CCAR-P practice questions: Governance, safety, and risk management.

You are designing an agent that can modify customer records. Where do approval gates and audit trails belong?

• In the observability stack, with traces sampled at 10% and reviewed in a weekly governance meeting
• In a post-launch hardening phase, once task completion is stable enough to show which code paths actually matter
• In the tool layer from the start, with a log per tool call and an approval gate on every irreversible write
• In the system prompt, with instructions to confirm before writing and to summarize every action at the end of each run

How do you decide which tools an autonomous agent may call without a person?

• Let the model rate the risk of each call itself and request approval whenever its stated confidence falls below a configured threshold
• Gate every tool at launch and remove the gate from whichever tools users approve most often during the first month
• Allow every tool inside the agent's own sandbox and require approval only for calls that cross a network boundary
• Classify each action by blast radius: read-only and reversible calls run freely, irreversible or external ones need approval

A client engagement involves personal data. What must the architecture cover beyond the model calls?

• A data processing agreement with the model provider plus a zero-retention setting on the API organization
• Encryption at rest and in transit for every store the agent touches, with keys held in the client's own key management service
• An anonymized eval set so that test runs and CI pipelines contain no real customer records or identifiers
• Retention limits, PII redaction where possible, isolation from other clients' data, and access control on the logs

Which artifact should exist before an agent is allowed to act on production systems?

• A risk register listing each action, its blast radius, its gate, and its rollback
• A load test showing the agent stays within the production API's rate limits
• A signed change request from the system owner covering the agent's service account
• A passing eval run above the launch threshold on the current golden set

An audit asks why the agent took a specific action last month. What lets you answer?

• The agent's memory store, which records the facts it had learned by that date
• A replay of the request on today's system with the same inputs to reproduce the decision
• Per-call logs of inputs, tool calls, results, and decisions, retained per policy
• The prompt version deployed that month and the eval results attached to its release

What is a kill switch in an agent system?

• A tool the model calls when it detects it is outside policy, ending the run
• A feature flag that routes new requests to a fallback and lets in-flight runs finish
• An operator control that halts the system immediately, independent of the model
• A per-run timeout that stops any task exceeding its expected duration

A client wants the agent to use customer data from another client's engagement to improve results. Response?

• Agree if the other client's contract permits data reuse for service improvement
• Refuse; client data isolation is a governance boundary, not an optimization trade-off
• Anonymize the records and proceed, since de-identified data is no longer client data
• Use the other client's data only to build the eval set, not in production prompts

How should personal data be handled in prompts where possible?

• Included in full so the model has context, with zero data retention configured on the API
• Encrypted inside the prompt text so the model processes it without seeing plaintext
• Duplicated in the system prompt and the user turn so that retrieval cannot miss a field
• Minimized or redacted, with only what the task needs

Which change to an agent requires a fresh risk review?

• Changing the model tier used for a read-only summarization step
• Rewriting a tool description to improve selection accuracy
• Raising the retry count on a read-only search tool from two to three
• Adding a tool that can send, delete, or pay

What is the purpose of a staged rollout for an agent change?

• Meeting the launch date while the remaining tests continue to run in parallel
• Collecting user feedback on the interface before committing to the design
• Reducing eval cost by testing on live traffic instead of maintaining a golden set
• Limiting blast radius while monitoring real behavior before full exposure

What belongs in the audit record for an agent action that changed a customer's data?

• The final state of the record and the user id of the session owner
• Who or what triggered it, the inputs, the tool call and result, the approval if any, and a timestamp
• The full conversation transcript, stored against the ticket for that customer
• The before and after state of the record plus the model version and prompt version that produced the change

A regulator asks how the agent avoids discriminatory outcomes in a decision-support use case. What must exist?

• Use of the largest available model tier, which carries the strongest fairness training
• A disclaimer in the output stating that the recommendation is advisory only
• A system prompt instructing the model to ignore protected attributes when reasoning
• Documented bias evaluation, human review on decisions, and monitoring with defined thresholds

Which is the right response to discovering the agent logged full credit card numbers?

• Encrypt the log store at rest and add the finding to the next quarterly risk review
• Add redaction to the logger and let the existing records age out under the retention policy
• Restrict log access to the security team and shorten the retention window to seven days
• Stop the logging, purge the records, assess exposure, and add redaction with tests

What is a sensible policy for agent access to production databases?

• Full read access on the primary with writes blocked at the network layer
• A dedicated agent role that mirrors the application's service account so the agent can do what the app does
• No database access; the agent files tickets that a human executes by hand
• Reads through scoped views by default; writes through audited, gated operations

How should an architect treat a model's refusal behavior in a regulated workflow?

• As a signal to tune away with the system prompt so the workflow completes reliably
• As the primary control, documented in the compliance file as the enforcement mechanism
• As one safety layer among several, with policy enforced in code and review regardless
• As a reason to route the refused requests to a less restrictive model tier

What should a change-management process require before an agent's tool set expands?

• A code review of the tool wrapper and a passing run of the existing eval set
• A risk review of the new capabilities, updated gates, tests, and a staged rollout
• A load test of the new tool and a rate limit configured on the MCP server
• Approval from the tool's system owner and an updated tool description

Which incident-response element is specific to agent systems?

• The ability to halt autonomous actions immediately and replay decisions from logs
• A public status page updated while the incident is in progress
• An on-call rotation with paging tied to error rate and latency alerts on the agent service
• A blameless postmortem held within a fixed window after resolution