CCAR-P curriculum

Every tool an agent can reach is attack surface and selection noise. Remove what the role doesn't need; logging and confirmations don't substitute for removal.

An agent acting for a user must be authorized as that user, enforced downstream. A shared service credential plus prompt rules is a confused deputy.

Start from each path's latency budget and error cost, then spend accuracy levers (model tier, thinking, retrieval depth, verification) only where they pay.

A log line per model call isn't observability. Propagate one trace across every tool and service, and attribute cost and errors to the step that caused them.

Chunk along document structure, give every chunk the context and metadata to stand alone, and treat the index as a versioned artifact rebuilt consistently.

Vector search is one tool, not the default. Match retrieval to the data's shape and the query's pattern: exact, semantic, structured, relational or aggregate.

MCP for capabilities shared across clients, direct API or CLI tools for one app's own integrations, agent-to-agent only when the other side must reason.

Load everything up front only when it's small, stable and always relevant. Otherwise expose short summaries and let the agent pull detail on demand.

Start from the workflow and its measurable baseline, not the model. Pick one primary value pillar, price in error cost and review, then size the solution.

Design all four stages, input, processing, output and feedback, and pick the simplest pattern that meets the need: augmented LLM, then workflow, then agent.

Add agents only for breadth, context isolation or separate permissions. Orchestrate through a hub with typed contracts, scoped tools, budgets and traceable handoffs.

Split along real seams: stages, partitions or unknowns. Give each piece an interface and acceptance test, keep exact steps in code, and plan recombination.

Pick one primary quality metric tied to the business outcome, then set pass/fail thresholds on latency, cost, safety and security before building anything.

Build a stratified, versioned dataset from real and adversarial traffic. Grade with code where possible, a calibrated model judge where not, humans to anchor both.

Gate each change offline, then test online with a pre-declared primary metric, guardrails, the right randomization unit and enough traffic. One change at a time.

Check what changed, then whether the right context reached the model, then the prompt, then the model. Swapping in a bigger model is rarely the first step.

Optimize under the quality bar: measure cost and latency per successful task, pull the biggest lever first, and log enough per request to see drift.

A rule that must never break belongs in code: remove the capability, scope the credential, gate the call. Prompts shape behavior; they don't enforce boundaries.

LLM failures are fluent and confident. Name failure modes up front, rank them by impact and reversibility, and give each a detection and containment control.

Put humans where errors are costly and irreversible, not everywhere. Tier review by risk, enforce gates in code, and measure whether reviewers catch errors.

Compliance follows the data, not the model: map every hop (logs, indexes, tools, evals) and verify agreements and authorizations cover each one.

Bias shows up per group, not on average. Test with segmented metrics and counterfactuals, choose a fairness criterion deliberately, and give people recourse.

Discovery turns "we want AI for X" into a measured baseline, a target, real sample data and owned constraints, before anyone picks a model or pattern.

Present real options with consequences and evidence, tailored to what each audience decides, and record the decision so it can be revisited later.

Commit only to what you can measure and control: quality, latency and availability targets with a method, and triaged feedback flowing into the eval set.

Document what the next team needs to run and change the system, hand off against exit criteria, and treat monitoring and iteration as owned phases.

Pick the model per step, not per product: the smallest tier that passes your eval for that step, a measured reason to move up, and a pinned version.

A system prompt sets role, rules and format; a template keeps it consistent at scale. Rules that must never break are enforced in code, not louder wording.

Match technique to failure: explicit criteria for vague judgment, a few targeted examples for inconsistency, reasoning room for multi-step errors. Then measure.

Context is a budget: send what the step needs, keep the stable prefix byte-identical so caching works, and package reusable know-how as modules or Skills.

Put shared config in the repo, org-wide rules in managed settings, personal taste in user files. Enforce hard limits with permissions and hooks, not CLAUDE.md prose.

Give Claude a verifiable target and evidence, keep humans on merges and production changes, and measure delivery outcomes rather than code volume or prompt counts.