Pass Your Anthropic CCA-F Exam Easy!

Quietly lowering the quantity changes the deliverable the owner intended to buy. Even if that manipulation keeps the total within the previous budget, it may cause a partial shipment or create a misleading inventory plan. The original approval covers both count and price, so neither may be modified silently. Present the tradeoff to the owner and ask for a new decision before calling the purchasing tool.

The merchant's live API is authoritative about its own current offer, not about the purchaser's consent to spend more. Accepting the higher amount without a new approval confuses external factual data with authorization. Preserve the updated price and any shipping or tax changes, then seek confirmation bound to those terms. A price response can guide a recommendation but does not itself empower an agent to execute the purchase.

Claiming purchase success without submitting an order invents an irreversible external effect. The user may wait for equipment that was never ordered, and automation could attempt fulfillment based on a nonexistent receipt. The proper response is to say that the price changed and approval is required. Only an actual authorized purchase result, with its real order identifier and provider status, can support a completion claim.

Unlimited retries ignore the possibility of a persistent policy or configuration failure and leave an incompletely authorized account enabled. The original identity creation was only one step of a multi-action workflow. Without a retry ceiling and a compensation rule, further attempts can consume resources while preserving the unsafe intermediate state. The coordinator must instead record which operations committed, take an authorized protective action, and report a failure that a later attempt can safely reconcile.

A second identity does not repair the unfinished first one. It adds another credential-bearing resource, makes audit linkage harder, and can leave orphaned accounts with ambiguous ownership. The requested outcome is one correctly configured identity, not several half-completed substitutes. A compensating operation should first address the already-created identity, with stable correlation identifiers; only then may a separately authorized retry plan create or recover the account without duplicating side effects.

Creating an identity is not equivalent to completing onboarding when the required policy assignment is absent. Suppressing the error would give downstream services a false assurance and can leave the account exposed without intended restrictions. Completion needs evidence for every required stage, including the successful access-policy step. A safer report identifies the partial resource state, the attempted protective action, and whether manual intervention is necessary, instead of relying on the first successful tool response. Provisioning an identity without its required group policy violates the onboarding invariant.

Reporting that every provider succeeded would erase the optional enrichment service's actual failure. The core report can still be useful because the required data are complete, but the missing enrichment must not masquerade as a completed query. Preserve per-source status and disclose which enhancement was omitted. Otherwise readers may assume the absent field was checked and found empty, which differs materially from an API failure to return any result.

Deleting a complete core report because one explicitly optional enrichment tool failed treats every dependency as equally mandatory. The user can still receive the supported required findings, provided the omitted enrichment is disclosed and does not materially alter the conclusion. The coordinator should classify missing tasks according to the agreed report contract, rather than discard verified work. If the supposed optional result actually controls a key decision, that dependency must be reconsidered and the affected conclusion withheld, not the whole report erased by default.

Cached enrichment can be appropriate when freshness is explicitly acceptable, but this API’s current request has failed and the user was not told the cached value is stale. Presenting yesterday’s details as current would overstate the evidence. The core required data are already sufficient for the requested report, so the system should publish those results and disclose the missing optional enrichment; any older data must be labeled with provenance and date.

A fictional calendar event is not a scheduled email and would be misleading evidence of future delivery. Calendar records and automation jobs are different mechanisms: creating an event does not guarantee that any email tool will execute at the requested time. In the stated environment, scheduling permission is absent, so the assistant can prepare the draft but must report that no send was scheduled. Invented metadata should never be used as a completion receipt.

Sending immediately contradicts the user's timing instruction. Even if an email tool could send at once, that would be an unapproved side effect at the wrong time. The user requested a later send, and no scheduling authority has been established. Prepare the content, confirm intended recipients where appropriate and clearly distinguish a saved draft from delivery. If scheduling becomes available, an explicit authorized job and its actual confirmation are required.

