Pass Your Anthropic CCA-F Exam Easy!

An isolated worktree protects the child from modifying the parent’s files while it develops its patch, but it does not make later integration conflict-free. The coordinator changed the target module after the child branched, so forcing an overwrite can erase authorized parent changes. A patch must be compared against its actual base and the current target. Reconciliation and testing are required before promoting work from one branch into another.

A wall-clock timestamp cannot show whether a patch includes a newer business rule, preserves all parent edits or even targets the correct revision. Clock skew and differing branch histories make last-finished-wins an unreliable merge policy. The coordinator must compare committed ancestry and changed content rather than trusting arrival time. An apparently recent child result can still overwrite a later parent edit unless its changes are reconciled against the target branch.

Tests on the child’s independent worktree establish behavior only for that child revision. Integration can introduce new code combinations or resolve a conflict incorrectly, and tests that passed before the merge may no longer cover the resulting code. The coordinator should preserve the child test evidence as useful input but must validate the integrated commit. Worktree isolation is not a substitute for post-merge correctness checks.

Increasing every specialist's token limit would expand the transcript problem instead of giving the coordinator a usable decision interface. Longer raw notes can bury the decisive severity observation and make it harder to see whether evidence is missing. Define a bounded handoff with a concise finding, its source anchors, its risk rationale and open questions; retain the full transcript separately if authorized retrieval is needed.

A bare severity label such as critical or low cannot be checked against the underlying logs or differentiated from an unsupported opinion. The coordinator needs evidence pointers and a short explanation of how the observed behavior meets the severity threshold. A compact result should preserve those details and uncertainty while avoiding wholesale transcript transfer. Removing citations saves tokens at the expense of trustworthiness and reproducibility.

A conclusion cannot reveal source locations that the analyst never supplied. Guessing file names or line numbers to make the handoff look complete creates a false provenance trail and may steer remediation to the wrong component. Require the worker to return actual evidence references with its finding, or explicitly mark the reference unknown. Source retrieval must precede a page-specific or line-specific citation.

Waiting for consensus is not a containment control. The specialists may have observed different snapshots, and an attacker could continue using a still-active token while analysts debate the status. An authorized protective disable or rotation can reduce that exposure without erasing the user account. Preserve the alert evidence, perform the narrow containment action and check the provider’s resulting credential state so the eventual report distinguishes the original uncertainty from the observed remediation.

Deleting a user account is broader than the granted containment authority and could destroy evidence, interrupt legitimate workflows and complicate recovery. It does not establish which credential was compromised or whether related sessions remain active. Here the immediate requirement is to neutralize a specific suspected leaked token using an approved disable or rotation process, preserve the forensic context and verify the actual provider outcome. Deleting incident logs also hides the very observations needed to assess the event.

Testing a leaked credential by distributing it to additional responders increases its exposure and creates uncontrolled authentication attempts. Its validity should be checked through an authorized identity-management interface or provider audit record, not by circulating the secret. Narrow protective revocation or rotation can be performed under the coordinator’s stated authority while retaining original incident artifacts. Any additional testing must use a sanctioned procedure that does not disclose usable credentials to unnecessary recipients.

A previous itinerary may reflect a different traveler, trip purpose or accessibility requirement, so reusing it silently can be both inaccurate and privacy-intrusive. The concrete failure is that the delegated hotel search never received the current requirement. The coordinator should pass only the user-approved constraints needed for the search or clarify them when absent. Inference from old history cannot substitute for a current explicit specification on a critical suitability criterion.

Sending the same incomplete hotel-search instruction to more workers would multiply the number of recommendations that ignore accessibility. Each agent would still receive only travel dates and would have no documented condition for rejecting inaccessible properties. More parallel execution can improve coverage of a well-specified task, but it cannot supply a missing mandatory customer constraint. Repair the delegation by passing approved accessibility criteria and requiring evidence for those features in returned results, then consider additional workers only if the scope justifies them.

Selecting the cheapest hotel regardless of requirements confuses price ranking with suitability. A low fare does not compensate for a property lacking a feature that the traveler needs, and the worker never received the accessibility criteria needed to screen its candidates. The coordinator should transmit those criteria explicitly and apply them before comparing eligible hotel prices. If evidence for a mandatory feature is unavailable, mark the property unverified rather than recommend it as an acceptable budget option.

A verbal promise from a summarization agent does not convert an invoice read assignment into permission to change billing records. A user asking for a summary has not authorized payment mutations, and a malicious invoice could include instructions to alter an account. The executor should expose read-only invoice retrieval to that worker and reject billing writes. If a record change is genuinely required, delegate it to a separately authorized updater and record the real provider outcome.

Giving both assistants every billing tool makes a mistaken natural-language interpretation capable of changing balances, recipients or invoice status. The summarizer only needs to inspect data; write access expands risk without improving the requested explanation. Separate tool catalogs by role and enforce the same restrictions in the backend, where the model cannot override them. Convenience is not a reason to expose production mutations to an unprivileged worker.

Placing the updater's secret in both prompts duplicates a credential into a context that has no need for it. An invoice summary might later be logged, compacted, or shared with another specialist, increasing leakage risk. This option also undermines the claimed separation between read-only and write-capable workers. Store credentials outside model-visible prompt text and bind them to a scoped executor identity that checks the exact permitted operation.

Worker identity alone does not prove that a result belongs to the active case. The same specialist may handle many customer cases, and asynchronous calls can complete in an order different from their dispatch order. The reply from case 741 can be technically valid yet irrelevant or confidential when attached to case 819. The coordinator needs task-level correlation and a scope match, not the worker display name or apparent recency.

