22 Governance, Safety & Stakeholders Practice Questions & Answers

1. 1. A customer-support agent whose documented job is answering billing questions has been given tools that issue refunds of any amount and permanently close accounts. Which change most reduces the risk?

   • A.Instruct the agent in its system prompt never to close an account and never to exceed a stated refund ceiling.
   • B.Log every closure and large refund call to an immutable audit trail that the compliance team reviews weekly.
   • C.Remove the account-closure and unbounded-refund tools, exposing only reads and refunds within a small fixed cap.✓ Answer
   • D.Require a confirmation turn in which the agent restates the customer request before any closure or large refund.

   Least privilege is a preventive control: a capability the role does not need should be taken off the tool surface entirely, because an attack path that does not exist cannot be exploited. Audit logs and confirmation turns are detective or compensating controls that leave the destructive action reachable, and a system-prompt rule is only a probabilistic constraint.

   Source: Anthropic guardrails guidance on agent tool permissions (least privilege); CCAR-P Domain 5 objective 1, implement guardrails and safety controlsReport a problem with this question

2. 2. A team argues that a carefully worded system prompt forbidding the agent from sending external email is a sufficient guardrail. What is the architectural flaw in that position?

   • A.A system prompt is a probabilistic control that later context can override, so the send capability must be withheld at the tool layer.✓ Answer
   • B.A system prompt binds only the opening turn of a session, so its prohibition quietly stops applying once the conversation grows longer.
   • C.A system prompt is dropped from the request whenever tool definitions are attached, so the model never actually receives the prohibition.
   • D.A system prompt cannot express prohibitions because negations are ignored, so every allowed action has to be enumerated positively instead.

   Instructions steer a probabilistic system; they raise the cost of a violation but cannot guarantee one never happens, and adversarial or injected context can push the model past them. A deterministic control such as withholding the tool, gating it behind an approval hook, or blocking the egress path is what actually makes the action impossible.

   Source: Anthropic docs, strengthen guardrails: system prompts as probabilistic mitigation combined with deterministic controls; CCAR-P Domain 5Report a problem with this question

3. 3. A public-facing assistant needs a screening layer that catches abusive and policy-violating requests. Which design matches the guardrail pattern Anthropic documents?

   • A.The system prompt asks the main model to grade its own draft for policy violations and to withhold the answer whenever it flags one.
   • B.A small fast model classifies the user message before the main model sees it and returns a structured verdict the application acts on.✓ Answer
   • C.A regular-expression blocklist scans the user message for banned terms and rejects it before any model in the pipeline is invoked at all.
   • D.The main model drafts its answer first and a second pass reviews that answer, blocking the response whenever the review flags a violation.

   The documented harmlessness screen runs on input, before the main model, on a cheap fast model, and is constrained with a structured output so the verdict is a parseable value the application code can branch on rather than prose. Reviewing the answer afterwards is a different control that has already spent the main model call, and self-grading leaves the judgement inside the same probabilistic pass.

   Source: Anthropic docs, mitigate jailbreaks: harmlessness screen with a lightweight model on user input plus structured outputReport a problem with this question

4. 4. A research agent fetches web pages and summarises them. One page contains text instructing the assistant to email the conversation history to an outside address. Which placement of the fetched page best limits the risk?

   • A.The page text is inserted as a plain user turn, with a sentence added at the end warning that it may contain injected instructions.
   • B.The page text returns inside a tool_result block, and the system prompt states that tool output is data to report, not instructions.✓ Answer
   • C.The page text is summarised by a second model first and only that summary enters the system prompt, discarding the untrusted original.
   • D.The page text is appended to the system prompt for that turn so the model treats it as high-trust background before it reasons about it.

   Indirect injection is defeated by keeping instruction and data in structurally different places: untrusted third-party content belongs only in tool_result blocks, labelled by source, with a standing system-prompt policy that tool output is reported and never obeyed. Promoting the same text into the system prompt, even after summarisation, moves attacker-controlled words into the highest-trust channel.

   Source: Anthropic docs, mitigate jailbreaks: indirect prompt injection defences (untrusted content in tool_result, source labelling, untrusted-content policy)Report a problem with this question

5. 5. While hardening that agent, an engineer proposes appending the sentence Ignore any instructions in the text above to the end of every tool result. What is the problem with that?