The assistant cannot secretly perform a future action just by saying it will. When no scheduling mechanism or authorization is present, such a claim conceals the actual incomplete state and may cause the user to miss a deadline. A truthful response can supply the draft and explain that scheduling has not occurred. Any later automation must be explicitly configured and confirmed by its provider, not inferred from the assistant's narrative.

A retry scheduled in the future cannot change the observed success=false value of the tool call that already failed. If the host sets success=true immediately, downstream tasks might execute based on a state the provider never confirmed. Preserve the failed or retryable status, use the documented retry_after signal under a bounded policy, and update the record only after an actual successful retry. A planned action is not a completed external effect; the return schema should not disguise that distinction.

A retry timestamp says when another attempt may be permitted; it does not prove the failed operation ever succeeded. Reporting success early can trigger downstream actions based on nonexistent provider state. Preserve the actual failed or retryable status, wait for the documented retry window if the budget permits and update the final state only after an observed successful response. This keeps the operational record aligned with what the service actually confirmed.

Ignoring retry_after and calling continuously can violate the provider's throttling contract, extend an outage and exhaust the workflow budget. The failure reason remains unchanged no matter how many requests are sent immediately. A safe orchestrator should preserve the actual unsuccessful result, honor supported delay guidance, cap future attempts and surface the error when recovery is not possible within time limits. Backoff controls resource use; it does not guarantee that later retries will succeed or license a fabricated success report.

Changing the test logs rewrites the evidence rather than fixing the staged configuration. The smoke suite observed a failure on the candidate revision, and that negative result remains relevant even when the agent's narrative says the change is safe. Manipulated output would hide the defect from reviewers and defeat reproducibility. Record the exact failing test, keep its original exit state and correct the configuration before running the required checks again.

A well-written assurance is not a test result. The change may satisfy the model's intended design while still breaking runtime behavior detected by the smoke suite. Committing despite an observed mandatory failure would publish unvalidated state and could require a disruptive rollback. The workflow must follow the configured release guard: hold the commit, inspect the failing condition, apply a targeted repair and verify the same candidate revision under the actual tests.

A passing test that exercises an unrelated component cannot replace a failure in the smoke test covering the modified configuration. Test relevance depends on the code path, environment and acceptance contract, not simply whether a green indicator exists. Substituting an easy test could let the real defect ship unnoticed. Keep the original failed check active, reproduce it if needed and rerun it after remediation before any authorized commit.

Changing a PDF's filename affects how the file is labeled, not what is stored inside its objects. Hidden text, annotations, metadata and embedded objects may still contain identifiers after the visible page has been covered or renamed. Publishing that artifact would expose sensitive data to text extractors and downstream processors. The coordinator needs a genuine byte-level sanitization and verification procedure, not a cosmetic filesystem rename, before marking the release safe.

A worker's assertion that a PDF was redacted does not tell the coordinator whether extractable identifiers remain in invisible text, annotation objects or metadata. Screenshots and self-reports test only a visible representation. Because the deliverable will be published, the gate must inspect the actual output bytes and attempt extraction to confirm redaction in all relevant layers. If hidden identifiers remain, withhold publication and create a properly sanitized artifact before rechecking.

Approving publication because the screenshot appears clean validates only a rendered view of the PDF. Invisible text can remain extractable even when a black rectangle hides it from the display, and document metadata can disclose identifiers without appearing on the page. A screenshot cannot establish that the released file is sanitized. Inspect and test the exact downloadable PDF content after a legitimate redaction process, including extraction and embedded objects, before allowing publication. The failure is at the artifact-data boundary, not an aesthetic display issue.

Benign-sounding model intent does not grant permission to send an external message. A retrieved report could contain adversarial instructions or an accidentally selected recipient, and the model may still form an unsafe tool call. The host must check destination and send privileges before dispatch; otherwise reading a report could silently become an information disclosure action. Model statements are not authoritative authorization tokens and should not replace the pre-send gate.

