooting

Model identity and version are essential diagnostic dimensions. Without them, operators cannot correlate a behavioral change with a model migration, reproduce the conditions of a failed turn, compare performance among model versions, or distinguish model drift from prompt, retrieval, and application defects. Therefore, the omission described in Option D is a genuine observability gap.

Option E is equally significant. A multi-agent execution normally crosses orchestration, model, agent, MCP, and tool boundaries. If the request-scoped correlation identifier or distributed trace context is lost at any boundary, the resulting spans cannot reliably be reconstructed into one end-to-end transaction. Anthropic’s monitoring guidance explains that distributed tracing links a user prompt to the API requests and tool executions it initiates; it also documents propagation of W3C trace context to supported subprocesses and outbound MCP requests. Claude Code Monitoring

Options A and B describe healthy telemetry coverage rather than gaps. Option C is also appropriate because recording tool interactions supports investigation, while redaction reduces the risk of exposing sensitive data in logs.

Study Guide references/topics: Integration—observability challenges at scale; distributed tracing; correlation identifiers; model-version attribution; privacy-aware tool telemetry.

===============

Option A combines the contractual, technical, and operational measures relevant to a defensible GDPR posture. For commercial services, the Data Processing Addendum defines processor obligations and incorporates safeguards such as Standard Contractual Clauses where applicable. Anthropic states that its DPA is incorporated into its Commercial Terms, while the customer remains responsible for determining lawful purposes, issuing processing instructions, and fulfilling controller obligations.

A defined retention configuration ensures personal data is not retained indefinitely without a documented purpose. Redacting personal information that is unnecessary for the task implements data minimization and reduces exposure in prompts, logs, retrieval stores, and model outputs. Documented data-subject-rights procedures support access, correction, deletion, restriction, and other applicable requests by ensuring the organization can locate and act on relevant records.

Enterprise deployment alone does not establish compliance; the organization must configure and govern the service consistently with its processing activities, risk assessment, lawful basis, and contractual commitments. Options B, C, and D intentionally remove those controls or promote excessive collection.

Study Guide references/topics: [Anthropic Data Processing Addendum guidance](https://privacy.anthropic.com/en/articles/7996862-how-do-i-view-and-sign-your-data-processing-addendum-dpa); [commercial data-retention practices] (https://privacy.anthropic.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data); GDPR data minimization; retention governance; data-subject-rights procedures.

===============

Option B uses progressive disclosure to meet the decision needs of both audiences. The executive sponsor first receives the selected direction, intended business outcomes, major constraints, cost or performance implications, and accepted trade-offs. This establishes why the decision matters and whether it remains aligned with strategic objectives.

The presentation can then move into the technical rationale required by engineering leads: component responsibilities, integration contracts, model and retrieval choices, security controls, rejected alternatives, implementation dependencies, evaluation gates, operational consequences, and migration requirements. This structure gives engineers enough evidence to implement the decision without forcing the executive audience to interpret unnecessary low-level detail.

Option A excludes the sponsor’s concerns and fails to connect technical design to business value. Option C removes the context required for governance and implementation, making the decision appear arbitrary. Option D assumes that all participants require identical information density, which usually produces a presentation that is too technical for executives and insufficiently precise for engineers.

The strongest communication pattern is layered but internally consistent: one decision, one rationale, and multiple levels of detail tailored to the responsibilities of the audience.

Study Guide references/topics: Mixed-audience communication; progressive disclosure; business outcomes; architectural trade-offs; technical rationale; implementation implications.

===============

The observed sequence provides direct causal evidence: the initial connection was interrupted while the operating system awaited authorization, and later attempts succeeded after permission was granted. The correct response is to verify repeatability, document the first-run requirement, and incorporate it into installation or onboarding instructions. Reinstalling the operating system is disproportionate and destroys useful diagnostic state. Disabling permission dialogs weakens endpoint security and bypasses the control rather than addressing expected behavior. Replacing a server that operates correctly after authorization misclassifies a transient initialization condition as a permanent defect. Claude Code uses explicit permission controls to balance capability and safety, so first-use approval behavior should be accommodated rather than suppressed. Claude Code permissions

Executive sponsors generally need architecture decisions translated into business significance. The briefing should explain what outcomes the retrieval architecture enables, why the chosen approach is valuable, which material trade-offs were accepted, and what major risks require awareness or sponsorship. This allows the executive to assess strategic alignment, investment value, and organizational exposure without becoming immersed in component-level implementation details. Option A is more appropriate for architects and engineering teams conducting a technical review. Option C is primarily suited to product and program stakeholders managing features, scope, and roadmap dependencies. Option D is designed for security, compliance, and risk-governance audiences requiring detailed control evidence. Although those perspectives remain important, option B provides the concise, outcome-oriented framing needed for an executive architectural decision summary.

