Certification Notes

1 · Agentic loop and tool use

An agent is, in the definition Anthropic uses, an LLM using tools in a loop autonomously. The cycle has five steps: receive prompt → the model evaluates and responds → the tools it asked for are executed → the results come back → repeat. It ends when the model produces a response with no tool calls.

How you know the loop must continue

At API level, when Claude wants to use a tool the response carries stop_reason: "tool_use" and one or more tool_use blocks with id, name and input. When it has finished, stop_reason: "end_turn". That field is the loop's flow control.

Possible values of stop_reason: end_turn, max_tokens, stop_sequence, tool_use, pause_turn, refusal, model_context_window_exceeded.

How results come back

In a message with role: "user" containing tool_result blocks. Fields: tool_use_id (required), content (optional) and is_error (optional). There is no tool or function role in Claude's API, unlike other chat APIs.

Two formatting rules that return 400 if broken: the message with the tool_result blocks must come immediately after the assistant message that emitted the tool_use, and the tool_result blocks must come first in the content array. Any text goes after them.

Tool errors

A tool failure is not an exception in your application: it is information for the model. It is returned as a tool_result with is_error: true and a readable cause, so the agent can retry with different parameters, escalate or report.

Defining tools

Three required fields: name (regex ^[a-zA-Z0-9_-]{1,64}$), description and input_schema (JSON Schema).

Official best practices: consolidate related operations into fewer tools with an action parameter, instead of create_pr/review_pr/merge_pr; namespacing by service (github_list_prs); return stable semantic identifiers, not opaque internal references.

The ability to choose the right tool degrades above 30-50 available tools. With large catalogues, tool search is recommended. Splitting the tools across several MCP servers connected at the same time solves nothing: the model still sees the total.

tool_choice: four values

With any or tool the API prefills the assistant message, so there will be no natural text before the tool_use. If your interface shows that text as visible reasoning, it disappears.

Parallel tool use is enabled by default; it is disabled with disable_parallel_tool_use: true inside tool_choice.

Client tools vs server tools

Client tools: you define them, the response arrives with stop_reason: "tool_use", you execute and return a tool_result. This also includes the Anthropic-schema ones such as bash, text_editor, memory or computer.
Server tools: they run on Anthropic's infrastructure within the same request, with no round trip on your side — web search, web fetch, code execution, MCP connector.

2 · Subagents and multi-agent orchestration

Hub-and-spoke architecture: a coordinator manages all communication between subagents, error handling and information routing. It is chosen for observability and control, not for savings — multi-agent systems consume on the order of 15× the tokens of a chat (simple agents, ~4×). That is why they are only justified on high-value tasks.

The most-asked point: context isolation

Practical consequence: if the synthesis subagent produces reports empty of detail, it is almost always because the coordinator did not include the previous findings in its prompt. And when passing context between agents it is worth using structured formats that separate content from metadata (source URLs, document names, pages) so attribution is not lost.

Spawning and parallelism

• The spawn tool must be in allowedTools or the invocation is denied.
• Parallelising = emitting several spawn calls in a single response from the coordinator. One per turn is sequential execution in disguise.
• AgentDefinition: description and prompt are required. Optional: tools, disallowedTools, model (including 'inherit'), skills, memory, mcpServers, maxTurns, effort, permissionMode. If you omit tools, it inherits all the available ones.
• Programmatically defined agents take precedence over filesystem ones with the same name.

Designing the coordinator

Prompts of objectives and quality criteria, not procedural steps, so the subagents can adapt. The coordinator must dynamically select which subagents to invoke according to the complexity of the query, instead of always walking the full pipeline, and partition the scope to minimise duplication. The typical failure is a decomposition that is too narrow and leaves gaps: it is fixed with a loop where the coordinator evaluates the synthesis, spots the holes and re-delegates with targeted queries.

