Pass Your Anthropic CCA-F Exam Easy!

Inventing a missing policy converts an incomplete search into false documentary evidence. The worker only searched one directory, so the absence of a match says nothing about the other authorized location. A fictional entry could cause the final advice to cite a nonexistent obligation or exception. Record which directory was searched, preserve the negative result and inspect the remaining location before making an organization-wide finding. A document's existence must come from retrieval, not expectation.

The words 'not found' describe a search result over the set of places actually inspected. In this case, the specialist did not examine a known second directory, so its claim cannot support the stronger proposition that no policy exists anywhere. The coordinator needs a coverage record identifying searched and unsearched locations. It can extend the permitted search or report a qualified gap, but must not inflate a partial search into global nonexistence.

Running the identical query against the same already-searched directory is unlikely to resolve a known coverage omission. Repetition adds tool cost while still leaving the second directory unexamined, and an endless loop can obscure the fact that the problem is scope rather than search syntax. The coordinator should redirect effort to the remaining authorized location, tracking access failures or missing files there. If that location cannot be read, the result must remain explicitly incomplete.

This changes the wrong control. The subagent is not blocked by a missing executable capability; it is wasting time because it does not know which package or security inference to investigate. Broadening permissions and forwarding unrelated conversation material increase exposure, cost, and potential context contamination. A better design defines the assignment precisely and keeps existing read-only authorization. The parent should supply only the relevant evidence and preserve each finding’s file and revision provenance.

Spawning more agents with the same underspecified task is likely to multiply redundant searches and inconsistent conclusions. Faster completion is not evidence that the right package was inspected or that the required risk question was answered. Parallel children are appropriate only when their work can be partitioned into distinct scopes and the coordinator has a reconciliation plan. In this case, improve the information in the initial delegation before investing in more workers.

A completion flag cannot replace observations about vulnerable code, the affected files, or the limits of the review. A child can exit without actually evaluating the target package. Discarding its report would hide whether the intended analysis ran, and the parent could not responsibly act on the result. Use a structured, evidence-bearing handoff with task identifiers, citations, and open questions, then synthesize only findings that match the approved review scope.

A specialist can recommend a recovery option based on evidence, but it does not gain authority to approve the side effects of that option. The user might permit a reversible configuration reset while prohibiting deletion of a workspace. Letting each worker self-authorize its own proposal would make risk and permission checks inconsistent. The coordinator must compare both candidates against the authenticated user's approval, the actual effects and an appropriate rollback or recovery path before executing either action.

Running a destructive and a reversible proposed fix in parallel can create conflicting writes or destroy the state the second action needs to recover. The two alternatives are proposals for the same problem, not independent read-only checks. Before execution, evaluate actual permissions and whether one change is irreversible; choose one approved path or a carefully ordered plan. Simultaneous dispatch provides no guarantee that at least one solution will be safe, and can make both outcomes harder to reconcile.

The specialists' recommendations can both be valid analyses while still implying different authorized actions and side effects. Comparing execution time alone hides whether a destructive option has permission to run and whether it can be reversed if the outcome is wrong. A coordinator needs the actual user's authorized scope, the consequence of each candidate action and a recovery plan. Speed may be a secondary tradeoff after those conditions are satisfied, not the primary gate in a scenario with destructive risk.

A final summary does not reveal the resources consumed by recursively delegated work or whether all spawned tasks finished. Without a fan-out limit, apparently simple reviews can generate runaway tool calls and duplicated analysis. The coordinator needs an explicit authority and budget envelope for every child. A worker should not acquire further delegation rights implicitly merely because the parent allowed it to inspect repository evidence. Limit roster, depth, concurrency and shared task budget so that children cannot silently create unlimited subagents or claim a partial set of reviews as complete.