================

The workflow must first identify where human judgment is necessary. Option E applies risk-based oversight by examining each decision’s impact and reversibility. High-impact, irreversible, externally binding, privacy-sensitive, or legally consequential actions require stronger review than low-risk draft generation or easily reversible recommendations.

After locating those control points, Option A defines how work reaches reviewers. The sampling strategy should specify whether review is universal, random, risk-triggered, confidence-based, or stratified. Escalation criteria should cover policy violations, uncertain outputs, conflicting evidence, sensitive data, failed validation, and cases exceeding the reviewer’s authority.

Anthropic recommends human confirmation for decisions with meaningful real-world consequences and actions requiring affirmative consent. Computer Use Security Considerations

Option B necessarily follows the pilot because findings must exist before design iteration. Reviewer onboarding and operational documentation in Options C and D are important readiness activities, but they follow the core design decisions being tested by this item: where oversight is required and how cases are sampled and escalated.

The completed pilot plan should subsequently include trained reviewers, documented procedures, queue capacity, SLAs, audit evidence, and measured inter-reviewer agreement.

Study Guide references/topics: Human-in-the-loop design; impact and reversibility; oversight points; sampling; escalation criteria; consequential decisions.

===============

The network-boundary requirement is a mandatory architectural constraint; therefore, Option D must be resolved before evaluating operational savings. Managed infrastructure can reduce responsibility for agent loops, sandboxes, session state, recovery, and orchestration, but those advantages are immaterial if financial data leaves the approved boundary. Anthropic describes Claude Managed Agents as a hosted agent harness and provides configurable data-residency controls. The architect must still validate inference location, session persistence, encryption, subprocessors, credential handling, auditability, and deletion behavior against the organization’s exact security policy. Options A, B, and C affect migration effort or economics, but they cannot override a non-negotiable data-governance requirement.

Study Guide references/topics: Architectural constraints; managed versus self-hosted agents; data boundaries; residency; security-gated decision-making.

Yes, Yes, Yes, No, No

Dense vector retrieval represents semantic similarity, making it suitable for matching paraphrases and conceptually related language even when the query and source do not share identical words. Sparse lexical retrieval, including BM25-style matching, retains strong sensitivity to exact tokens and is therefore valuable for identifiers, product codes, technical names, and uncommon terminology.

Structured query retrieval is appropriate when the required operation depends on explicit fields, predicates, joins, counts, grouping, or aggregation over a relational schema. In that situation, generating or invoking a constrained database query is more precise than approximating the operation through semantic similarity.

Hybrid retrieval is not identical to dense retrieval. It combines semantic and lexical candidate sets, typically followed by rank fusion or reranking. Anthropic’s contextual-retrieval guidance explains that semantic search captures meaning and paraphrases, while BM25 captures exact terminology; combining them improves coverage. Contextual Retrieval, Contextual Retrieval Cookbook

Random sampling is not a relevance strategy. It provides no systematic relationship between the query and selected evidence, producing unstable coverage and preventable hallucination risk. Production Q & A requires deterministic or evaluated relevance mechanisms, access filters, suitable indexes, and measurable retrieval metrics such as recall at k.

Study Guide references/topics: Dense retrieval; sparse retrieval; structured queries; hybrid search; rank fusion; retrieval evaluation; production RAG design.

===============

Risk-stratified sampling concentrates limited reviewer capacity where error consequences and uncertainty are greatest. All low-confidence and high-impact cases should receive mandatory review, while random sampling of routine high-confidence outputs provides an unbiased signal for drift, unexpected failure modes, and overconfident errors. Complaint-only monitoring discovers defects after harm occurs. Reviewing only high-confidence cases systematically ignores the most dangerous outputs. Universal review provides maximum coverage but contradicts the stated throughput constraint and may create queues that undermine service objectives. The sampling policy should define confidence calibration, impact categories, escalation thresholds, review SLAs, and periodic adjustment based on observed error rates. Reviewer decisions should feed the evaluation dataset so monitoring quality improves over time.

A controlled prompt experiment must begin with a falsifiable hypothesis and a predefined primary metric. Option C prevents the team from examining results first and then selecting whichever metric makes the candidate look successful. The metric might measure task accuracy, rubric score, citation validity, escalation rate, latency, cost, or another criterion directly connected to the hypothesis.

Option A determines whether the experiment can detect a practically meaningful improvement. The minimum detectable effect expresses the smallest difference worth acting upon, while the power calculation determines the required sample size. Without this step, the experiment may be too small to detect a real improvement or unnecessarily large and expensive.

Random assignment should then distribute representative traffic between the control and candidate prompts while controlling model version, retrieval configuration, tool availability, and other confounding variables.