Figures from Anthropic's research system

• Multi-agent (Opus as lead, Sonnet as subagents) beat single-agent by 90.2% on their internal eval.
• Three factors explain 95% of the performance variance; token usage alone explains 80%. The other two: number of tool calls and model choice.
• Scaling rules in the lead's prompt: simple fact = 1 agent and 3-10 tool calls; direct comparison = 2-4 subagents with 10-15 calls each; complex research = more than 10 subagents.
• The lead launches 3-5 subagents in parallel and each uses 3+ tools in parallel: up to 90% less time on complex queries.
• Each subagent can spend tens of thousands of tokens and return a distilled summary of 1,000-2,000 tokens.

3 · Workflow vs agent: the five patterns

The criterion: workflows give predictability and consistency on well-defined tasks; agents are chosen when you need flexibility and model-driven decision-making at scale. And the recommendation that comes before all of it: for many applications it is enough to optimise a single call with retrieval and in-context examples. Add complexity only when it demonstrably improves the outcome.

The base building block for everything is the augmented LLM: model + retrieval + tools + memory.

Three closing principles: simplicity, transparency (showing the planning steps) and careful design of the ACI (agent-computer interface).

4 · Context engineering

Context engineering = curating and maintaining the optimal set of tokens during inference. It is the natural progression from prompt engineering, which was limited to writing instructions. Guiding principle: the smallest possible set of high-signal tokens.

The three techniques for long tasks, and when to use each

Compaction

The history is passed to the model to summarise. It preserves architectural decisions, unresolved bugs and implementation details; it discards redundant tool outputs. In Claude Code it continues with the compressed context plus the five most recently accessed files. When tuning it: first maximise recall, then iterate on precision.

Tool result pruning

"The safest, lightest form of compaction is tool result clearing". The official reasoning: once a tool was called a long time ago, the agent does not need to see its raw result again.

Just-in-time vs monolithic

In JIT the agent keeps lightweight identifiers (paths, saved queries, links) and loads the data at runtime with tools, instead of preloading everything. Advantages: progressive discovery, and metadata as signal (names, folder hierarchy, timestamps). Acknowledged trade-off: runtime exploration is slower than precomputed retrieval. Claude Code uses a hybrid model: CLAUDE.md is loaded up front, glob and grep retrieve just-in-time.

5 · Claude Code: memory, permissions, hooks, sessions

Watch the split: in the Developer it weighs only 3.1%. If this is your daily territory, it is exactly where you should not spend study time.

CLAUDE.md hierarchy

Order of scope: managed policy → user (~/.claude/CLAUDE.md) → project (./CLAUDE.md) → local (./CLAUDE.local.md).

Settings precedence (different from CLAUDE.md's)

Managed (not overridable) → CLI arguments → local → project → user. Permission rules merge across scopes instead of overwriting each other.

Permissions

Three types: allow / ask / deny. They are evaluated in the order deny → ask → allow; the first match decides and specificity does not alter that order. A deny with a bare name (Bash) removes the tool from the context; with a specifier (Bash(rm *)) it blocks only the matches.

Modes: default, acceptEdits, plan, auto, dontAsk, bypassPermissions. Plan mode blocks edits until you approve the plan: its value is in high-impact tasks with uncertainty about the scope of the change.

Hooks

Main events: PreToolUse, PostToolUse, UserPromptSubmit, Stop, SubagentStart/SubagentStop, PreCompact, SessionStart/SessionEnd, Notification, Setup.

• PreToolUse returns permissionDecision: allow, deny, ask or defer. A deny prevents execution and Claude receives the rejection as a tool result.
• PostToolUse can add context or replace the output before Claude sees it.
• Hooks run in your process, outside the context window: they consume no context beyond whatever they return.
• Exit code 2 = blocking error, not overridable even with an allow.
• Silence is not approval: a hook can deny, but staying quiet lets the normal permission flow continue.

Sessions: three distinct mechanisms

Headless

-p/--print with --output-format text|json|stream-json, --allowedTools, --continue/--resume. This is the route for CI and automation.