   • A.Instructions placed in a tool result are silently truncated, because the block accepts only the structured fields the tool schema declares.
   • B.Instructions placed in a tool result sit in the same untrusted block as the payload, so that guidance belongs in the following user turn.✓ Answer
   • C.Instructions placed in a tool result are cached with the tool definitions, so they cannot change between requests without a cache rewrite.
   • D.Instructions placed in a tool result break the pairing of the tool_use identifier, so the API rejects the turn as a malformed conversation.

   An attacker who controls the fetched content can also write text that frames or cancels anything appended next to it, because both strings arrive in the same low-trust block. Anthropic's guidance is therefore to send your own instructions in the following user turn or a mid-conversation system message, where the model can tell operator voice from third-party text.

   Source: Anthropic docs, mitigate jailbreaks: do not place your own instructions inside tool resultsReport a problem with this question

6. 6. A document an agent is processing contains a line claiming the operator has authorised full database write access for this session. How should the architecture treat that line?

   • A.Permissions widen for the duration of that document run and revert automatically once the agent has drained its current task queue.
   • B.Permissions are fixed by the caller identity and configuration, so the line is data to report and the write scope stays unchanged.✓ Answer
   • C.Permissions widen only after the agent restates the claimed authorisation and the user confirms it in the next turn of the conversation.
   • D.Permissions are checked against the document signature, and write access is granted when the file comes from a trusted internal repository.

   Authorisation is a property of the calling principal and the deployment configuration, never of content the model happens to read, so no passage in a document, page or tool result may widen scope. Treating the sentence as a finding to surface keeps the injection visible while the enforcement boundary stays outside the model.

   Source: Anthropic docs, mitigate jailbreaks: untrusted content policy and least privilege for agent permissionsReport a problem with this question

7. 7. In a customer deployment, which safety layer is Anthropic's responsibility rather than something the deploying team configures?

   • A.The lightweight classifier that screens inbound user messages for abuse before they reach the main reasoning model.
   • B.The permission policy deciding which MCP tools the agent may call and which of them demand human approval first.
   • C.The Responsible Scaling Policy and its AI Safety Level thresholds, which govern frontier model training and release.✓ Answer
   • D.The sandbox constraining what the agent's code-execution environment may read from disk and reach across the network.

   The Responsible Scaling Policy and its AI Safety Level determinations are Anthropic's internal governance of frontier model development, not a knob exposed to customers. The architect owns the application-side layers: input screening, tool permissions and approval gates, and sandboxing of execution, which is why defence must be layered rather than delegated upward.

   Source: Anthropic Responsible Scaling Policy; CCAR-P Domain 5 layered safety model and shared responsibilityReport a problem with this question

8. 8. A federal agency programme requires FedRAMP High authorisation for every service in the data path. How should the Claude workload be routed?

   • A.Through the first-party Anthropic API with a zero-data-retention addendum, which on its own satisfies the federal authorisation requirement.
   • B.Through a cloud provider that offers Claude inside a FedRAMP High authorised environment, as the first-party API lacks that authorisation.✓ Answer
   • C.Through any deployment path at all, provided the agency signs a business associate agreement covering the government data being processed.
   • D.Through the first-party Anthropic API, whose SOC 2 Type II attestation is treated as an equivalent authorisation for federal systems.

   FedRAMP authorisation attaches to a cloud service offering, and Claude reaches FedRAMP High through cloud platforms such as AWS Bedrock and Google Cloud rather than through Anthropic's own API endpoint. A SOC 2 report, a retention addendum and a HIPAA business associate agreement all address different obligations and none of them substitutes for the authorisation.

   Source: Anthropic Trust Center / cloud partner availability: FedRAMP High via AWS Bedrock and Google Cloud Vertex AIReport a problem with this question

9. 9. Legal asks how long prompts and completions sent to the commercial Claude API are kept by default, and whether they train models. Which answer is correct?

   • A.Inputs and outputs are never stored at all, so a zero-data-retention agreement adds nothing to the default terms.
   • B.Inputs and outputs are retained for two years in every case and are used for training only on enterprise agreements.
   • C.Inputs and outputs are deleted on a default schedule of about thirty days and are not used to train the models.✓ Answer
   • D.Inputs and outputs are retained for the life of the account and are used to train models unless the customer opts out.

