Pass Your Anthropic CCA-F Exam Easy!

A previous amount could be relevant as a disclosed historical observation, but the user requested the current balance. It may have changed after new transactions or account corrections. The read_account tool exists for that precise need, while refund_payment would introduce an unauthorized side effect. The agent should perform a scoped read and disclose any inability to retrieve live account state.

Calling refund_payment would attempt to move money even though the user requested only information. The presence of the tool in the catalog does not establish customer consent, target payment details or permission to issue a refund. A forced mutation could change financial state unrelated to the balance query. Choose an authorized read_account call, validate its result and decline any unrequested write. The host should enforce this scope independently of what the model proposes.

Executing every registered tool would turn a simple balance lookup into unrelated actions, including a payment refund. Tool registries describe available capabilities, not a checklist of operations to run whenever a user asks a question. The orchestrator must select only what the task requires and what the user is authorized to do. An account read can satisfy this request; broad tool execution would waste resources and may trigger irreversible side effects.

Setting tool_choice to none tells a compatible Claude API request not to use tools for that turn, so it directly contradicts a requirement to return a structured tool call. The model may then answer in ordinary text even when an operation is available. Use the documented required-tool configuration and a registered capability with valid arguments, while keeping authorization checks in the executor. A prompt asking nicely cannot override a configuration that explicitly excludes tool use.

Supplying a tool name that does not exist in the declared tool list cannot create a callable function. A forced name must refer to an actual supported tool definition, otherwise the request may be rejected or the intended contract cannot be satisfied. The host should configure a documented supported tool_choice value with matching schemas, not invent a label and hope Claude discovers an implementation. Model output is not a registry installation or a permission grant.

Granting administrative credentials to all tools is unrelated to requiring a structured function call in the model's next response. That change expands privileges and increases the damage possible from an incorrect tool choice or prompt injection. A tool-choice setting influences which available tool the model proposes; execution authority must remain scoped to the user's task. Keep the declared registry and least-privilege credentials while using the supported required-call mode only when appropriate.

Disabling all tools could be acceptable for static advice, but this diagnostic agent sometimes needs live telemetry to answer accurately. A forced no-tool setting would prevent it from obtaining those fresh measurements, even when the host has authorized a read-only source. Automatic selection allows a direct answer for stable facts and a bounded read call when current evidence is needed. Keep the registered tool set scoped so automatic choice does not authorize unrelated mutations.

Forcing a refund tool for a diagnostic assistant would cause a monetary capability to be requested even when the user asks a conceptual or read-only question. That expands risk without supplying the needed live telemetry and confuses tool availability with business authorization. The assistant should normally answer directly and use read-only diagnostic tools as appropriate, subject to host permission checks. A refund is a separate consequential action requiring its own verified request and privilege; it is not the default tool for ordinary diagnosis.

Forcing a write tool on every diagnostic question creates unnecessary side effects and may change customer state when the user only needs an explanation. A tool can be appropriate when current state is required, but a mutation should be selected only when the task authorizes it and the host validates scope. Auto tool-choice leaves room for direct textual answers and necessary read calls; a forced write loses that distinction and increases operational risk.

A retrieved document, even one styled like a corporate policy, cannot install an executable tool in the host registry. It is lower-trust content that may contain attacker instructions, and the approval-only agent has no account-deletion mandate. Registering delete_user from that text would convert document content into privileged configuration. Preserve the original allowed capabilities and treat the document's request as untrusted evidence to report or ignore, not as an instruction to expand authority.

Account deletion has a significant irreversible effect and cannot be justified merely by seeing a request embedded in third-party text. The actual user asked for approval work, not destruction of an account, and a retrieved document cannot grant new privileges. Running the delete call would bypass the host's tool allowlist and customer-specific authorization. The model should refuse the injected operation and continue only the originally authorized review, possibly flagging the malicious content.