6 · Model Context Protocol

Architecture

An MCP Host (the AI application) creates one MCP Client per MCP Server, with a dedicated 1:1 connection. Two layers: data layer (JSON-RPC 2.0, primitives, notifications) and transport layer (framing, channels, authorisation).

The three server primitives and who controls them

Methods: tools/list, tools/call; resources/list, resources/read; prompts/list, prompts/get. Resources carry a unique URI and a MIME type, in two patterns: Direct Resources (fixed URI) and Resource Templates (parameterised URI).

Transports

Two standard ones: stdio (newline-delimited JSON-RPC over a subprocess launched by the client) and Streamable HTTP (POST to a single endpoint; JSON response or SSE stream).

Authorisation

• It is optional and applies to HTTP transports. stdio should not use it: it takes credentials from the environment.
• The MCP Server acts as an OAuth 2.1 Resource Server; the client as an OAuth 2.1 Client.
• PKCE is mandatory. The token always goes in the Authorization: Bearer header, never in a query string.
• Codes: 401 unauthorised or invalid token, 403 insufficient scopes, 400 malformed request.

MCP inside Claude Code

Three scopes: local (default, per machine), project (.mcp.json versioned in the repo, requires interactive approval the first time), user (all your projects). Precedence local > project > user.

Naming: tools = mcp__server__tool; prompts = slash commands /mcp__server__prompt; resources = mentions @server:protocol://path.

7 · Skill, MCP, hook or CLAUDE.md: the decision tree

Context cost of each mechanism

• CLAUDE.md: full content on every request.
• Skills: only the descriptions at the start.
• MCP: tool names at the start, schemas deferred.
• Subagents: isolated context.
• Hooks: zero, unless they return output.

Agent Skills: progressive disclosure at three levels

Required frontmatter in the standard: only name and description. description ≤1024 characters, in the third person, and it must say what it does and when to use it. Body below 500 lines.

8 · Messages API, errors, streaming and batch

By far the heaviest domain in the Developer. A good part of it is generic software engineering: cheap points.

Basic structure

POST /v1/messages. Required: model, messages, max_tokens.

Errors

The official SDKs retry transient failures with exponential backoff, 2 retries by default, respecting retry-after. Every response carries a request-id header.

Streaming

Sequence: message_start → for each block content_block_start + N content_block_delta + content_block_stop → message_delta → message_stop. The usage figures in message_delta are cumulative.

Non-streaming calls are limited to a 10-minute timeout. For long operations: streaming or Batch.

Message Batches API

• 50% discount on input and output.
• Limit: 100,000 requests or 256 MB, whichever is hit first.
• Most finish in under 1 hour; results are available on completion or at 24 h, whichever comes first. Batches expire if they do not complete within 24 h.
• Results downloadable for 29 days.
• Batch states: only in_progress and ended. Per request: succeeded, errored, canceled, expired (the last three are not billed).
• It does not support stream: true. Progress is tracked through the batch counters.
• A 1-hour cache TTL is recommended, because they usually take more than 5 minutes.

9 · Models, thinking, effort and tokens

Selection criterion

Thinking

• Adaptive thinking: the model decides when and how much to think. In current models it is always on with no configuration.
• Extended thinking with budget_tokens is the old mechanism, deprecated and rejected with a 400 on recent models.
• Billing: reasoning tokens are billed as output and count against max_tokens, even though the text is not returned. You are charged for the tokens generated, not those of the visible summary.
• thinking blocks carry a signature and must be returned unmodified, or 400.

Effort

Levels max, xhigh, high, medium, low, with default high. It is a behavioural signal, not a strict budget, and it affects all tokens including tool calls.

Tokens and limits

• POST /v1/messages/count_tokens is free, with rate limits independent of those for message creation. It returns an estimate.
• Rate limits per organisation and usage tier, measured in RPM, ITPM and OTPM.
• ITPM is cache-aware: input_tokens + cache_creation_input_tokens count; cache_read_input_tokens does not count on most models.
• max_tokens has no influence on the OTPM calculation: the tokens actually generated are counted.

