CCAR-P
CCAR-P quick reference
The facts worth having in your head when you sit down. Print it, or read it on the way there.
Numbers that change often (prices, model IDs, limits) are deliberately omitted; verify them at docs.anthropic.com before the exam.
Domain 1: Solution Design & Architecture (17%)
| Decide | Rule of thumb |
|---|---|
| Workflow or agent | Code controls the sequence = workflow; model controls the loop = agent. Choose the simplest rung that meets the NFRs. |
| Agent viability | Multi-step and unspecifiable in advance, value justifies variance, model is capable, errors are recoverable. Any "no" means stay simpler. |
| Multi-agent | Only for parallel breadth, context isolation or differing tools and permissions. Pass structured results, not transcripts. |
| State | Conversation, working context, long-term memory and task state live in different places. Compaction summarises; context editing clears. |
| Cost levers | Caching and hygiene first, then effort, then model tier, then routing. Judge by cost per completed task. |
| Record | One ADR per significant decision; a risk register beside it. |
Reference shapes: knowledge assistant (citations, Files, caching), document pipeline (Batches, structured outputs, confidence routing), conversational agent (tools, MCP, streaming), coding or operations agent (Agent SDK or Managed Agents), analytical agent (code execution, skills).
Domain 2: Models, Prompting & Context Engineering (13%)
- Tiers: Haiku (fast, cheap), Sonnet (balanced default), Opus (most capable); frontier tiers may add access and retention conditions. Pin versions; keep IDs in configuration; discover limits via the Models API.
- Selection order: best model at defaults, build evals, lower effort, then smaller tier, then routing.
- Context engineering: smallest high-signal token set; right-altitude instructions; minimal non-overlapping tools; deferred loading and skills for large catalogues; stable content first, volatile last.
- Prompting: sectioned system prompt, rationale with instructions, few diverse examples, documents before questions, citations for grounding, structured outputs instead of prefill (prefill and forced tool choice are unavailable on current generations).
- Thinking: fixed budgets replaced by adaptive thinking plus effort; thinking billed as output; display does not change cost; pass thinking blocks back unchanged; keep history append-only.
- Caching: prefix match over tools, then system, then messages; up to four breakpoints; move the history breakpoint each turn; no timestamps or IDs in the prefix; verify with cache read tokens; caches are per organisation and per model.
Domain 3: Integration (19%)
| Surface | Use for | Remember |
|---|---|---|
| Messages (streaming) | Anything interactive | Branch on stop_reason; pause_turn means continue; refusal has stop_details |
| Batches | Offline volume, evals | Asynchronous, discounted, results in any order by custom_id |
| Files API | Reused documents, code-execution outputs | Block type must match media type |
| MCP connector | Remote MCP servers from a request | Server entry plus toolset entry, beta, platform availability varies |
| Agent SDK | Filesystem and shell agents you host | Permission modes, hooks, subagents, sessions; sandbox it |
| Managed Agents | Hosted loop and sandbox | Agents, sessions, environments, vaults, permission policies |
- Streaming events: message_start, content_block_start, content_block_delta, content_block_stop, message_delta, message_stop. Tool inputs arrive as partial JSON. Streams are not resumable.
- MCP: hosts, clients, servers; tools, resources, prompts; stdio local, streamable HTTP remote with OAuth 2.1. Govern with registries, pinning, least privilege, read/write separation, audit logs.
- Cloud platforms: chosen for identity, billing, governance, residency. Different auth, model IDs, client classes; same messages interface. Parity lags; check availability tables. Managed Agents is Claude-API-only.
- Server tools: web search and fetch, code execution, tool search run on Anthropic infrastructure; memory, editor, bash and computer use execute in your environment. Errors arrive inside result blocks.
- Identity: workspace-scoped keys; prefer workload identity federation or cloud IAM; gateway as credential broker; user-delegated OAuth for tools; secrets never pass through the model.
- Legacy: adapter between model and system; parameterised tools over free SQL; structured outputs with confidence fields; timeouts, backoff, circuit breakers, idempotency, dead-letter queues.
Domain 4: Evaluation, Testing & Optimisation (16%)
- Eval anatomy: dataset, runner (deployed pipeline), grader, metrics by segment, threshold set in advance. Hold out a test split; version the dataset; watch saturation and contamination.
- Non-determinism: repeat runs; pass^k for unsupervised systems, pass@k when a human picks.