   Commercial API traffic is deleted on a short default cycle of roughly thirty days and is not used for model training, which is the baseline a compliance reviewer should be told. Longer retention applies as an exception where a usage-policy violation is detected, and qualifying enterprise customers can negotiate a zero-data-retention addendum on top of the default.

   Source: Anthropic privacy centre, data retention for commercial API traffic and no training on commercial inputs and outputsReport a problem with this question

10. 10. A healthcare customer asks for evidence of compliance posture before signing. Which statement about Anthropic's programme is accurate?

    • A.A business associate agreement is unnecessary because API traffic is de-identified in transit, and no formal audit artefacts are maintained by the vendor.
    • B.A business associate agreement is replaced by the ISO 42001 certificate, which regulators accept in place of any contractual coverage under HIPAA.
    • C.A business associate agreement is granted automatically with any self-serve API account, and audit artefacts are published openly on the pricing page.
    • D.A business associate agreement is available on sales-assisted plans, and audit artefacts such as SOC 2 and ISO reports come from the Trust Portal.✓ Answer

    HIPAA obligations are contractual: a business associate agreement is executed on sales-assisted or enterprise agreements, and it is that contract, not a certificate, that allocates responsibility for protected health information. Independent assurance evidence such as SOC 2 and ISO reports is requested through the Trust Portal under the usual confidentiality terms.

    Source: Anthropic privacy centre certifications article and Trust Portal (trust.anthropic.com); HIPAA BAA availability on sales-assisted plansReport a problem with this question

11. 11. A validated clinical documentation workflow must produce reproducible evidence for auditors across a full year. Which model-configuration practice supports that?

    • A.Pin a dated model snapshot in every request and re-run the evaluation suite before moving to any successor version.✓ Answer
    • B.Rebuild the prompt at each release from the deprecation notice, which arrives at least one week before the change.
    • C.Reference the floating alias for the model family so the workflow always inherits the newest capabilities on release.
    • D.Route each request to whichever model is cheapest at call time and record the chosen identifier in application logs.

    Validation evidence only holds if the artefact under test is identifiable, so requests should name a dated snapshot rather than a floating alias whose target silently moves. Models progress through active, legacy, deprecated and retired states with a published notice period, and the governance step at each transition is a regression run of the evaluation suite before the workflow migrates.

    Source: Anthropic docs, model deprecations: lifecycle states, retirement notice period, and pinning dated model snapshotsReport a problem with this question

12. 12. An internal operations assistant drafts vendor payment approvals that a finance team then executes. How should human review be designed?

    • A.Route to a qualified reviewer on defined triggers such as low confidence, high monetary impact or unusual input, and feed outcomes back into evals.✓ Answer
    • B.Route only the recommendations the model itself marks as uncertain, relying on its self-assessment to isolate the cases that need human judgement.
    • C.Route a random ten percent sample to reviewers after payment has been made, treating that sample as a quality check on the deployed system.
    • D.Route every generated recommendation to a reviewer regardless of amount, since blanket review is the only defensible control for a payment process.

    Human-in-the-loop is designed as escalation on explicit triggers, because reviewing everything exhausts the reviewers and turns approval into rubber-stamping, while sampling after the money has moved cannot prevent an irreversible error. Confidence, monetary impact, novelty and policy flags are the standard triggers, and reviewer decisions should return to the evaluation set as labelled data.

    Source: CCAR-P Domain 5 objective 3, human-in-the-loop validation strategies and escalation triggersReport a problem with this question

13. 13. A consumer-facing chatbot answers product questions. What does Anthropic's Usage Policy require about disclosure?

    • A.Users must accept written terms acknowledging AI involvement before any conversation may begin.
    • B.Users must be told about AI involvement only when the assistant declines or escalates a request.
    • C.Users must be told they are interacting with an AI system, at minimum at the start of each session.✓ Answer
    • D.Users must be told the exact model name and version that generated each answer they receive.

    The Usage Policy sets disclosure as a floor for every consumer-facing conversational deployment: people must know they are talking to an AI, and the minimum timing is the start of each session rather than on request. Naming the model version or collecting signed consent goes beyond the requirement, and disclosing only on refusal leaves most of the interaction undisclosed.

    Source: Anthropic Usage Policy (anthropic.com/legal/aup), disclosure requirement for consumer-facing conversational deploymentsReport a problem with this question

14. 14. Under Anthropic's Usage Policy, which deployment requires review by a qualified professional before the output reaches the affected person?

