Robust guardrails require both preventive enforcement and continuous empirical validation. Per-role tool allow-lists satisfy the preventive requirement by restricting each authenticated role to explicitly authorized tools. Enforcement must occur in the orchestration or permission layer before execution; relying on the model to decide whether a tool call is authorized is not an adequate security boundary. Anthropic recommends allow-list-based validation and provides permission rules and pre-tool-use controls capable of denying calls before they execute.

Adversarial evaluation with regression tracking supplies the validation component. The evaluation set should include prompt injections, indirect injections, encoded instructions, multi-turn escalation, role-confusion attempts, and requests designed to trigger unauthorized tool use. Guardrail performance must then be measured across releases so that changes to prompts, models, tools, or orchestration logic do not silently reduce protection.

Centralized logging and user feedback are useful detective and lifecycle controls, but neither prevents an unsafe action nor proves guardrail effectiveness. Periodically refreshing refusal wording is also insufficient unless the revised behavior is evaluated against defined safety criteria. The strongest design therefore combines deterministic authorization with adversarial regression testing.

Study Guide references/topics: Claude Code permissions and pre-tool enforcement ; tool allow-list guidance ; adversarial evaluations; regression testing; least-privilege orchestration.

===============

Option D defines a measurable performance characteristic rather than a business capability. The requirement specifies a percentile-based latency threshold—under 800 milliseconds at the 95th percentile—and ties that threshold to the expected workload volume. It therefore describes how well the system must operate under defined conditions.

Options A, B, and C are functional requirements. They describe actions the solution must perform: extracting fields and creating a downstream record, producing an editable draft, and assigning tickets to categories. Functional requirements define observable system behaviors or outputs.

A strong non-functional requirement must include a metric, threshold, measurement method, and operating condition. For Option D, the architect should further define whether latency is measured end-to-end or only at the model API, the test duration, concurrency, input-size distribution, cache state, timeout behavior, geographic region, and treatment of failed requests. Without those details, teams may report incompatible results while claiming to satisfy the same requirement.

Non-functional requirements for Claude solutions commonly address latency, availability, throughput, cost, privacy, security, recoverability, observability, scalability, and regulatory compliance.

Study Guide references/topics: Structured discovery; functional requirements; non-functional requirements; p95 latency; workload conditions; measurable acceptance criteria.

===============

Documentation remains grounded only when the generating agent can inspect the authoritative implementation. A purpose-built subagent should receive scoped filesystem and code-search capabilities, identify the relevant modules, interfaces, configuration files, tests, and call sites, and generate documentation from that evidence. This approach minimizes reliance on training-data recall, which cannot represent the repository’s current private code or recent changes.

Subagents are useful because repository exploration occurs in their own context, allowing them to return focused findings or proposed edits without filling the main conversation with every file read. Their tool access should follow least privilege: read access to required paths, narrowly controlled write access, and explicit exclusions for secrets or unrelated repositories.

Generated documentation should enter the team’s established change-control process as a patch, branch, or pull request. Normal review, automated checks, link validation, example execution, and human approval provide accountability and prevent unverified material from being published. Direct publication bypasses these safeguards, while disabling repository tools makes factual grounding impossible.

Study Guide references/topics: [Claude Code custom subagents](https://docs.anthropic.com/en/docs/claude-code/sub-agents); [codebase exploration workflows] (https://docs.anthropic.com/en/docs/claude-code/common-workflows); source-grounded generation; least-privilege tools; human review and lifecycle controls.

A workflow is appropriate when processing stages and transitions are known in advance. Metadata extraction, classification, summarization, and persistence can be represented as deterministic nodes with explicit schemas, validation rules, retry policies, and failure handling. This provides predictable execution, cost, observability, and testability without paying for repeated model-driven planning. Anthropic’s Building Effective AI Agents distinguishes workflows, where predefined code paths control execution, from agents, where the model dynamically determines its process. Option A reaches the correct pattern for an incorrect reason: workflows and agents can both invoke tools. Options B and C introduce unnecessary autonomy and make unsupported claims about consistency or universal accuracy.

Study Guide references/topics: Workflow versus agentic patterns; deterministic orchestration; batch processing; structured outputs; predictable cost; error handling.

Yes, Yes, No, Yes, No

More capable reasoning configurations generally require greater computation, produce higher latency, and may consume larger token or rate-limit allocations than lighter alternatives. This makes the first statement generally accurate, although actual performance must be measured under the organization’s specific provider and service tier.

Representative workload testing is essential because generic benchmark rankings do not establish performance on the organization’s prompts, data, edge cases, tools, or required output format. Anthropic recommends benchmark tests specific to the use case, using actual prompts and data, followed by comparison of accuracy, quality, edge-case behavior, and cost. Choosing the Right Model

The strongest model is not automatically the correct production choice. Model selection must balance capability, speed, cost, throughput, and operational constraints. Tiered routing implements this principle by serving predictable requests with an efficient model and escalating difficult cases to a more capable model. Anthropic documents multi-model strategies in which lower-cost workers handle most traffic while harder decisions are escalated.

