CCAR-P: Claude Certified Architect — Professional

Question

The compliance team at a firm has approved a Claude Skill that produces client-facing investment summaries. The Skill contains the firm’s required disclaimers and prohibited-language list. A product manager has asked whether extra guardrails are required in the application layer, or whether the Skill alone is adequate.

Which two guardrail responsibilities must remain at the application layer instead of the Skill? Each correct answer represents part of the solution. (Select two.)

Choose two

Explanation

Authorization is an application-level access-control decision because it depends on the requesting user’s identity and permissions. Compliance-audit retention is also an application-level responsibility because the application must reliably record every generated summary in the firm’s audit trail. The approved Skill can centrally apply the reusable disclaimer and prohibited-language content controls. Anthropic’s guidance describes centralized authentication and audit logging as infrastructure or gateway capabilities surrounding model interactions.

Learn more

LLM gateway configuration - Anthropic

CCAR-P: Claude Certified Architect — Professional

AstroTutor

Notes

Readiness

QuestionQ69

Community Discussion