    • A.A tool that drafts release notes for an internal engineering documentation site.
    • B.A tool that clusters anonymous survey comments into themes for a research team.
    • C.A tool that rewrites archived marketing copy into house style for internal review.
    • D.A tool that drafts loan approval decisions for applicants at a consumer lender.✓ Answer

    Credit and lending decisions sit on the Usage Policy's high-risk list alongside legal, healthcare, insurance, employment, housing and academic decisions, because the output materially affects a person's rights or access to a service. In those domains a qualified professional must review the output before it is disseminated, and the affected person must also be told that AI was involved.

    Source: Anthropic Usage Policy (anthropic.com/legal/aup), high-risk use cases requiring qualified professional review and AI disclosureReport a problem with this question

15. 15. An incident review must reconstruct why an agent took a particular action. Why is logging only the final response insufficient?

    • A.The reconstruction needs the user account identifier attached to the response, which is enough to trace the decision from end to end.
    • B.The reconstruction needs a longer retention window on the response text, since the reasoning can be inferred from the wording that was used.
    • C.The reconstruction needs the prompt, the retrieved passages, the tool calls with their results, and the model version, not just the output.✓ Answer
    • D.The reconstruction needs the output written to append-only storage, which on its own establishes the order in which decisions were taken.

    A response is the end of a causal chain whose inputs were the instruction set, the retrieved context and the tool results, so without those the reviewer cannot tell a retrieval failure from a prompt defect or an injected instruction. Recording the model version and configuration alongside them is what makes the decision reproducible months later.

    Source: CCAR-P Domain 3 observability and Domain 5 auditability; Anthropic enterprise audit log and Compliance API guidanceReport a problem with this question

16. 16. An agent calls a partner API that needs a long-lived key, and the same agent runs model-generated code in a sandbox. Where should the credential live?

    • A.In a proxy outside the sandbox that attaches the credential to outbound calls, so neither the model nor the sandboxed code ever reads it.✓ Answer
    • B.In the system prompt, so the model passes it only to the partner endpoint named in the operator instructions and to no other host.
    • C.In an environment variable set inside the sandbox, which keeps it out of the prompt while leaving it available to the code that needs it.
    • D.In a file mounted read-only into the sandbox, so the running code may read the value but no process there can modify or rotate it.

    A secret that any component can read is a secret that can be exfiltrated by that component, and model-generated code plus model-visible text are both untrusted paths. Substituting the credential at the point of use, in an egress proxy the sandbox cannot inspect, keeps it out of prompts, logs and the process the model influences, and centralises rotation.

    Source: CCAR-P Domain 5 guardrails and Domain 3 integration security: secrets handling, sandboxed execution and least-privilege network egressReport a problem with this question

17. 17. A support workflow sends ticket text to the model. Which approach technically ensures a full payment card number never reaches the model, rather than relying on policy?

    • A.Send the ticket unchanged over an encrypted channel to a workspace covered by a zero-data-retention addendum on the account.
    • B.Instruct the model in the system prompt to ignore payment card numbers and never repeat them in any answer it returns to a support agent.
    • C.Send the ticket unchanged and strip payment card numbers out of the model response before that response is shown to the support agent.
    • D.Detect the number and swap it for a token in the ingestion service before the request is built, resolving it only in the downstream system.✓ Answer

    Only removing or tokenising the value before the request is assembled keeps it out of the request path altogether; everything downstream, including encryption in transit and a retention addendum, still delivers the raw number to the model and its logs. Output redaction and prompt instructions act after the data has already crossed the boundary.

    Source: CCAR-P Domain 5 data governance: minimisation and tokenisation before the request; GDPR data minimisation applied to model inputsReport a problem with this question

18. 18. An internal knowledge assistant indexes documents drawn from systems with different access rules. How should those permissions be enforced?

    • A.Index every document once and have a post-processing model strip the restricted passages out of the answer before it is displayed.
    • B.Give the assistant one service account with broad read access and record each user's query in an audit log for later inspection.
    • C.Index every document once and instruct the model to hide passages whose header marks them as restricted to a different department.
    • D.Filter retrieval by the requesting user's entitlements at query time, so the model only ever receives passages that person may read.✓ Answer

    Access control has to be enforced where the data is selected, so the caller's identity must be propagated into the retrieval query and the index filtered against it. Any design that puts restricted text into the context and then asks a model to withhold it has already granted the access, and a single broad service account collapses every user down to one privilege level.