Removing task accounting makes it impossible to enforce cost ceilings, stop conditions or missing-output detection. Unbounded work can continue after the original request is satisfied, and the parent may mistakenly describe a partial collection of child reports as complete. Retain stable task identifiers and resource budgets at both coordinator and worker boundaries. Independent checks may run in parallel, but the coordinator still owns the final set of required deliverables.

An unversioned shared buffer cannot establish which worker wrote a finding, for which revision or under what access scope. It can also introduce conflicting edits and stale context between siblings. Shared state is sometimes useful when protected by explicit ownership and versioning, but is not a substitute for controlling child spawning or cost. The parent should orchestrate bounded tasks and preserve individual result provenance instead of relying on workers to self-organize through mutable notes.

Trusting the coding agent and deleting the failure record turns a potentially reproducible regression into an invisible risk. The agent's confidence is not a substitute for test output, especially if the test ran against the same changed module. Keep the failing command, target revision and observed behavior, then investigate whether the patch fixes or worsens that result. Removing evidence would make a later release difficult to audit or recover.

Merging contradictory outputs into unconditional PASS is a reporting error. One worker says the change is safe while another has a failed test; without comparing commits, neither result can certify the integrated state. The coordinator should classify the mismatch as unresolved, reproduce relevant failures and reconcile any differing assumptions. A combined report may contain useful findings, but it cannot claim that all required checks passed until the actual conflict is addressed.

The testing agent may have targeted an obsolete revision or an unrelated feature. Automatically preferring it would overrule the refactor without checking whether its failure applies to the proposed code. Conversely, ignoring it would be equally unjustified. Bind both reports to the same commit and acceptance criteria, investigate the exact failure mechanism and decide using observed evidence rather than worker role, response order or unsupported confidence.

Publishing old customer notes and asking readers to decide does not prevent one tenant's sensitive context from entering another tenant's report. The disclosure has already occurred by the time a reader sees the contamination warning. The coordinator should refuse to merge previous-case data unless its original provenance and reuse permissions support the current case. Tenant- and run-scoped retrieval protects the boundary before content is copied, rather than shifting responsibility to an external recipient after the leak.

Instructions do not isolate persisted state at the host or storage layer. When previous and current tenant notes remain mixed, a worker can still retrieve or summarize the wrong case despite a reminder. Separate scratchpad access by tenant and task run, version reusable references and enforce resource filters before returning context. A prompt can reinforce the boundary but cannot replace authorization and provenance checks on the actual stored records.

Tagging notes with the current customer ID does not establish that the evidence originally belonged to that customer. A shared mutable scratchpad may contain old tenant data and can leak it even if a new label is attached. Correct isolation requires tenant- and run-scoped storage, provenance on reusable context, and an explicit policy for controlled reuse. A label applied after retrieval is not a substitute for an access boundary enforced before retrieval.

Assigning a different identifier on every callback makes two deliveries of the same completion event look like distinct operations. If both are accepted, the downstream scheduler can start the same job twice despite the user's single-execution requirement. Preserve a stable event identity from the producer and use it at an atomic consumer-side deduplication boundary. A new ID for each receipt destroys the information needed to recognize replay and track the original committed action.

A timer-based debounce can suppress near-simultaneous duplicate callbacks but fails if the second copy arrives after the window or after a process restart. Event delivery systems may retry much later, and the downstream action could already have committed. Persistent idempotent state keyed by a stable completion ID is needed to distinguish first application from replay. Debouncing can reduce load, but cannot prove exactly-once effects for this workflow.

A callback system can deliver the same event more than once after retries, network delays or process restarts. Executing the dependent job on every receipt converts at-least-once notification delivery into repeated side effects. The coordinator must instead record a durable event ID and transition the downstream job only on the first accepted completion. Later copies should be recognized as replays and return the existing state rather than launch additional work. Simply trusting the callback's apparent validity does not solve duplication.

A review sent after approval has reached the borrower cannot fulfill a rule requiring the officer to make the binding decision first. The credit action may already have contractual or operational consequences, and a later audit is a different control. The agent may prepare a recommendation and attach evidence, but the host must block the actual approval tool until the authorized officer has reviewed the specific application and given the required decision.