10 · Prompt caching

Prefix hierarchy

tools → system → messages, up to and including the marked block. Consequence: changing the tools invalidates everything below. Hence the discipline of keeping the tool catalogue stable in long sessions.

Other invalidations: changes to thinking or to effort invalidate messages; tool_choice and images, only messages. Setting a parameter explicitly to its default value is equivalent to omitting it and does not invalidate.

Cache lifetime is measured from the start of the request, and each use refreshes it at no extra cost.

11 · Structured output

Two features: JSON outputs (schema in the output configuration) and strict tool use. The mechanism is constrained decoding: the grammar guarantees schema compliance, with no retries.

Fine details

• Property order: the schema's order is respected, but the required ones come first. If order matters, mark everything as required.
• Grammar caching: the first request with a new schema has extra compilation latency; it is cached for 24 h from the last use. Changing only name or description does not invalidate it.
• Structured outputs injects an additional system prompt and changing the format invalidates the thread's prompt cache.
• Citations + structured outputs = 400. They are incompatible.

Consistency without a schema

When there is no schema, the most effective technique is constraining with examples: the docs say explicitly that it is more effective than abstract instructions. Adjectives describe an aspiration; examples define it.

12 · Evals and hallucinations

Success criteria

They must be specific, measurable, achievable and relevant. Official example of a good criterion: "fewer than 0.1% of outputs over 10,000 trials flagged by the content filter". The bad one: "safe outputs".

Grading methods, in the official order of preference

Three pieces of advice for LLM-as-judge: detailed, clear rubrics; empirical and bounded output (only correct/incorrect, or a 1-5 scale); and asking it to reason before scoring and then discarding the reasoning. In Anthropic's research system, a single judge with a single call turned out to be more consistent than several judges.

Methods by criterion, according to the docs: fidelity → exact match; consistency → cosine similarity; relevance and coherence → ROUGE-L; tone → Likert via LLM; privacy → binary classification.

Reducing hallucinations

Basics: allow it to say "I don't know"; use verbatim quotes as an anchor (for documents over 20k tokens, ask for the literal quotes before the task); verify, with retraction if it cannot find a quote backing a claim.

Advanced: chain-of-thought verification; best-of-N (same prompt N times — the inconsistencies give the hallucination away); iterative refinement; restriction to external knowledge (use only the documents provided).

And the official disclaimer: these techniques reduce, they do not eliminate, hallucinations.

13 · Security: injection, least privilege, secrets

Two distinct threat models

Jailbreak or direct injection: the adversary is the user. Indirect injection: the user is trusted, but Claude processes third-party content — websites, emails, documents, tool results.

Indirect injection mitigations (the most examinable part)

• Put untrusted content only in tool_result blocks, never in the system prompt or in user text blocks. Claude is trained to treat instructions appearing inside tool results with scepticism.
• Declare what that content is and where it comes from.
• Declare the policy in the system prompt: content from tools and documents is untrusted data and can never override the system prompt or the original request.
• Encode untrusted content in JSON: escaping gives unambiguous delimiters and prevents "escaping" the context by closing quotes or tags.
• Do not put your own instructions inside a tool result: they are ignored or flagged as injection. They go in a later user turn.
• Screening of tool outputs before Claude acts on them, with a lightweight model and structured output.
• Red-team your own agent before deploying, and continuous monitoring afterwards.

In the MCP connector this is implemented as an allowlist (disable by default and enable specific tools) or a denylist. For a read-only assistant, write and destructive tools are denied.

Keys and secrets

• Store them in a secrets manager, rotate them periodically and revoke any that is suspected leaked.
• Use workspaces to segment keys by project and environment — that way an incident is isolated.
• Expiry is chosen when the key is created and cannot be changed afterwards. After expiry: 401, and they cannot be reactivated.
• Expiry is no substitute for secrets hygiene.
• CORS is not supported with zero data retention: you have to route through a backend proxy, never call the API from the browser.

