The retrieval pipeline is stated to be unchanged, so the first investigation should isolate changes in generation behavior and grounding instructions. Replaying the failing cases on the previous model version determines whether the regression follows the model upgrade or current model-prompt combination. Inspecting the system prompt establishes whether source-use rules, uncertainty behavior, citation requirements, or prohibitions against unsupported claims were removed or weakened. Increasing context or replacing the embedding model changes a component for which no failure evidence exists and may introduce additional noise. Lowering temperature may reduce variation but does not explain systematic contradiction of retrieved evidence. The investigation should compare identical requests, retrieved passages, prompts, and model versions before applying a fix. Define success criteria and evaluations

Adversarial tests directly evaluate behavior under attack, including prompt injection, malformed records, malicious document content, credential-extraction attempts, and unauthorized tool requests. Integration tests provide the complementary coverage required by the question: they verify authentication, retrieval, prompt construction, model invocation, validation, logging, and downstream actions as one end-to-end system. Regression, smoke, and unit testing remain valuable, but they do not jointly satisfy the two stated objectives. A stable regression set measures previously established behavior; smoke tests provide shallow availability confirmation; and prompt-rendering unit tests cover only one component. Anthropic recommends explicit prompt-injection defenses and task-specific evaluations that represent both normal and edge-case traffic. Prompt-injection mitigation

Model Stage, Post-Processing, Post-Processing, Model Stage, Pre-Processing, Pre-Processing

Pre-processing prepares source material before Claude receives it. Optical character recognition converts scanned invoice images into machine-readable text. Because PII redaction is explicitly performed before model invocation, it also belongs in pre-processing. Additional activities at this layer can include file validation, malware scanning, normalization, page separation, and metadata extraction.

The model stage contains tasks requiring Claude’s language-understanding capability. Classifying the invoice type involves interpreting textual and contextual features, while extracting structured invoice fields requires mapping unstructured content into defined business attributes.

Post-processing verifies and commits the model’s result. Schema validation confirms that required fields exist, data types are correct, enumerated values are permitted, and structural constraints are satisfied. Persistence must occur only after validation and any required human review because the system of record should not receive malformed or unapproved model output.

This decomposition separates probabilistic inference from deterministic processing. OCR, redaction, validation, and persistence do not need to be delegated to Claude when conventional components can execute them more predictably. The resulting architecture reduces model workload, strengthens privacy controls, improves auditability, and prevents unvalidated output from directly changing authoritative records.

Study Guide references/topics: Task decomposition; pre-processing; model inference; post-processing; deterministic validation; privacy-by-design; system-of-record protection.

===============

Yes, Yes, No, Yes, No

More capable reasoning configurations generally require greater computation, produce higher latency, and may consume larger token or rate-limit allocations than lighter alternatives. This makes the first statement generally accurate, although actual performance must be measured under the organization’s specific provider and service tier.

Representative workload testing is essential because generic benchmark rankings do not establish performance on the organization’s prompts, data, edge cases, tools, or required output format. Anthropic recommends benchmark tests specific to the use case, using actual prompts and data, followed by comparison of accuracy, quality, edge-case behavior, and cost. Choosing the Right Model

The strongest model is not automatically the correct production choice. Model selection must balance capability, speed, cost, throughput, and operational constraints. Tiered routing implements this principle by serving predictable requests with an efficient model and escalating difficult cases to a more capable model. Anthropic documents multi-model strategies in which lower-cost workers handle most traffic while harder decisions are escalated.

Recency is also not a valid selection criterion. A newly announced model must pass the workload’s existing evaluation, security, latency, and cost gates before replacing a validated production model.

Study Guide references/topics: Model trade-offs; representative evaluations; tiered routing; escalation architectures; cost–capability optimization; model migration validation.

===============

Expectation alignment begins with measured evidence. Option A gives stakeholders the median experience through p50 latency and the slower-tail experience through p95, then compares both with the agreed SLA. The measurements should reflect representative input sizes, concurrency, retrieval activity, tool calls, geographic routing, and cache conditions.

If the target remains infeasible after reasonable optimization, Option E establishes the correct governance response. The architect should collaboratively revise the SLA, scope, cost envelope, model choice, or user-experience design rather than silently accepting a breach or making unilateral changes. Any revision should document the business impact and accepted trade-offs.

Option B commits all resources before the problem’s severity, causes, and business priority have been established. Option C wrongly treats latency as uncontrollable; model selection, prompt length, retrieval depth, caching, streaming, and architecture can materially affect it. Option D introduces an unvalidated provider and could create quality, security, compliance, and integration regressions.

Expectation management is not merely communicating bad news. It requires transparent measurements, credible optimization options, explicit trade-offs, and jointly approved commitments that the production architecture can actually satisfy.

Study Guide references/topics: SLA alignment; p50 and p95 latency; stakeholder negotiation; evidence-based communication; architectural trade-offs; production constraints.