Options B and D occur after data collection. Option E follows the completed analysis and decision. The team should also define significance thresholds, stopping rules, guardrail metrics, exclusion criteria, and treatment of repeated observations before launch.

Study Guide references/topics: Prompt A/B testing; hypothesis definition; primary metrics; minimum detectable effect; statistical power; random assignment; decision sequencing.

===============

Before a pilot begins, the architect must understand the workflows being enabled, the associated security boundaries, and the correct ownership of each configuration decision. Option D establishes this foundation. Organization-wide, non-overridable controls belong in managed configuration, whereas repository-specific MCP servers, shared permissions, and team subagents generally belong in project scope.

Option A then converts those decisions into an initial project baseline that the pilot group can use. The baseline should identify approved MCP endpoints, minimum permission rules, denied operations, subagent responsibilities, configuration ownership, and observable success criteria. Anthropic distinguishes managed, user, project, and local scopes according to who they affect and whether they are shared with the team. Claude Code Configuration Scopes

Options B and C are broad-rollout activities and should not occur before pilot evidence is available. Option E is explicitly post-pilot: findings must first be collected before the configuration can be iterated and stabilized.

The correct lifecycle is discovery, boundary definition, baseline design, limited pilot, evidence review, baseline refinement, documentation and training, followed by controlled expansion with a support and rollback process.

Study Guide references/topics: Claude Code rollout planning; scope ownership; MCP baselines; permission design; pilot strategy; operational enablement.

===============

Credentials must never be supplied as prompt content. Prompts can be retained in traces, debugging output, caches, or logs, and model output may inadvertently expose included secrets. Credentials should instead be resolved server-side through an approved secret store or delegated authentication mechanism. Option C is also a serious gap because post-response RBAC occurs after unauthorized data has already entered model context. Authorization must be enforced before retrieval and prompt construction. Options A, D, and E describe appropriate controls: least-privilege service identities, per-user scoped OAuth, and encrypted transport. Anthropic’s prompt-leak guidance recommends excluding unnecessary sensitive information, while Claude Code security relies on permission-based enforcement rather than natural-language instructions alone. Reduce prompt leak

Structured discovery begins by eliciting constraints from the people who own the business outcome, operate the process, manage risk, and will use or support the deployed system. Stakeholder workshops in Option A identify measurable expectations concerning accuracy, latency, throughput, cost, privacy, compliance, escalation, and acceptable failure behavior before the solution is scoped.

Option D converts those expectations into production gates. Success criteria must be explicit enough to evaluate empirically, while failure thresholds must determine when the design requires remediation, human review, or rejection. Anthropic’s evaluation guidance states that successful LLM applications begin with defined success criteria and evaluations that measure performance against them. It characterizes strong criteria as specific, measurable, achievable, and relevant. Define Success Criteria and Build Evaluations

Option B prematurely selects a model before the workload profile is known. Option C can supplement discovery, but reaction-driven prototyping cannot replace documented requirements and acceptance criteria. Option E postpones essential constraints until architectural commitments may already have been made.

The discovery output should create traceability from stakeholder objectives to requirements, evaluation metrics, architecture decisions, and deployment gates.

Study Guide references/topics: Structured discovery; stakeholder workshops; nonfunctional requirements; success criteria; failure thresholds; production readiness gates.

===============

Option B is the only configuration establishing the contractual, data-handling, and audit foundations needed for a HIPAA-eligible deployment. Anthropic requires an eligible commercial organization to activate the HIPAA-ready configuration and accept a Business Associate Agreement. A standard Enterprise subscription is not automatically covered merely because it is an enterprise product. Anthropic BAA Guidance

Zero Data Retention may be required for particular covered services, including eligible Claude Code configurations, and is enabled per organization for qualified accounts. Audit logging supports access review, configuration monitoring, incident investigation, and compliance evidence. Anthropic provides audit logs for Enterprise organizations. Claude Code Legal and Compliance, Access Audit Logs

Options A and D use consumer or personal accounts without the required contractual framework. Option C incorrectly treats the elimination of audit evidence as a substitute for a BAA and compliant configuration.

The signed BAA remains the authoritative source for covered products and features. The customer must also configure access control, minimum-necessary data use, workforce policies, retention, integrations, incident response, and vendor-risk controls. The configuration supports compliance; it does not independently guarantee it.

Study Guide references/topics: HIPAA readiness; BAA; ZDR; PHI handling; audit logging; eligible services; shared compliance responsibility.

===============

Authorization must be enforced before restricted information enters model context. The retrieval service should authenticate the user, resolve role and document permissions, and filter candidate records before prompt construction. This prevents unauthorized content from appearing in prompts, model traces, cached context, tool results, or generated responses. A system-prompt instruction is behavioral guidance, not an enforceable access-control boundary. Post-generation filtering is also inadequate because the model has already received and processed the restricted data, creating exposure through output, logging, or indirect inference. Relying on general refusal behavior provides no deterministic authorization. The correct architecture treats RBAC as an application and data-layer control, with the model receiving only information the requesting principal is entitled to access.

