Pass Your Anthropic CCA-F Exam Easy!

Deleting the original document is an irreversible side effect that the user did not request. A translation task requires access to source text and a way to deliver the translated result; removal of the source file is neither a prerequisite nor a harmless cleanup step. Selecting deletion would risk losing the very evidence needed to verify the translation. Use the translation capability and preserve the original unless a separate authorized removal request exists.

Calling both translation and deletion is not more thorough when the second tool performs an unrelated destructive mutation. Tool selection should be driven by the specific requested outcome and the permitted side effects of each operation. The user wants a translated document, not elimination of the source. Adding a delete call expands the task without consent and may make later review impossible if the original text is lost.

A delete operation is designed to remove a resource, not summarize its content. Asking it for a translation or summary is a capability mismatch even if a language model can formulate such arguments. The host should not reinterpret dangerous tool names as benign analysis functions. Select a read or translation tool with a compatible schema, and only use destructive commands when they are explicitly authorized for the relevant target.

Removing file paths from code-search hits destroys the information needed to locate, recheck and safely edit a match. Two files may contain identical identifiers but implement different behavior, and a bare snippet cannot show which source revision supplied the text. The tool should return bounded excerpts with path, line span and query context. That lets the caller inspect the actual target and distinguish evidence from similarly named but unrelated occurrences.

Concatenating an entire repository into one unstructured string increases token use and strips away practical boundaries between files. A model cannot reliably tell which line belongs to which module or whether a match came from production code or tests. For targeted search, return only relevant bounded snippets with source paths and line numbers, plus a way to fetch more context. Huge raw output is not better evidence when provenance and navigation are lost.

A count of matching files can estimate how broad a search is, but it does not answer where the relevant symbol appears or what it means in surrounding code. Without paths and line references, the agent cannot select the correct file or cite a specific callsite before proposing edits. The result contract should include the actual matches and revision-aware context, not just aggregate statistics. File counts may complement, but cannot replace, evidence-bearing snippets.

Relative adjectives like 'tomorrow morning' depend on an unstated locale and daylight-saving rule, so they do not satisfy an API that expects UTC timestamp strings. They can be useful as user intent but must be resolved with an explicit timezone, date and applicable offset before dispatch. The tool contract should define the accepted ISO representation and reject unresolved ambiguity rather than inventing a UTC instant from conversational wording.

Removing all offsets turns an unambiguous zoned timestamp into a naive clock time. A scheduled 09:00 could then be interpreted differently by the server, client or customer, leading to missed notifications and incorrectly ordered events. Preserve an explicit timezone or offset in input, and normalize to UTC as the actual API requires. Stripping temporal context is particularly dangerous around daylight-saving transitions.

Treating every offset-free timestamp as UTC may look deterministic but can silently shift a customer's local appointment when the source timezone was never specified. The service requires UTC, not a license to interpret ambiguous user intent as UTC. Ask for or derive a verified timezone under a documented contract and convert to the required instant. Accepting naive input as UTC should be an explicitly stated business rule, not an unstated tool-description assumption.

Merging every customer's records into a shared index without access filtering means a search for one case could retrieve sensitive material from another tenant. The worker's apparent need for a document title does not justify receiving unrelated attachments or customer secrets. Keep records tenant-scoped at storage and retrieval, and grant access to sensitive bytes only after explicit authorization. Performance or search convenience is not an acceptable reason to remove the confidentiality boundary.

Hiding source identity while sending secret attachments combines two defects: the model receives unnecessary protected data and lacks the provenance to know its original owner. Removing the document label does not make raw credentials less sensitive or establish access permission. A safe search result should contain minimum required metadata, content snippets where permitted, and stable identifiers that support an authorized follow-up retrieval. Sensitive attachments must be separately gated before entering model context.

Sending every attachment with each search result massively expands context and may expose credentials or unrelated customer data even when the task needs only a passage citation. The returned content can also contain lower-trust instructions that complicate the agent's work. Use a lightweight search contract and retrieve the exact attachment only after authorization and relevance checks. Broad retrieval does not equal broader user permission, and extra token volume provides no proof of better factual accuracy.

Blind retries with fresh operation IDs can repeat an uncertain write or trigger another charge when the first request was processed despite an application-level error. Even for read-only calls, they waste budget without classifying whether the failure is permanent or retryable. The host must inspect the response body's real operation status and error class, retain the original correlation, and apply a bounded provider-specific recovery policy. Replacing every failure with a fresh ID is not a normalized status contract.

Keeping only HTTP 200 discards the explicit operation failed message that the business service returned. The assistant would then report the transaction as successful although the body describes the opposite outcome. A useful tool result must preserve both transport information and the service's domain-level status, with safe error details and any retry guidance. Discarding the body removes the very data required to distinguish a completed operation from a rejected or partially processed one.

A transport success indicates that the HTTP request received a response, not necessarily that the business operation succeeded. This API explicitly puts a failed operation in the body even when the response status is 200. An agent-facing adapter should parse and normalize the semantic outcome and error details so downstream decisions do not mistake a rejected operation for a completed one. Exceptions alone also fail to represent such domain-level failures.

Sending the full private repository for a single README request transfers far more source code and possibly secrets than the task requires. It also adds bandwidth, model-context pressure and unnecessary exposure in logs or third-party service boundaries. A scoped file-read operation can return the requested path from an authorized revision without packaging unrelated folders. Repository-wide archives remain appropriate only when the user's actual authorized task needs that broader scope.

An exhaustive indexing step is still much broader than the request to inspect one known README, and it can expose file names or access metadata unrelated to the authorized task. It may also cost more than the content retrieval. The real contract defect is that the tool requires an entire private archive for one file. Provide a path- and revision-scoped read_file capability with server-side authorization, and return only the observed file content or a truthful access/error result.