===============

Lifecycle continuity depends on preserving validated knowledge and feeding operational learning back into subsequent phases. Carrying the evaluation framework and reference set forward, as stated in Option B, creates a stable baseline across prompt changes, model migrations, retrieval adjustments, and architectural revisions. Rebuilding the evaluation system each time would undermine longitudinal comparison because changes in the test framework could be mistaken for changes in solution performance.

Option D establishes the second essential continuity mechanism: lessons from discovery, design, implementation, deployment, and production monitoring become explicit inputs to the next phase. This closes the feedback loop and prevents recurring defects, invalid assumptions, and operational findings from being lost at organizational handoffs.

Option A is overly mechanical. Stakeholders should receive communications relevant to their responsibilities and decision rights, not indiscriminate notifications at every transition. Option C confuses comprehensive archival with lifecycle continuity; retention must follow business, regulatory, security, and records-management requirements rather than an unconditional “archive everything” policy. Option E is directly contrary to iterative architecture. Decisions should be documented and governed, but material evidence or changed requirements must be allowed to reopen them.

Study Guide references/topics: Lifecycle phases; evaluation continuity; reference datasets; feedback loops; lessons learned; decision records; iterative architecture governance.

===============

Authorization and compliance logging must remain enforceable application-layer controls. Option B requires the application to authenticate the requester, resolve the user’s role and entitlements, and deny the operation when the user lacks authority. A Skill can instruct Claude how to behave, but it is not a reliable security boundary and cannot replace identity-based access control enforced by the surrounding system.

Option A similarly belongs at the application layer. The application must create an authoritative audit event containing the requester, timestamp, Skill and model version, relevant input or content identifiers, generated output, review status, and retention classification. Audit evidence cannot depend on whether the model remembers or chooses to invoke a logging instruction.

Options C, D, and E describe reusable generation behavior that appropriately belongs within the approved Skill: house style, the standardized disclaimer, and the prohibited-language policy. The application may still validate their presence after generation, but the Skill remains the primary reusable content package.

The correct architecture separates behavioral guidance from deterministic enforcement. Skills supply domain instructions and templates; the application enforces identity, authorization, audit retention, data access, output validation, and consequential-action controls.

Study Guide references/topics: Skills versus application controls; authentication; authorization; compliance logging; deterministic guardrails; policy enforcement boundaries.

===============

User scope applies to one engineer across every project and is therefore appropriate for portable personal preferences. Option A fits this definition because an interface theme belongs to the individual rather than to a repository or organization. Option B also fits because Claude Code provides a language setting for the preferred response language, and placing that preference in user scope makes it apply across repositories.

Option C requires managed configuration because an organization-wide security control must be centrally deployed and resistant to individual override. Option D belongs in project scope because repository-specific MCP endpoints must be shared consistently with that repository’s contributors.

Option E describes credential handling rather than merely a preference assignment. Credentials must not be placed in a repository, but avoiding version control alone is insufficient. They must be stored through a supported secure authentication mechanism, protected environment configuration, operating-system credential facility, or approved secrets manager—not inserted as plaintext into an ordinary settings file.

Anthropic defines user scope as affecting one user across all projects, project scope as shared repository configuration, and managed scope as the location for enforceable organizational controls. It also explicitly lists themes and other personal settings as user-scope use cases. Claude Code Configuration Scopes

Study Guide references/topics: User scope; project scope; managed configuration; personal preferences; repository-shared MCP configuration; credential protection.

===============

The required control is best implemented through layered prevention. The system prompt should explicitly classify personalized investment recommendations as out of scope, instruct Claude not to recommend particular securities or transactions, and provide standardized refusal language. Fixed refusal behavior reduces ambiguity and gives the model a clear alternative response when users request prohibited advice or attempt to reframe it indirectly.

An output classifier supplies an independent enforcement layer after generation but before delivery. It should detect prohibited recommendation language, individualized buy-or-sell instructions, portfolio allocations, and equivalent regulated content. A detected violation must block or replace the response rather than merely record it. This protects against prompt circumvention, unexpected phrasing, and occasional model noncompliance.

Increasing temperature makes responses less predictable and weakens control reliability. Session-length limits regulate volume, not content. SIEM logging is valuable for monitoring, investigation, and compliance evidence, but it is detective rather than preventative: the prohibited recommendation may already have reached the customer.

The completed design should evaluate both layers using adversarial prompts, paraphrases, multi-turn escalation, and classifier false-negative testing.

Study Guide references/topics: [Mitigating jailbreaks and prompt injections](https://docs.anthropic.com/en/docs/test-and-evaluate/strengthen-guardrails/mitigate-jailbreaks); layered guardrails; explicit scope boundaries; standardized refusals; output classification; pre-delivery enforcement.

===============

Alignment is an ongoing governance process rather than a one-time approval. Option D creates a predictable cadence for reassessing objectives, constraints, assumptions, risks, service levels, and success measures as business and technical conditions change. Option E requires disagreements to be surfaced and reconciled explicitly, preserving decision traceability and preventing unresolved conflicts from reappearing during implementation or operation. The routine should document decisions, owners, accepted trade-offs, action items, and conditions that trigger reconsideration. Recording meetings may improve accessibility but does not itself produce alignment. Rotating facilitation is optional and may weaken accountability. Automatically escalating every disagreement to an executive sponsor bypasses normal architectural negotiation and should be reserved for material deadlocks.