Study Guide references/topics: Retrieval-layer RBAC; authorization before inference; least privilege; sensitive-context isolation.

Authorization and compliance logging must remain enforceable application-layer controls. Option B requires the application to authenticate the requester, resolve the user’s role and entitlements, and deny the operation when the user lacks authority. A Skill can instruct Claude how to behave, but it is not a reliable security boundary and cannot replace identity-based access control enforced by the surrounding system.

Option A similarly belongs at the application layer. The application must create an authoritative audit event containing the requester, timestamp, Skill and model version, relevant input or content identifiers, generated output, review status, and retention classification. Audit evidence cannot depend on whether the model remembers or chooses to invoke a logging instruction.

Options C, D, and E describe reusable generation behavior that appropriately belongs within the approved Skill: house style, the standardized disclaimer, and the prohibited-language policy. The application may still validate their presence after generation, but the Skill remains the primary reusable content package.

The correct architecture separates behavioral guidance from deterministic enforcement. Skills supply domain instructions and templates; the application enforces identity, authorization, audit retention, data access, output validation, and consequential-action controls.

Study Guide references/topics: Skills versus application controls; authentication; authorization; compliance logging; deterministic guardrails; policy enforcement boundaries.

===============

Transaction value is only one component of risk. Even a small refund can create fraud exposure, discriminatory outcomes, contractual violations, account compromise, policy inconsistency, or cumulative financial loss. Delegation should therefore depend on the nature, detectability, reversibility, and aggregate impact of failure—not a monetary threshold alone. Option B supports risk-stratified automation: routine, well-evidenced cases may proceed automatically, while anomalous, identity-sensitive, disputed, or policy-edge cases require review or escalation. Anthropic’s trustworthy-agent principles emphasize maintaining meaningful human control rather than imposing universal review or unrestricted autonomy. Option A is unnecessarily absolute; Option C prioritizes efficiency over governance; and Option D prohibits potentially safe, controlled automation without risk analysis.

Study Guide references/topics: Delegation competency; human control; risk classification; reversibility; cumulative exposure; escalation design.

AI-generated code requires verification through the same controlled engineering workflow as human-authored changes. Removing review eliminates the gate that can detect incorrect assumptions, security defects, missing tests, and unintended behavior. Line count is not a defensible risk measure: a one-line authorization change, dependency alteration, or command-execution defect can be more consequential than a large documentation update. Review requirements should instead be determined by affected components, privilege, data sensitivity, reversibility, test coverage, and deployment impact. Expanding capacity may be operationally useful but is not the central diligence objection. Raising the threshold retains the same flawed proxy, while rejecting all AI-generated changes discards legitimate productivity benefits. Anthropic states that users remain responsible for reviewing proposed code and commands. Claude Code security

Observation 1 is a direct efficiency improvement because the time required for one summarization task fell substantially. Observation 2 shows that local time savings have not yet translated into higher organizational productivity or billable output. Observation 3 is explicitly a solution-cost problem caused by unnecessary API calls. Observation 4 introduces additional human correction time and therefore partially offsets the gross efficiency gain reported in Observation 1. Option D is the only answer that keeps these value dimensions distinct. Measuring only generation speed would overstate realized value because review effort, retry costs, and downstream output must also be included. A valid post-deployment assessment should calculate net cycle time, cost per accepted summary, correction rate, and resulting business output.

Option C provides the minimum coherent package required to move from architectural intent to implementable and supportable delivery. The architecture overview establishes system boundaries and component relationships. Architecture Decision Records preserve the context and trade-offs behind key choices. Component contracts define interfaces, schemas, responsibilities, failure behavior, and integration assumptions.

The evaluation framework and reference set allow the implementation team to confirm that prompts, models, retrieval components, and tool integrations continue to meet the defined quality, safety, latency, and cost thresholds. Runbooks translate operational knowledge into repeatable procedures, while the on-call playbook defines detection, escalation, containment, and recovery actions. The known-limitations register prevents unsupported behavior from being mistaken for an implementation defect and helps stakeholders manage residual risk.

Options A and B depend excessively on slides or undocumented verbal knowledge. Option D provides implementation material without explaining the system-level decisions, operating model, acceptance criteria, or limitations. Source code cannot substitute for architectural and operational documentation.

A clean transition does not mean the architect can never be consulted. It means routine implementation and support do not depend on undocumented knowledge held by a single individual.

Study Guide references/topics: Design-to-implementation handoff; ADRs; component contracts; reference evaluations; runbooks; operational playbooks; limitations management.

===============