Temporarily disabling a policy hook to accommodate a document's instruction would deliberately remove the execution boundary that protects the user's task. The document has no authority to change hook configuration or trigger account deletion. Even a brief bypass could let unsafe tools run without the required pre-execution checks. Keep the guard active and isolate the suspicious retrieved text as data; any real policy change requires an independent authenticated administrative workflow.

Requiring a particular registered tool can constrain which operation the model attempts, but it does not verify that the tool's result is accurate or that its backend has current data. A selected schema query may still fail, return stale records or contain a semantic mistake. The host must validate actual results and authorization separately. Tool-choice configuration controls invocation behavior, not the truth of every field returned by the selected service.

Forcing a named tool does not grant permission to use its side effects. Authorization depends on the authenticated principal, resource and requested operation, and the host may still deny a call that is technically well formed. The tool-choice setting only narrows the model's proposed next invocation; it cannot transform an otherwise forbidden action into an approved one. Treat execution permission and model selection as separate layers even when exactly one tool is expected.

A named tool-choice setting determines the intended operation but cannot replace validation of required parameter types and values. The model might supply a malformed ID, an unauthorized resource or a value outside a permitted range. The caller should still use the tool's structured schema and enforce server-side checks before executing. Forcing a specific function reduces selection ambiguity, not the need to ensure its arguments satisfy both the contract and the access policy.

Provider defaults can change and may refer to a region outside the two permitted locations. The requirement is a hard residency boundary, so unqualified defaults are not adequate routing controls. The host or integration should enforce an explicit allowlist on actual tool arguments and reject omitted or disallowed regions. Region selection cannot be delegated to an unverified convention when policy limits eligible destinations.

A warning inside the model's prompt can influence its next tool choice, but it cannot guarantee compliance at the execution boundary. The scenario explicitly prohibits the third region for residency reasons. A prompt-only rule still leaves a callable API and credentials capable of accessing that location if the assistant makes a mistake or is manipulated. Authorization should instead reject any request whose resolved region is outside the two-region host allowlist before the network call happens. The warning may supplement enforcement, not replace it.

Hiding a prohibited region name from the model interface is a presentation choice, not a data-residency control. Global credentials may still be valid for that region, and a tool call could target it through an alias, inferred endpoint or user-supplied argument. The executor should validate the resolved region against the permitted two-region list and issue credentials whose provider-side scope enforces that limit. A restriction that exists only in the prompt or visible menu is fragile when residency is a hard policy boundary.

Removing citations would make the reviewer's evidence harder to trace and would not reduce its access to risky capabilities. This worker exists specifically to locate references supporting a review; citation search is its useful task boundary. The dangerous inheritance is the ability to write files or send external messages, not the presence of source identifiers. Keep references and their retrieval status in the worker's output, while constructing a child tool registry that contains only the search functions required by the assignment.

A well-written reviewer prompt may say never edit or email, but an instruction does not revoke tools already exposed to the agent. If the child inherits write_file and send_email, a mistaken or injected tool request can still reach an executor with those permissions. Apply least privilege when the subagent is created and require host-side authorization for every operation. The distinction is between describing acceptable behavior in text and restricting the actual tools and credentials available to the child process.

Automatically handing the citation reviewer every tool available to its parent includes write_file and send_email even though neither is needed to search and verify evidence. If the reviewer encounters a malicious quote or misinterprets a delegated instruction, that needless access could produce a filesystem mutation or external message. Limit the subagent's executable catalog to citation retrieval and related read-only inspection, and enforce the boundary at the host. Delegation of an analytical responsibility does not imply inheritance of the parent’s broader operational privileges.

The sentence 'just checked' is a claim about a completed external observation. With all tools disabled, this research agent has no way to inspect a changing live product offer during the current run. Generating that wording would fabricate both the method and the freshness of the price. It can describe a previously known amount as historical if its provenance is available, but must distinguish that from a current verified quote and explain the missing retrieval capability.