    Source: CCAR-P Domain 3 retrieval architecture and Domain 5 access control: per-user entitlement filtering in RAGReport a problem with this question

19. 19. What can an output guardrail catch that an input screen cannot?

    • A.A user message written to jailbreak the model through a role-play framing before any generation has begun.
    • B.A response that leaks internal data or asserts unsupported claims after a request that looked entirely benign.✓ Answer
    • C.A retrieved passage carrying instructions that a third party planted inside the source document being indexed.
    • D.A tool definition that grants the agent an action its documented role has no operational need to perform.

    An input screen can only judge what has been asked, so it is blind to failures created during generation, such as leaked context, fabricated citations or unsupported assertions arising from a harmless-looking question. An output check inspects the produced text and can block or force a retry, which is why the two screens are complementary rather than alternatives.

    Source: Anthropic docs, strengthen guardrails: input screening and output validation as complementary layersReport a problem with this question

20. 20. A guardrail blocks a user's request. What is the right product behaviour for that path?

    • A.Retry the request against a more capable model, on the grounds that the block may be a false positive.
    • B.State plainly what was declined and offer a supported alternative or a hand-off to a person who can help.✓ Answer
    • C.Let the request through with a warning banner and leave it to the user to decide whether to continue.
    • D.Return a generic error page so that nobody can infer the criteria the guardrail applied to the request.

    A refusal is a designed path in the product, not an exception to be papered over, so the user should learn what happened and how to proceed legitimately, and the event should be logged for false-positive review. Retrying on a different model deliberately routes around the control, and passing the request through with a banner removes the guardrail entirely.

    Source: CCAR-P Domain 5 guardrail design and Domain 6 user experience of declined requests; Anthropic guardrails guidanceReport a problem with this question

21. 21. A hiring-screening assistant meets its overall accuracy target. What additional evaluation does fairness require?

    • A.Removing demographic fields from the input so the aggregate accuracy measure is fairness-neutral by construction.
    • B.Scoring the system separately across demographic slices to expose gaps the aggregate accuracy figure hides.✓ Answer
    • C.Replacing code-graded checks with an LLM judge that rates each recommendation for neutral and respectful tone.
    • D.Enlarging the evaluation set until the confidence interval on overall accuracy narrows to an acceptable band.

    Aggregate accuracy can stay high while a subgroup is systematically disadvantaged, so fairness testing has to be disaggregated and run on the decision the system actually makes. Dropping demographic fields does not remove bias either, because correlated proxies remain in the text and the disparity then becomes invisible to measurement.

    Source: CCAR-P Domain 5 objective 4, ethical AI: bias detection through disaggregated evaluation across demographic slicesReport a problem with this question

22. 22. A document-processing agent passed its pre-launch review a year ago and now ingests new source systems. What is the appropriate governance step?

    • A.Rely on the original launch approval, since neither the model version nor the system prompt has changed since that sign-off was given.
    • B.Ask the vendor to re-certify the model for the new sources, because assurance at the source level falls inside the provider's scope.
    • C.Extend the retention window on the audit logs so that any injection incident in the new sources can be investigated afterwards.
    • D.Re-run the evaluation and red-team suite against the new sources, including deliberately poisoned documents, on a standing schedule.✓ Answer

    The threat surface of a retrieval or ingestion agent is defined by what it reads, so adding source systems changes the risk even when the model and prompt are untouched. Governance therefore requires post-deployment review on a schedule, with red-team documents that carry planted instructions, and the vendor cannot assure content it does not control.

    Source: Anthropic docs, mitigate jailbreaks: red-team agents with poisoned documents before launch; CCAR-P Domain 6 lifecycle stewardship and post-deployment reviewReport a problem with this question

Practice questions based on the official Claude Certified Architect – Professional (CCAR-P) exam guide and Anthropic's public documentation. This is an independent study tool, not affiliated with or endorsed by Anthropic, and does not grant certification. It is delivered via Pearson VUE; Anthropic publishes the current question count, time limit, passing score and fee in the official CCAR-P exam guide. Official certification page →