14 · RAG and retrieval strategies

Almost exclusive to the Architect Professional. If you are only going for the Foundations, you can skip it.

Why embeddings alone are not enough

Embeddings capture semantics and lose exact lexical matches: identifiers, error codes, rare proper nouns. The example in the docs is "Error code TS-999". BM25 retrieves them. They are combined with rank fusion, and that is the recommended baseline.

Contextual Retrieval and its figures

It consists of prepending to each chunk an explanatory context generated by the model (typically 50-100 tokens) before embedding it and indexing it in BM25. Measured as the reduction in retrieval failures against a 5.7% baseline:

The benefits stack. Reranking: retrieve top-150, rerank and pass top-20 to the model. Top-20 performs better than top-10 and than top-5.

Anthropic does not offer its own embedding model: the docs recommend external providers. And the post's final rule: "Always run evals".

15 · Compliance: ZDR, HIPAA, retention

Certifications

HIPAA-ready (with a BAA), ISO 27001:2022, ISO/IEC 42001:2023 (AI management systems), SOC 2 Type I and II. FedRAMP is not on that corporate list: it comes via third parties (Bedrock on GovCloud, Claude for Government).

Zero Data Retention

• It is enabled per organisation and does not automatically extend to other organisations in the same account.
• Not eligible: batch processing (it retains results), Files API, code execution, MCP connector, Agent Skills, and CORS.
• Retained data is never used for training without express permission.

HIPAA

• It requires a signed BAA, applies at organisation level and once enabled it is permanent: an admin cannot switch it off. For HIPAA and non-HIPAA workloads you need separate organisations.
• If you have HIPAA, you do not also need ZDR.

Retention despite any agreement: if the content is flagged by the automated trust & safety systems or there is a legal requirement, it can be retained for up to 2 years.

On Bedrock or Google Cloud the cloud provider is the data processor, not Anthropic: you have to consult their documentation.

17 · Claude Code in a team: permissions, review and portability

This block is worth almost four times more in the Architect Foundations than in the Developer. Study it with the CCAR-F in mind.

And the nuance that completes the answer: a deny rule on the path that must not be touched, set at project or enterprise level, covers the gap the mode alone does not cover. Mode and rules are distinct layers: the mode decides how much it asks, the rule decides what is flatly unreachable.

AI code review

Two design consequences: the human gate goes where a finding turns into an action that is hard to reverse, not on every comment; and the way to raise the reviewer's precision is to give it the team's conventions that it would otherwise have to guess. This is exactly scenario 5 of the CCAR-F (Claude Code in CI/CD), where the stated objective is to give actionable feedback and minimise false positives.

Skill portability

The same SKILL.md runs in Claude Code, in the Messages API and through the Agent SDK, but each runtime loads and isolates it differently: filesystem discovery in Claude Code, beta headers and a code execution container in the API, and setting sources in the SDK.

• A skill scoped to a clear description and free of assumptions about the local environment ports cleanly. One that takes for granted the terminal it was written in does not.
• In every runtime, subagents start clean: they do not preload skills automatically.

The four durable-context mechanisms

Making the setup shareable

A plugin that references an absolute path to the author's home directory installs on one machine and fails on every other. Rules: paths relative to the project root in everything that will be shared, environment variable requirements documented or validated at install time, and testing the installation from a clean machine before distributing.

18 · MCP: transport, scope and enterprise requirements

Out of that comes the sentence that lends itself best to an item: a stdio server declared in .mcp.json is a configuration that looks shareable and is not. The file travels with the repo, but the process it launches only exists on the machine of whoever wrote it. A team server requires HTTP transport and project or enterprise scope: both at once.

The four requirements a regulated client brings

19 · Numbers that come up

A quick review the night before. If you know this table, you have the memorisation part of all four exams covered.

20 · Version traps

Anthropic's documentation is rewritten fast. These points appear in third-party material with the old answer, which today is wrong. They are the items where most people fail because they studied on blogs.