Blocking collection of every public fact would prevent harmless preparatory research, even though the scenario requires human judgment only for the consequential credit decision. The agent can retrieve permitted information, identify missing fields and assemble a review packet without itself granting the loan. The appropriate pause is at the decision boundary, not at the beginning of the workflow. An early blanket stop is neither necessary nor the control described by the question.

Waiting until after money has been disbursed moves human approval beyond the binding action it was supposed to authorize. The loan would already have changed accounts and created obligations, and a later rejection might not undo those effects. Place an explicit pre-action gate tied to the officer's verified decision. Reporting that an officer will review later does not make prior automated approval compliant with the stated workflow.

A cached clearance may represent the account before a new fraud alert, dispute, or restriction appeared. The stem requires ownership, balance, and fraud status to be satisfied for the present refund, so passing two current checks cannot excuse a stale third predicate. The host must verify current required risk state, apply all three conditions conjunctively, and block the write when any required check is unresolved. Prior fraud clearance is useful history, not present authorization.

Sending a refund before checking fraud status and ownership permits money to leave the system while a required policy predicate is unknown or false. A later risk check may discover an unauthorized transaction that cannot be recovered promptly. The state-changing call must be downstream of every mandatory eligibility and permission check, with a durable record of which order and customer were evaluated. Post-action inspection is an audit measure, not a substitute for the required pre-disbursement gate.

Using an OR condition across ownership, balance and fraud clearance would approve transfers when only one of three mandatory checks passed. A customer might own the order but fail the fraud review, or have available balance without authorization for the specific order. The workflow needs conjunction: all required predicates must be satisfied at the time of the transaction. Preserve failures independently and block the refund on any unresolved gate rather than averaging or voting across eligibility tests.

A historical tax rate can serve as an explicitly labeled scenario assumption, but it may be inappropriate if jurisdiction, entity structure or taxable income changed. The task requires a dependable net-income estimate, and an unverified old rate must not be silently treated as current fact. Retain the supported revenue information, identify the missing tax assumption and seek an authoritative rate or document a justified bounded estimate when the user permits it.

Discarding reliable revenue evidence because one tax parameter is unavailable would erase information that can still support a partial financial report. The missing rate prevents a verified net-income estimate, not a faithful statement of known sales. Preserve the sourced revenue with its period and units, explain which calculation cannot proceed, and request the tax assumption separately. A truthful incomplete result is more informative than refusing to report already validated data merely because another required input is absent.

A precise net-income value created while concealing the missing tax rate would imply a calculation with verified premises that the agent never obtained. Financial decisions could then rely on a fabricated result, and the reader could not reproduce its basis. The report should distinguish observed revenue from any hypothetical tax scenario, show an explicit unresolved input, and avoid describing a guessed figure as authoritative. A polished number is not evidence for the missing liability or effective rate.

A proposed appointment time is not a completed provider update. Informing a customer that rescheduling succeeded before checking availability and writing the change could cause them to miss the original reservation or arrive for an unbooked slot. The host needs the relevant calendar's current free/busy result, account authority and the update receipt. Only then can it describe the appointment as moved; before that, it should label the time as a candidate.

Sending the reschedule request before checking whether the proposed slot is free can create a conflict with an existing booking or attendee requirement. An apology after the fact does not reverse missed appointments or user confusion. Treat availability as a prerequisite and use the actual calendar service to check it before the update, then confirm the provider's resulting state. If no valid time is available, present alternatives instead of executing an optimistic mutation without the required check.

A recent cache snapshot may help suggest times, but it does not establish the calendar state at the moment of an actual rescheduling write. Another participant can book the slot during the cache window, and the original appointment may have been modified. The workflow should query authoritative availability for the proposed duration and timezone, then submit a scoped update and check its receipt. Cache validity alone is not proof of current free time.