# CCAR-P Practice: Governance & Risk | Your AI Department > 17 free CCAR-P practice questions on governance, safety, and risk management (a domain CCAR-P adds), with study notes and explanations. Source: https://youraidept.com/network/ccar-p-practice-questions/governance-safety-and-risk-management CCAR-P domain drill # CCAR-P practice questions: Governance, safety, and risk management. 17 original questions on Governance, safety, and risk management, a domain the Claude Certified Architect – Professional exam adds to Foundations. No official weights are published yet. Study notes first, then the questions with an explanation for each. When this domain feels solid, take [the timed CCAR-P practice exam](https://youraidept.com/network/ccar-p-practice-exam) and check the domain breakdown. ## What to know about Governance, safety, and risk management - Designing approval gates, audit trails, and rollback into an agent system rather than bolting them on. - Risk assessment for autonomous actions: what the system is allowed to do without a human, and how that boundary is enforced in code and configuration. - Data handling, retention, and policy compliance across an engagement. ## Governance, safety, and risk management questions All domains (17) Governance, safety, and risk management (17) Governance, safety, and risk management You are designing an agent that can modify customer records. Where do approval gates and audit trails belong? - In the observability stack, with traces sampled at 10% and reviewed in a weekly governance meeting - In a post-launch hardening phase, once task completion is stable enough to show which code paths actually matter - In the tool layer from the start, with a log per tool call and an approval gate on every irreversible write - In the system prompt, with instructions to confirm before writing and to summarize every action at the end of each run Check answer ### Show answer Answer: In the tool layer from the start, with a log per tool call and an approval gate on every irreversible write. Gates and logging enforced in the tool layer cover every path the model can take, and they are cheapest to design in at the start. Prompt instructions to confirm are advisory and can be skipped under pressure; sampled traces miss most actions; governance bolted on afterwards misses paths. Governance, safety, and risk management How do you decide which tools an autonomous agent may call without a person? - Let the model rate the risk of each call itself and request approval whenever its stated confidence falls below a configured threshold - Gate every tool at launch and remove the gate from whichever tools users approve most often during the first month - Allow every tool inside the agent's own sandbox and require approval only for calls that cross a network boundary - Classify each action by blast radius: read-only and reversible calls run freely, irreversible or external ones need approval Check answer ### Show answer Answer: Classify each action by blast radius: read-only and reversible calls run freely, irreversible or external ones need approval. Classify actions by what happens if they are wrong: reversibility and reach decide the gate. A network boundary is the wrong proxy, since a local delete is just as irreversible as a remote one, and approval frequency measures convenience rather than risk. Governance, safety, and risk management A client engagement involves personal data. What must the architecture cover beyond the model calls? - A data processing agreement with the model provider plus a zero-retention setting on the API organization - Encryption at rest and in transit for every store the agent touches, with keys held in the client's own key management service - An anonymized eval set so that test runs and CI pipelines contain no real customer records or identifiers - Retention limits, PII redaction where possible, isolation from other clients' data, and access control on the logs Check answer ### Show answer Answer: Retention limits, PII redaction where possible, isolation from other clients' data, and access control on the logs. Data handling is part of the system: retention, minimization, isolation, and who can read the logs. Encryption is necessary but says nothing about how long data is kept or who can read it, and a provider agreement covers the provider's side, not your own logs and stores. Governance, safety, and risk management Which artifact should exist before an agent is allowed to act on production systems? - A risk register listing each action, its blast radius, its gate, and its rollback - A load test showing the agent stays within the production API's rate limits - A signed change request from the system owner covering the agent's service account - A passing eval run above the launch threshold on the current golden set Check answer ### Show answer Answer: A risk register listing each action, its blast radius, its gate, and its rollback. Risks, gates, rollbacks: the register is what makes every production action deliberate. A passing eval says the agent is usually right, not what happens when it is wrong, and a signed change request records approval without defining the controls. Governance, safety, and risk management An audit asks why the agent took a specific action last month. What lets you answer? - The agent's memory store, which records the facts it had learned by that date - A replay of the request on today's system with the same inputs to reproduce the decision - Per-call logs of inputs, tool calls, results, and decisions, retained per policy - The prompt version deployed that month and the eval results attached to its release Check answer ### Show answer Answer: Per-call logs of inputs, tool calls, results, and decisions, retained per policy. Auditability is logging plus retention: the record of what actually happened. A replay on today's system produces today's decision, not last month's, and the prompt version explains the