- Graders: code where codifiable; model with binary rubric items, evidence quotes, structured verdicts, bias controls and calibration against humans; humans for ground truth and adjudication.
- Agents: tool unit tests, tool-selection tests on the tool_use block, step replays, trajectory and outcome evals (state-based), standing adversarial scenarios. Mocks, sandboxes or recorded replays control side effects.
- CI: versioned bundle (prompt, model, tools, settings); smoke, route, full (Batches) and migration suites; gates by segment plus safety must-pass, cost and latency; flakiness budget; shadow and canary; rollback by configuration.
- Optimisation: profile by route first; free wins (caching, input and output hygiene, loop hygiene, batching, max_tokens discipline); then effort, tier, routing, each proven against evals.
- Monitoring: quality, safety, reliability, cost, plus drift; trace IDs across model, tools and subagents; sampled production grading; owned feedback loops; AI incident runbooks start from trace ID and bundle version.
Domain 5: Governance, Safety & Risk Management (14%)
| Concept | Key point |
|---|---|
| Trust boundaries | Retrieved content, tool results, web content and memory are untrusted |
| Lethal trifecta | Private data + untrusted content + external channel; split agents so none holds all three |
| Blast radius | Worst a compromised agent can do; shrink with least privilege, read/write split, user credentials, confirmations, egress allowlists, limits |
| Injection defence layers | Architecture, input handling (provenance tags, size caps), model-level, detection (classifiers, canaries), action validation in code (hooks, allowlists), human oversight |
| Data | Map all flows including server tools, files, memory, MCP and logs; retention defaults versus zero data retention with caveats; residency per platform; Trust Center for evidence |
| Oversight | Decide per action by reversibility, impact and confidence; gates on tools; evidence-first reviews; seeded audits; measure override rates |
| Usage Policy | Prohibited uses; high-risk uses need human oversight and disclosure; honesty about AI; refusal stop reason with stop_details; never circumvent safety behaviour |
Domain 6: Stakeholder Communication & Lifecycle Management (14%)
- Business case: baseline first; hard versus soft benefits; full TCO including oversight, evaluation, governance and lifecycle; cost per completed task; sensitivity to volume and caching; pilot as the experiment.
- Pilot to production: real data and users, narrow scope, pre-registered criteria, production-like architecture, time box. Readiness review across nine areas. Shadow, canary, ramp, full with a control group. Agreed operating model.
- Expectations: probabilistic, capable but not uniformly reliable, confidently wrong at times, limited to what it is given, changed by tools, bounded by context. Quote accuracy with conditions; demo failures and controls; state residual risk.
- Migration: release, active, deprecated, retired. Expect changes to thinking configuration, prefill and forced tool choice, tokenizer, history handling, tool versions, behaviour and defaults. Inventory, read the guide, re-baseline, change, audit prompts, compare, tune effort, shadow, canary, document, retire.
- Documentation: architecture, ADRs, risk register, prompt catalogue (rationale per section, validated model, eval score), tool catalogue, eval docs, privacy records, runbooks, change process, user guidance. Handover with walkthroughs, shadowing, dry runs and acceptance.
Domain 7: Developer Productivity & Operational Enablement (7%)
| Topic | Essentials |
|---|---|
| Access | Plan seats, Console API, cloud platforms via environment variables, or an LLM gateway; API key helper for runtime credentials |
| Settings precedence | Managed, command line, local project, shared project, user; managed deny rules cannot be overridden |
| Placement | Always-needed context in CLAUDE.md; on-demand know-how in skills; personas with distinct tools as subagents; enforcement in hooks and permission rules |
| Distribution | Plugins bundle commands, skills, subagents, hooks and MCP definitions; marketplaces distribute them; managed settings can pre-register |
| Rollout | Discovery, pilot, expansion, standard, with gates; security review answered with controls; training on context, permissions and critical review |
| Measurement | Adoption, usage, outcome layers; OpenTelemetry export, Console and plan dashboards, Admin API, engineering systems, surveys; baseline and comparison group; lines of code is usage, not outcome; quality guardrails |
Exam-day reminders
- The simplest architecture that meets the stated requirements is usually the correct option; agentic answers are frequent distractors.
- Anything untrusted can carry instructions; controls must hold even when the model is fooled.
- Every cost or model decision is made against evals, judged per completed task.
- Verify platform feature availability before committing a design.
- When a question hinges on a number, the principle (ratio, order, direction) is what is examinable; check the docs for current values.