Study Guide references/topics: Stakeholder alignment; feedback cadence; assumption management; conflict reconciliation; decision records; lifecycle governance.

Structured discovery begins by eliciting constraints from the people who own the business outcome, operate the process, manage risk, and will use or support the deployed system. Stakeholder workshops in Option A identify measurable expectations concerning accuracy, latency, throughput, cost, privacy, compliance, escalation, and acceptable failure behavior before the solution is scoped.

Option D converts those expectations into production gates. Success criteria must be explicit enough to evaluate empirically, while failure thresholds must determine when the design requires remediation, human review, or rejection. Anthropic’s evaluation guidance states that successful LLM applications begin with defined success criteria and evaluations that measure performance against them. It characterizes strong criteria as specific, measurable, achievable, and relevant. Define Success Criteria and Build Evaluations

Option B prematurely selects a model before the workload profile is known. Option C can supplement discovery, but reaction-driven prototyping cannot replace documented requirements and acceptance criteria. Option E postpones essential constraints until architectural commitments may already have been made.

The discovery output should create traceability from stakeholder objectives to requirements, evaluation metrics, architecture decisions, and deployment gates.

Study Guide references/topics: Structured discovery; stakeholder workshops; nonfunctional requirements; success criteria; failure thresholds; production readiness gates.

===============

Persist the validated output for downstream consumption and audit — Output Handling

Order prompt sections so cacheable content appears before per-request content — Prompt Construction

Summarize prior conversation history when full history is no longer needed — Input Preparation

Validate the model’s structured output against the expected schema — Output Handling

Move stable repeated content into a cacheable prefix at the beginning of the prompt — Prompt Construction

Trim retrieved passages to spans relevant to the user’s question — Input Preparation

Input preparation determines what evidence and history should enter the request, so summarization and retrieval trimming belong there. Prompt construction determines ordering and cache boundaries; stable repeated instructions must precede dynamic per-request content to maximize cache reuse. Output handling begins after generation and includes schema validation, persistence, auditing, and downstream delivery. Mixing these responsibilities creates inefficient prompts and weak validation boundaries. Anthropic’s context guidance emphasizes curating the smallest useful context because unnecessary tokens can reduce recall and accuracy. Prompt caching similarly depends on a stable reusable prefix, while structured outputs or schema validation protect downstream systems from malformed responses. Context windows ; prompt caching

Instrumentation must be driven by an explicit measurement specification. The team must first define the metrics and evaluation slices required to detect performance, cost, quality, safety, or reliability failures. Slices should include representative traffic, adversarial inputs, user segments, tools, and relevant content categories. SLOs and error budgets must also be established before instrumentation because they determine required measurements, aggregation windows, and acceptable failure levels. Alert thresholds cannot be tuned until normal-state data has been collected. Dashboards and on-call documentation depend on the final metric definitions and observed operational behavior. Anthropic supports metrics, event, and trace export through OpenTelemetry, but telemetry is useful only when tied to measurable success and operating objectives. Claude Code monitoring

Role-based access control directly supports HIPAA’s access-control and minimum-necessary principles. The retrieval and orchestration layers must verify the authenticated user’s role before protected health information enters the model context. Authorization should be applied to individual records, data sources, tools, and actions, with audit events recording the requesting identity, accessed resource, purpose, and result. Model instructions alone are not a security boundary.

Patient information must also remain within services and processing activities covered by the organization’s Business Associate Agreement. Anthropic states that PHI processing requires a HIPAA-ready organization and an accepted BAA, and that only specified eligible services and configurations are covered. Patient data must not be submitted through training, feedback, beta, third-party, or integration pathways that fall outside the applicable agreement. A BAA is not blanket authorization; architects must verify feature eligibility and disable inappropriate data-sharing mechanisms.

Reducing max_tokens, selecting a more capable model, and enabling streaming affect output length, quality, or latency. They do not establish authorization, contractual coverage, minimum-necessary access, or compliant PHI handling.

Study Guide references/topics: Anthropic Business Associate Agreement requirements ; HIPAA-ready services; PHI access control; minimum necessary; eligible-service boundaries; auditability.

===============

Effective documentation begins with audience analysis and structural planning. Identifying the audience determines the required technical depth, terminology, decision context, and operational emphasis. Defining the questions the guide must answer prevents sections from becoming generic descriptions. The outline then establishes complete coverage across architecture overview, component responsibilities, interface contracts, dominant flows, operational runbooks, and known limitations. Translation occurs only after stable source content exists. Implementation-team validation also follows an initial draft because there must be material to review. Version control, reviewers, and cadence are important governance controls, but they do not replace the two content-planning activities required before section drafting. The guide should be planned around the decisions and tasks its intended readers must perform.