rules rather than the specific action. Governance, safety, and risk management What is a kill switch in an agent system? - A tool the model calls when it detects it is outside policy, ending the run - A feature flag that routes new requests to a fallback and lets in-flight runs finish - An operator control that halts the system immediately, independent of the model - A per-run timeout that stops any task exceeding its expected duration Check answer ### Show answer Answer: An operator control that halts the system immediately, independent of the model. Operator-controlled and model-independent: it has to work when the model is the thing misbehaving. A tool the model calls depends on the model noticing, and a flag that lets in-flight runs finish is exactly what a kill switch must not do. Governance, safety, and risk management A client wants the agent to use customer data from another client's engagement to improve results. Response? - Agree if the other client's contract permits data reuse for service improvement - Refuse; client data isolation is a governance boundary, not an optimization trade-off - Anonymize the records and proceed, since de-identified data is no longer client data - Use the other client's data only to build the eval set, not in production prompts Check answer ### Show answer Answer: Refuse; client data isolation is a governance boundary, not an optimization trade-off. Isolation is a boundary, not a dial. Anonymization is the strongest distractor, but de-identified records still originate from the other client's engagement and re-identification risk remains; using them for evals crosses the same line. Governance, safety, and risk management How should personal data be handled in prompts where possible? - Included in full so the model has context, with zero data retention configured on the API - Encrypted inside the prompt text so the model processes it without seeing plaintext - Duplicated in the system prompt and the user turn so that retrieval cannot miss a field - Minimized or redacted, with only what the task needs Check answer ### Show answer Answer: Minimized or redacted, with only what the task needs. Minimize what enters the prompt: redact or omit anything the task does not need. Zero retention limits what the provider keeps but not what your own logs and traces capture, and a model cannot reason over ciphertext. Governance, safety, and risk management Which change to an agent requires a fresh risk review? - Changing the model tier used for a read-only summarization step - Rewriting a tool description to improve selection accuracy - Raising the retry count on a read-only search tool from two to three - Adding a tool that can send, delete, or pay Check answer ### Show answer Answer: Adding a tool that can send, delete, or pay. New capabilities with side effects change the risk profile. A model tier change on a read-only step is worth an eval run, but it does not add any action the agent could not already take. Governance, safety, and risk management What is the purpose of a staged rollout for an agent change? - Meeting the launch date while the remaining tests continue to run in parallel - Collecting user feedback on the interface before committing to the design - Reducing eval cost by testing on live traffic instead of maintaining a golden set - Limiting blast radius while monitoring real behavior before full exposure Check answer ### Show answer Answer: Limiting blast radius while monitoring real behavior before full exposure. Contain and observe: a stage limits who is affected while you watch real behavior. Stages complement evals rather than replace them, and using a rollout to skip tests puts real users in the role of the test set. Governance, safety, and risk management What belongs in the audit record for an agent action that changed a customer's data? - The final state of the record and the user id of the session owner - Who or what triggered it, the inputs, the tool call and result, the approval if any, and a timestamp - The full conversation transcript, stored against the ticket for that customer - The before and after state of the record plus the model version and prompt version that produced the change Check answer ### Show answer Answer: Who or what triggered it, the inputs, the tool call and result, the approval if any, and a timestamp. The record has to make the action reconstructable: trigger, inputs, call, result, approval, time. Before and after states show what changed but not why or who allowed it, and a raw transcript is hard to query and often contains data the audit should not. Governance, safety, and risk management A regulator asks how the agent avoids discriminatory outcomes in a decision-support use case. What must exist? - Use of the largest available model tier, which carries the strongest fairness training - A disclaimer in the output stating that the recommendation is advisory only - A system prompt instructing the model to ignore protected attributes when reasoning - Documented bias evaluation, human review on decisions, and monitoring with defined thresholds Check answer ### Show answer Answer: Documented bias evaluation, human review on decisions, and monitoring with defined thresholds. Evidence, oversight, monitoring: a regulator wants to see measurement and controls, not intent. A prompt instruction is the strongest distractor, but it is unverifiable on its own and proxies for protected attributes pass straight through it. Governance, safety, and risk management Which is the right response to discovering the agent logged full credit card numbers? - Encrypt the log store at rest and add the finding to the next quarterly risk review - Add redaction to the logger and let the existing records age out under the retention policy - Restrict log access to the security team and shorten the retention window to seven days - Stop the logging, purge the records, assess exposure, and add redaction with tests Check answer ### Show answer Answer: Stop the logging, purge the records, assess exposure, and add redaction with tests. Contain, remediate, prevent. Adding redaction going forward is the strongest distractor, but leaving the existing numbers in place until they age out means the exposure continues, and restricting access does not remove the data. Governance, safety, and risk management What is a sensible policy for agent access to production databases? - Full read access on the primary with writes blocked at the network layer - A dedicated agent role that mirrors the application's service account so the agent can do what the app does - No database access; the agent files tickets that a human executes by hand - Reads through scoped views by default; writes through audited, gated operations Check answer ### Show answer Answer: Reads through scoped views by default; writes through audited, gated operations. Scoped reads, gated writes. Full read on the primary exposes every column including the ones the agent has no reason to see, and mirroring the application role grants the agent the app's full write surface without the app's business logic in front of it. Governance, safety, and risk management How should an architect treat a model's refusal behavior in a regulated workflow? - As a signal to tune away with the system prompt so the workflow completes reliably - As the primary control, documented in the compliance file as the enforcement mechanism - As one safety layer among several, with policy enforced in code and review regardless - As a reason to route the refused requests to a less restrictive model tier Check answer ### Show answer Answer: As one safety layer among several, with policy enforced in code and review regardless. Model refusals are one layer; policy is enforced in code, gates, and human review regardless of what the model does. Treating refusals as the primary control leaves compliance resting on behavior that changes with every model version. Governance, safety, and risk management What should a change-management process require before an agent's tool set expands? - A code review of the tool wrapper and a passing run of the existing eval set - A risk review of the new capabilities, updated gates, tests, and a staged rollout - A load test of the new tool and a rate limit configured on the MCP server - Approval from the tool's system owner and an updated tool description Check answer ### Show answer Answer: A risk review of the new capabilities, updated gates, tests, and a staged rollout. Capability changes are risk changes. A code review plus the existing evals is the strongest distractor, but the existing evals were written for the old tool set and say nothing about what the new tool can do wrong. Governance, safety, and risk management Which incident-response element is specific to agent systems? - The ability to halt autonomous actions immediately and replay decisions from logs - A public status page updated while the incident is in progress - An on-call rotation with paging tied to error rate and latency alerts on the agent service - A blameless postmortem held within a fixed window after resolution Check answer ### Show answer Answer: The ability to halt autonomous actions immediately and replay decisions from logs. Kill switch plus replay: an agent can keep acting during an incident, and understanding what it decided needs the decision log. Paging, postmortems, and status pages apply to any production system. ## Next - [Timed CCAR-P practice exam](https://youraidept.com/network/ccar-p-practice-exam): 63 questions in 120 minutes, scored against the 720 pass mark. - [All CCAR-P practice questions](https://youraidept.com/network/ccar-p-practice-questions) with a domain filter. - [The CCAR-P exam page](https://youraidept.com/network/ccar-p): format, weights, registration, study path. ### Other CCAR-P domains - [The five CCAR-F foundations domains (30 questions)](https://youraidept.com/network/ccar-p-practice-questions/the-five-ccar-f-foundations-domains) - [Stakeholder communication and lifecycle management (16 questions)](https://youraidept.com/network/ccar-p-practice-questions/stakeholder-communication-and-lifecycle-management) ## FAQ ### How much of the CCAR-P exam is governance, safety, and risk management? + No official weights are published for CCAR-P yet. Prep guides report governance, safety, and risk management as a domain CCAR-P adds to the five Foundations domains. The reported structure is on the CCAR-P exam page. ### Are these real CCAR-P exam questions? + No. They are 17 original scenario questions written from the blueprint for this domain. Reproducing exam content would violate the candidate agreement. ### How should I study governance, safety, and risk management for CCAR-P? + Read the domain notes on this page, answer the questions with explanations hidden, then take the timed CCAR-P practice exam and check the per-domain breakdown for this domain. ## Who wrote this ### [Matei Olaru](https://youraidept.com/about/matei-olaru) CEO, Your AI Department Former public-company CEO, corporate attorney, and World Bank consultant. Runs the YAID Network and the partner relationship with Anthropic. ### [Michael Greenberg](https://youraidept.com/about/michael-greenberg) AI Product Lead, Your AI Department AI at Google, Meta, and Samsung. Six patents. Leads member support and the certification prep guidance. Your AI Department is a registered Claude Partner Network company. Our members sit these exams under our partner standing. Facts on this page were last checked on October 15, 2026. ## Ready to sit CCAR-P for real? Registration needs a Claude Partner Network organization. [YAID Network](https://youraidept.com/network) members register under our partner standing. $149 per quarter, exam fee separate. [Apply to join YAID ↗](https://youraidept.com/network/apply?ref=drill)[How registration works →](https://youraidept.com/network/register-for-claude-certification)