Recency is also not a valid selection criterion. A newly announced model must pass the workload’s existing evaluation, security, latency, and cost gates before replacing a validated production model.

Study Guide references/topics: Model trade-offs; representative evaluations; tiered routing; escalation architectures; cost–capability optimization; model migration validation.

===============

An ethics review must examine unsupported generalizations, stereotyping, disparate treatment, and other conclusions about people that are not justified by the evidence. It must also preserve identifiable human accountability for consequential decisions; responsibility cannot be transferred to a probabilistic system. Licensing is a legal and commercial-control question, while latency and throughput are operational requirements. Both remain important, but neither is the central ethical test presented here. Restricting review to low-confidence or threshold-triggering outputs is also inadequate because models can express harmful or biased conclusions with high confidence. Ethical review should cover representative populations, protected and intersectional groups, high-impact outcomes, override mechanisms, transparency, and channels for challenge or appeal.

Study Guide references/topics: Bias and unsupported generalization; human accountability; consequential decisions; ethical oversight.

Authorization must be enforced before restricted information enters model context. The retrieval service should authenticate the user, resolve role and document permissions, and filter candidate records before prompt construction. This prevents unauthorized content from appearing in prompts, model traces, cached context, tool results, or generated responses. A system-prompt instruction is behavioral guidance, not an enforceable access-control boundary. Post-generation filtering is also inadequate because the model has already received and processed the restricted data, creating exposure through output, logging, or indirect inference. Relying on general refusal behavior provides no deterministic authorization. The correct architecture treats RBAC as an application and data-layer control, with the model receiving only information the requesting principal is entitled to access.

Study Guide references/topics: Retrieval-layer RBAC; authorization before inference; least privilege; sensitive-context isolation.

Risk-stratified sampling concentrates limited reviewer capacity where error consequences and uncertainty are greatest. All low-confidence and high-impact cases should receive mandatory review, while random sampling of routine high-confidence outputs provides an unbiased signal for drift, unexpected failure modes, and overconfident errors. Complaint-only monitoring discovers defects after harm occurs. Reviewing only high-confidence cases systematically ignores the most dangerous outputs. Universal review provides maximum coverage but contradicts the stated throughput constraint and may create queues that undermine service objectives. The sampling policy should define confidence calibration, impact categories, escalation thresholds, review SLAs, and periodic adjustment based on observed error rates. Reviewer decisions should feed the evaluation dataset so monitoring quality improves over time.

Strong decision communication must explain both how the decision was reached and how it will remain governed. Option D provides the reasoning structure: the alternatives considered and the criteria used to compare them. This allows reviewers to verify that capability, cost, latency, security, maintainability, integration complexity, and business outcomes were evaluated consistently rather than selectively.

Option A establishes lifecycle accountability. Architectural decisions depend on assumptions about requirements, models, data, regulations, usage volume, and operational constraints. Naming an owner and review cadence ensures the decision is reconsidered when those assumptions materially change.

Option B imposes a meeting mechanism rather than describing decision quality. Mandatory attendance by senior leaders may add delay without improving the clarity or correctness of the record. Option C removes important evidence and increases the chance that rejected approaches will be proposed again without addressing the original objections. Option E can improve consistency and discoverability, but visual standardization alone does not establish substantive architectural communication.

A strong decision record should therefore be evidence-based, audience-accessible, traceable to requirements, explicit about alternatives and consequences, assigned to an accountable owner, and governed by defined review triggers.

Study Guide references/topics: Architectural-decision communication; alternatives analysis; evaluation criteria; decision ownership; review cadence; changing assumptions; lifecycle governance.

Persist the validated output for downstream consumption and audit — Output Handling

Order prompt sections so cacheable content appears before per-request content — Prompt Construction

Summarize prior conversation history when full history is no longer needed — Input Preparation

Validate the model’s structured output against the expected schema — Output Handling

Move stable repeated content into a cacheable prefix at the beginning of the prompt — Prompt Construction

Trim retrieved passages to spans relevant to the user’s question — Input Preparation

Input preparation determines what evidence and history should enter the request, so summarization and retrieval trimming belong there. Prompt construction determines ordering and cache boundaries; stable repeated instructions must precede dynamic per-request content to maximize cache reuse. Output handling begins after generation and includes schema validation, persistence, auditing, and downstream delivery. Mixing these responsibilities creates inefficient prompts and weak validation boundaries. Anthropic’s context guidance emphasizes curating the smallest useful context because unnecessary tokens can reduce recall and accuracy. Prompt caching similarly depends on a stable reusable prefix, while structured outputs or schema validation protect downstream systems from malformed responses. Context windows ; prompt caching