An architect is deciding how to build a Claude feature: A coordinator delegates public web research to an agent that should never edit the internal customer ledger. Success requires: Enforce least privilege across different agent roles. Which approach is appropriate?
Role-scoped tool distribution constrains what each specialist can do even if it proposes an unexpected action.
UI concealment does not stop executable calls.
A role description is not an enforced permission boundary.
The researcher would acquire unrelated mutation capability.
A release engineer evaluates this requirement: Enforce least privilege across different agent roles. The production context is: A coordinator delegates public web research to an agent that should never edit the internal customer ledger. Which TWO safeguards or validation actions best support a safe implementation of the requirement? Select TWO answers.
Removing ledger-edit permissions protects against unauthorized mutation, but the researcher can still quote an inaccurate public page. Evaluate source quality separately from tool safety. To verify that boundary in the acceptance exercise, audit tool access grants and avoid sharing service credentials across agents.
Role-scoped tool distribution constrains what each specialist can do even if it proposes an unexpected action. Exercising this runtime path would detect the specific fault: its allowedTools policy included mutation tools outside the research role.
Behavioral instructions do not prove that write privileges are absent or denied.
An administrator success does not establish a least-privilege boundary for the research role.
Descriptions do not enforce authorization; denial must be checked under the actual specialist identity.
During integration testing the team reports: The research agent asks to delete a record while gathering citations. What diagnosis most directly matches the failed requirement: Enforce least privilege across different agent roles?
This diagnosis explains the observed pilot behavior: The research agent asks to delete a record while gathering citations. The architectural fault is its allowedtools policy included mutation tools outside the research role. A targeted correction is: Remove write tools from the research agent and enforce permissions at invocation time.
Permission granted to a different agent during authorized implementation does not explain why this research agent could call account deletion. The research agent’s actual allowed-tool scope is the issue.
A different approved cleanup task does not explain an unapproved deletion during citation gathering.
Document contents are not executable tool requests; the trace describes an actual deletion attempt.
A stakeholder asks whether the proposed Claude solution guarantees success for this requirement: Enforce least privilege across different agent roles. Which qualification is technically defensible?
Removing ledger-edit permissions protects against unauthorized mutation, but the researcher can still quote an inaccurate public page. Evaluate source quality separately from tool safety.
A role description is not an enforced permission boundary. Alternative approaches do not justify ignoring realistic failure conditions.
A design document cannot show actual enforcement, incomplete results or failures. The case specifically observed: The research agent asks to delete a record while gathering citations.
Public aggregate research is not a reliable substitute for an individual private ledger record. Restricted tool scope should preserve that evidence gap, not encourage invention.
A Claude application is failing a realistic test: The research agent asks to delete a record while gathering citations. Which remedy directly addresses the defect without a broad redesign?
Role-scoped tool distribution constrains what each specialist can do even if it proposes an unexpected action. In this failure, the research agent asks to delete a record while gathering citations. The corrective action is to remove write tools from the research agent and enforce permissions at invocation time.
A text promise cannot remove live deletion capability. Read-only tool permissions must be enforced during invocation.
A rationale is not authorization for an unrelated operation. Citation research has no need for customer-account deletion privileges.
Hidden names do not stop executable tool calls. The allowed-tool boundary must exclude mutations for this specialist.
In a proposed Claude-based system, A planning agent needs only document reading, while an implementation agent may apply reviewed configuration edits. The team needs to achieve the following: Separate analysis from changes and keep the model from using an editing capability during planning. Which decision fits best?
Different tool sets make the workflow state boundary concrete rather than a prompt-only preference.
An unrestricted shell can bypass intended capability separation.
Proposals are not approvals and can contain unsafe changes.
The model could still attempt an edit during its analysis.
The team claims its design satisfies: Separate analysis from changes and keep the model from using an editing capability during planning. The environment is: A planning agent needs only document reading, while an implementation agent may apply reviewed configuration edits. Which TWO safeguards or validation actions best support a safe implementation of the requirement? Select TWO answers.
Different tool sets make the workflow state boundary concrete rather than a prompt-only preference. Exercising this runtime path would detect the specific fault: the planning role received execution tools that should have been withheld until approval.
Read-only planning prevents an early file write, but the approved implementation may still be unsafe or mis-scoped. Review its concrete change list and authorize execution explicitly. To verify that boundary in the acceptance exercise, keep approvals scoped to the actual file paths and change diff.
A planning label is not proof that the agent is unable to modify source files.
Approval of a plan cannot authorize unrelated or expanded mutations.
Successful reads do not exercise the critical write-permission boundary.
The operational trace shows: A planning subagent writes files while creating a migration design. Given the requirement: Separate analysis from changes and keep the model from using an editing capability during planning. What is the most credible explanation?
This diagnosis explains the observed pilot behavior: A planning subagent writes files while creating a migration design. The architectural fault is the planning role received execution tools that should have been withheld until approval. A targeted correction is: Reconfigure allowed tools per phase and require explicit transition to implementation.
A broad but read-only research scope does not explain a planner writing files. The operative defect is that the planning role was allowed to use state-changing execution capabilities.
Approved implementation is different from the design-only subagent having write capabilities.
A draft report artifact is not the unauthorized project-file mutation identified in the trace.
The deployment proposal says it addresses: Separate analysis from changes and keep the model from using an editing capability during planning. Which boundary must not be hidden from the customer?
Read-only planning prevents an early file write, but the approved implementation may still be unsafe or mis-scoped. Review its concrete change list and authorize execution explicitly.
A design document cannot show actual enforcement, incomplete results or failures. The case specifically observed: A planning subagent writes files while creating a migration design.
Separating planning from editing reduces accidents, but an executable plan is not an approval. Validate the exact proposed mutation and grant action rights only at the authorized stage.
Proposals are not approvals and can contain unsafe changes. Alternative approaches do not justify ignoring realistic failure conditions.
The rollout cannot proceed because: A planning subagent writes files while creating a migration design. What is the most appropriate focused correction?
Different tool sets make the workflow state boundary concrete rather than a prompt-only preference. In this failure, a planning subagent writes files while creating a migration design. The corrective action is to reconfigure allowed tools per phase and require explicit transition to implementation.
A model instruction is not enforcement. Planning must have a genuinely read-only tool set until an authorized phase transition.
Draft labeling does not prevent unapproved file changes. Restrict mutations until implementation is explicitly authorized.
Overwriting production files is also a side effect. The planning role must exclude all state-changing tools it does not need.
A project lead describes the target workflow: An API application knows that a user request must use a customer-lookup tool before any final response. The decisive requirement is: Avoid relying on the model to decide whether the required tool should be called. What should be implemented?
Tool-choice control can force or constrain tool use, but the application must still check permissions and returned values.
Permission breadth does not force the required evidence-producing action.
Few-shot examples influence behavior without enforcing a tool requirement.
Automatic choice leaves the possibility that the model answers without lookup.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