An old cached excerpt might be useful background, but the current repository could have changed its setup instructions, dependencies or security requirements. Path equality alone does not establish version equality. The agent needs the requested README bytes for the authorized revision or a qualified indication that the content was not retrieved. A scoped read_file tool can return a specific file and revision without transferring the entire repository. Inferring current content from stale cache is not equivalent to reading it.

Treating a returned draft ID as a delivery receipt would falsely tell users that an email was sent. Draft creation merely stores proposed content; no provider send operation or recipient delivery status has been observed. The tool should surface a draft-created state, with its identifier and next authorization requirement, rather than claiming completion. An agent may later invoke a separately permitted send action and report its genuine result.

A prompt instructing the model not to mention the difference would hide an incorrect tool contract, not repair it. The backend still produces a draft while the advertised capability promises delivery, so any downstream system could rely on the wrong state. Adjust the tool name, parameters and result schema to distinguish draft creation from actual sending. A natural-language workaround is not a substitute for accurate executable semantics.

Deleting a draft immediately after creation does not turn it into a sent email. It would remove the artifact the user or sending workflow could otherwise review while leaving no provider dispatch result. The issue is mislabeling the backend's operation, not the draft's retention period. Preserve the actual created-draft status and require an independent authorized send if delivery is requested.

Assigning every support case an emergency category would distort routing priorities and could overwhelm on-call responders with low-risk tickets. The problem is inconsistent free-form category input, not a missing sense of urgency. Define a limited list of documented categories, validate the caller's selection and provide an explicit unknown or manual-triage path when none fits. Category severity should be determined from evidence and policy, not by an indiscriminate default.

Frequency-based fallback appears to improve route consistency but silently changes the meaning of unusual or newly introduced support requests. The selected common queue may have different service-level requirements or escalation permissions. A controlled enum with well-described categories and explicit unknown handling preserves uncertainty and supports later reclassification. A model may suggest a category, but validation and a safe fallback should govern the actual stored value.

Discarding an unmatched support request turns an input-quality issue into silent customer-service data loss. A new category may represent a legitimate emerging incident that the predefined routing taxonomy does not yet include. The system should preserve the submitted case with a safe unknown or manual-triage route, record the original category text as data and seek a controlled classification update. A validated enum should prevent arbitrary workflow execution while still allowing users to report problems outside the current list.

An offset alone is fragile when documents are added or removed between requests. Page 2 may then begin at a different logical position, skipping or repeating rows even when the first page looked correct. A count-based offset also gives the client no proof that two pages refer to the same result-set revision. The contract needs a stable snapshot identity and a cursor or status that declares whether the server can continue that same snapshot. If those are unsupported, the client must flag the result as potentially incomplete instead of asserting full coverage.

A nonempty first page proves that at least one match was found; it does not prove that the response contains all matching documents. The question explicitly states that the server has returned a cursor, which is evidence that additional pages may exist. Treating that first page as complete would suppress the next-page obligation and hide shifting boundaries as the data changes. The caller should continue using a snapshot-bound token and record whether the result set was actually exhausted or the continuation failed.

Generating an unrelated cursor for each page breaks the relationship between the page already read and the next authorized position in the same result set. A random token with no stored snapshot cannot establish ordering or detect when the backing index changed. If several pages are combined this way, duplicate or absent documents may be wrongly presented as a complete result. The consumer needs the actual server-issued cursor linked to the snapshot, with an explicit failure state if it expires.

An empty success result misclassifies both the authorization failure and the throttling event as an absence of records. The assistant could then conclude no account exists or no activity was found, rather than recognizing that those sources were unavailable. It also destroys the retry-after timing supplied by the provider. Preserve actual failure classes, valid partial outputs, and source correlation so the user-facing answer can distinguish missing evidence from evidence that a record is truly empty.

Classifying a permission denial as transient encourages repeated unauthorized requests and can produce noisy or suspicious logs without changing access rights. A timer is appropriate only for retryable conditions within a bounded budget, such as certain rate limits or temporary service errors. An error contract should expose category and retryability as separate fields; it must not promise success after waiting. Escalation for access rights belongs to an authorized administrator, not to unbounded automated retries. Typed error fields and correlation IDs preserve the distinction.

Free-form error text alone is brittle for orchestration. A model may fail to associate it with the correct tool request or to distinguish a blocked permission from a temporary throttle. The response should include structured metadata such as request correlation, failure category and optional retry_after, with sensitive details redacted. Natural-language explanation can supplement that envelope, but should not replace the machine-checkable fields needed to continue safely.

An invalid_arguments error describes an input that does not satisfy the tool schema, such as a missing required identifier. The observed response is a rate-limit condition rather than a malformed request. Changing valid field names or types would not replenish a quota or address transient throttling. The adapter should retain the actual error category so the orchestrator can distinguish input correction from waiting, bounded retries, or escalation when a persistent spending cap is responsible.

Authentication failures are a different class of problem, such as invalid or revoked credentials, and are not established by HTTP 429. Rotating API keys for every throttle response can violate credential policy and may not restore any quota. It also obscures whether the limit is associated with the organization or workspace. The adapter should surface the actual rate-limit error and decide whether a permitted retry is useful, without changing identity or permissions as an improvised workaround.

HTTP 429 is not equivalent to HTTP 404. Treating it as not-found would hide a service-limit condition and make downstream reports claim that a resource or result does not exist. The caller may need to wait, retry a limited number of times, reduce demand, or seek operational intervention. A reliable tool result includes the true status, any applicable retry guidance, and an explicit incomplete state if the limit cannot be cleared within the workflow budget.