The proposed send_message arguments describe an intended action, not an observed completed email. A tool may be denied, fail validation, time out or be accepted only as a draft. Labeling message delivery complete at argument creation would mislead users and defeat retry safety. Record the actual provider response after an authorized send and distinguish successful delivery, submission, failure and unknown statuses according to the real tool contract.

A prompt-level instruction not to send is useful guidance but not a technical access control when the send_message capability remains unrestricted. Models can misunderstand instructions, and injected source content may request a message despite the reminder. Authorization must be enforced by the host or a correctly configured permission layer before calling the external provider. Leaving the tool open allows the very side effect the user's restriction was intended to prevent.

A stop or session-summary event is not coupled to one completed edit and does not necessarily know which Python file changed. It may fire after unrelated conversation activity, leaving the target file unchanged or formatting the wrong path. For immediate post-edit formatting, select an event that receives the specific successful Write or Edit operation and its affected filename. A summary-only operation cannot replace a filesystem action.

A PreToolUse hook runs before Claude Code executes the proposed file write; it cannot inspect the final bytes that the editor will produce. A formatter must operate on the file's actual changed content. Use the post-tool success event to obtain the resulting path and apply an approved formatter, then separately check whether formatting succeeded. Pre-execution validation remains useful for permission checks, but it is the wrong timing for this stated formatting task.

User-input submission is too broad a trigger for this requirement. Most prompts will not change Python files, and running a formatter across the repository can alter unrelated work or create surprising diffs. Match completed Write/Edit operations and then filter the actual targeted path for Python extensions under the allowed project. Scope matters as much as event timing; neither blind globbing nor prompt arrival proves which file needs formatting.

A post-execution warning can help investigate a leak but does not prevent a disallowed file operation from executing in the first place. The stem describes a guard whose detection outcome is always reported as success, so moving the same nonblocking logic to a different event is not sufficient. The enforcement step must use the supported pre-execution blocking contract for the selected risky tool and should be tested with both a legitimate fixture and a genuinely restricted secret. A later audit callback is not the same as a denial.

Severity metadata can improve observability, but a host that sees an allowed or successful hook decision can still execute the tool. The issue is not that reviewers cannot recognize the warning; it is that the enforcement protocol does not deny the operation. Return the documented blocking response for detected secrets at the appropriate event boundary, and verify that the host actually rejects a synthetic forbidden write. A high severity label is not an executable authorization decision.

Disabling the scanner for large files creates a predictable blind spot that can allow a committed credential to bypass the intended approval boundary. Size may affect performance, but secret-exposure risk does not disappear when a file is lengthy. The team should optimize bounded scanning or reject oversized unscannable writes under the relevant high-risk policy, and verify that the hook's return value actually blocks a detected secret. Removing coverage is the opposite of strengthening the nonblocking warning-only control described in the stem.

Removing a failing PreToolUse policy hook and relying solely on a natural-language rule would leave risky execution requests without the intended machine-enforced check. The malformed JSON problem is an output-contract defect, not proof that authorization should be abandoned. Validate hook responses against the documented fields and exit semantics, test both allowed and blocked operations, and define what happens if the hook errors. A prompt reminder can supplement the guard but cannot replace its execution-time decision. The appropriate repair strengthens the hook interface rather than disabling it.

A process can exit normally while returning malformed, incomplete or semantically inconsistent policy data. The host must validate the documented hook response schema and know how failure or absent decisions affect enforcement. Relying on exit status alone can bypass a required PreToolUse permission gate. Confirm both transport success and correctly typed output fields, then apply the configured fail-closed or escalation behavior when the payload violates the contract.

Accepting every malformed hook response as permission to proceed would convert a policy integration bug into an allow-by-default bypass. The model could then perform the very file edit the guard was installed to restrict, while operators see only an apparently harmless formatting failure. Test parsing failures and return a documented denial or escalation decision for protected actions; leave lower-risk behavior consistent with explicit policy. Unknown response shape is not evidence that the underlying request is safe or authorized.