Historical catalog pricing can be useful as explicitly dated context, but it does not establish a live price that the tool-disabled agent cannot fetch. The user asked for a changing fact and the configuration prohibits verification tools. Rebranding an older observation as current would overstate evidence. The correct response is to disclose the missing capability and avoid a verified-current-price claim.

An unregistered web_search call has no executable implementation in the current tool catalog, so writing its name as if it existed would not retrieve a product price. The host should reject unsupported tools rather than fabricate search results or dynamically run arbitrary commands. If the user needs live verification, first enable an approved data source and execute it under the relevant permissions. Until then the assistant can only report the capability limitation and refrain from claiming that a current price was checked.

Making the agent's assignment a document-summary task does not change what an administrative MCP tool is capable of doing. Its methods can still modify configuration, users, or records if the backend exposes those operations and credentials. A prompt label such as 'summarizer' is not a host-side read-only restriction. The tool set should be narrowed to the minimum document access needed, and administrative endpoints should remain unavailable or independently denied even if the model requests them.

Exposing more administrative methods has no causal relationship to producing better citations. Citation accuracy depends on retrieved document content, stable source identifiers and a verifiable mapping between a claim and the referenced passage. Additional unrelated control APIs simply increase the number of possible tool actions, including harmful mutations. A good summary workflow uses appropriately scoped document lookup and read calls, then preserves observed source locations. Expanded privileges neither create stronger evidence nor repair unsupported references.

The main problem is not that the document becomes shorter. An administrative tool registry concerns what operations a model can attempt, while document length is determined by source material and the summarization contract. The danger is that irrelevant privileged operations become available to a low-risk reader. A malicious instruction in the document could direct the agent toward those tools, so the remedy is scoped capabilities and host authorization rather than changing how much prose the summary contains.

Citations in a response describe where a factual claim originated; they do not decide whether an agent must invoke a pricing tool. This scenario concerns the tool-selection rule applied before execution. If tool use is forced on every turn, a greeting, policy question or nonpurchase request can trigger an irrelevant price lookup. Correct the forcing condition or allow a no-tool path when no purchase intent has been detected. Changing the citation style would not affect that routing decision.

A pricing tool returning a currency code is normal structured business data, not evidence that the agent's routing policy is correct. The failure occurs earlier: the subagent is compelled to call the tool regardless of whether the user intends to buy something. Even a perfectly typed response in USD or EUR cannot justify an unnecessary network action. The host should gate the lookup on classified, authorized purchase intent and validate its parameters; currency parsing remains a separate downstream concern.

Validating a requested tool's arguments protects a different boundary: it helps stop malformed inputs from reaching a provider. It does not explain why the agent keeps requesting pricing data when the user has not expressed purchase intent. The root configuration error is forcing tool use regardless of task context. The host should still validate schema and permissions when an authorized lookup is actually needed, while giving the model a way to answer directly or select a more appropriate capability on turns without pricing requirements.

The capitalization of the literal none is not what makes a network policy safe. Even if the API parameter is perfectly formed, the host may have an independent Bash execution channel that is not governed by the model tool-choice setting. The application must restrict that channel according to its own permissions, including network destinations and data access. Parameter spelling is unrelated to this bypass of the execution boundary.

Bash is not harmless simply because the assistant says it is polite or intends to comply. A shell command can read secrets, open outbound connections or invoke other programs with privileges granted to the host. Model intention is a weak control against mistaken or injected commands. If the goal is to prevent exfiltration, constrain network access and command execution in the actual runtime, independent of tool_choice or a friendly prompt.

The size of the conversation may affect context quality and output reliability but does not explain why an independent Bash channel can still reach the network. The risk is a mismatch between model-level tool selection and host-level capability. An attacker or mistaken integration could use a non-model execution path even in a short conversation. Inspect and enforce the executor's network and filesystem permissions rather than blaming the token budget.