JSON syntax and field validation are necessary for machine processing, but they do not establish provenance. A well-formed report can still represent the prior customer’s records or a superseded task run. Treating schema conformity as permission to attach the result risks cross-case data leakage and misleading advice. The coordinator must verify the task ID, execution run and originating case before merging any received analysis into current customer context.

Relabeling a result changes presentation metadata without changing the source records or scope that produced it. It could silently reuse evidence from a different person’s case, creating both a confidentiality breach and a false audit trail. Arrival after the case switch does not imply association with the newer case. Preserve the original case and run identifiers, then discard or segregate stale results rather than reassigning them to the current request.

Delegation adds latency, context transfer and another agent boundary without improving a known, narrowly authorized file read. A specialist is useful when the work is sufficiently independent or complex to justify separate tools, context or a focused output. Here, a direct file-read tool already matches the request. Spawning by default can make basic actions harder to audit and cause repeated analysis of information the parent could obtain deterministically.

Increasing a child’s write authority is unrelated to the user’s read-only request. Delegating analysis does not expand authorization; the host and worker still need explicit tool permission boundaries. Broad write access would introduce side-effect risk where the only required operation is viewing known content. Keep permissions aligned with the task and use the existing direct read capability instead of turning a harmless inspection into an unnecessarily privileged multi-agent workflow.

Repository metadata can describe a file’s path, size, or revision, but cannot reliably disclose a configuration value that lives inside the file. Delegating a speculative summary adds a handoff without solving the information requirement. The parent already has a known path and scoped read capability, so the simpler direct read is both observable and efficient. The specialist becomes valuable if the task broadens into multi-file security analysis or requires isolated specialist tools.

Parallel execution is safe for work whose inputs are already fixed; the report writer here needs the regulator's selected regime before it can choose obligations and thresholds. Starting every stage at once can produce polished prose under the wrong rule set and waste time repairing cross-references. The coordinator should parallelize independent evidence gathering while delaying regime-specific calculations and drafting until the classifier returns a validated jurisdiction and applicable legal framework.

Using the report writer's language to choose the controlling jurisdiction ignores the upstream classification task that was explicitly assigned to determine the regulatory regime. The prose language may reflect translation or customer preference and can differ from the law governing the case. The coordinator must wait for validated classification evidence and pass the identified regime into the writer's input contract. Language inference would produce a plausible draft under potentially inapplicable obligations and conceal the missing dependency.

Speculative drafting under a default regime can contaminate citations, threshold calculations, and document structure even if a later revision is attempted. Here classification selects the legal framework that controls the report’s reasoning, so it is a true prerequisite rather than an optional enrichment. The orchestrator should represent a dependency edge, pass the actual classification result to the writer, and only then authorize the reporting task.

The coordinator account may be the current session owner without being the person assigned to manage this particular risk. Filling risk_owner with that account solely to satisfy a schema creates false accountability and could route an escalation to the wrong team. The specialist must provide the actual designated owner when supported by project evidence, or return a permitted unknown state and request clarification. Field completeness cannot authorize the model to invent a responsibility assignment.

A prose sentence containing the word owner is not a JSON object that satisfies the consumer's declared field names and value types. Downstream validation cannot reliably parse responsibility from arbitrary text or determine whether a real person was identified. The coordinator should reject the nonconforming handoff and ask for the supported structured representation, distinguishing missing evidence from a confirmed owner. Superficial keyword similarity does not fulfill a machine-readable output contract.

Dropping the required risk_owner field and reporting that validation succeeded would mislead any downstream service expecting responsibility metadata. A renderer might then show a false complete report or silently apply a default owner, even though no assignment was established. Preserve an explicit incomplete status and request the required value or an authorized schema change. The appropriate response is to repair the handoff or disclose the unresolved owner, not to weaken validation without recording the gap.

Discarding the consistently reproducible failure would turn the report into a false green signal. A deterministic defect observed on the target revision is especially important because a later release could reproduce it in production. Preserve the failing command, environment, expected versus actual behavior and associated commit. Analyze the flaky case separately rather than hiding a reliable defect just to make the combined summary shorter.

Declaring every test permanently failed ignores the distinction between an intermittent failure and one reproduced on every relevant run. The intermittent case may involve timing or environment variation and needs additional evidence to characterize. The consistently failing test should be treated as an open defect. Record retries and test identities rather than imposing one sweeping conclusion on both cases.

One passing retry of a flaky test does not retroactively resolve a consistently reproducible second defect. It also does not establish the flaky test's cause or long-term stability. The coordinator should track the result history for each test separately and retain the remaining failure as an explicit blocker where required. Treat success as evidence for one execution, not universal proof that all observed faults disappeared.

Inventing a missing policy converts an incomplete search into false documentary evidence. The worker only searched one directory, so the absence of a match says nothing about the other authorized location. A fictional entry could cause the final advice to cite a nonexistent obligation or exception. Record which directory was searched, preserve the negative result and inspect the remaining location before making an organization-wide finding. A document's existence must come from retrieval, not expectation.

The words 'not found' describe a search result over the set of places actually inspected. In this case, the specialist did not examine a known second directory, so its claim cannot support the stronger proposition that no policy exists anywhere. The coordinator needs a coverage record identifying searched and unsearched locations. It can extend the permitted search or report a qualified gap, but must not inflate a partial search into global nonexistence.

Running the identical query against the same already-searched directory is unlikely to resolve a known coverage omission. Repetition adds tool cost while still leaving the second directory unexamined, and an endless loop can obscure the fact that the problem is scope rather than search syntax. The coordinator should redirect effort to the remaining authorized location, tracking access failures or missing files there. If that location cannot be read, the result must remain explicitly incomplete.