Select Two (Multi-Select) Questions

Switch every production workload immediately from Claude 3.5 Sonnet to Claude 3 Opus to maximize parallel processing.

Why it fails: Claude 3 Opus consumes more tokens per response than Sonnet, so switching every workload raises expenditure rather than reducing it. Opus suits complex reasoning tasks where Sonnet's quality falls short, but applying it universally to millions of routine support queries ignores the cost driver the team is auditing.

Disable response streaming to batch full payloads and reduce HTTP connection overhead.

Why it fails: Disabling streaming does not reduce token consumption, since input and output tokens are billed identically regardless of delivery method. Streaming affects perceived latency, not cost. It would be correct when a client cannot handle server-sent events or requires complete payloads for downstream processing.

Hardcode maximum output tokens to five thousand across all API calls regardless of task complexity.

Why it fails: Setting excessively high maximum output token limits creates financial exposure if the model hallucinates or loops. It does not reduce costs; instead, it risks unexpected billing spikes if response lengths are unconstrained by prompt design or application logic.

Configure the subagent with the same broad toolset as the main agent to maximize flexibility.

Why it fails: Granting the subagent broad tools invites unintended actions and enlarges its decision space, increasing the chance it performs work outside the audit. The principle of least privilege applies to agent tools as much as to human roles; a specialized subagent should receive only the capabilities its narrow task requires.

Have the subagent write its raw logs directly into the main agent's message history for transparency.

Why it fails: Injecting raw logs into the parent conversation defeats the purpose of delegation by consuming the main agent's context with verbose detail. Transparency is better served by logging externally or by returning a distilled summary. Raw logs also risk burying the actionable findings the parent actually needs to proceed.

Share the main agent's entire conversation history with the subagent so it has maximum context.

Why it fails: Copying the full history bloats the subagent's context, increases cost, and can distract it with irrelevant details. Subagents are typically invoked to isolate work and keep the primary context lean. Passing only the essential task framing and inputs is preferable, so this practice undermines the separation the architecture is meant to achieve.

Include the full text of all previously processed chunks in every new request.

Why it fails: Including all prior chunks recreates the original context-length problem and will exceed the context window well before the manual is finished. It also inflates cost quadratically as the pipeline progresses. The developer explicitly has a fixed token budget, so this approach is both technically infeasible and economically unacceptable for a 200-page document.

Ask the model to summarize each chunk twice and concatenate both outputs to increase coverage.

Why it fails: Summarizing twice and concatenating doubles output tokens and often produces redundant or conflicting statements, which worsens consistency rather than improving it. Duplication does not create cross-chunk awareness, so a term defined in chunk 3 still has no way to influence chunk 27. It also consumes the fixed token budget without adding grounding.

Lower the temperature to zero and rely on deterministic sampling to guarantee identical facts across chunks.

Why it fails: Temperature zero reduces randomness but cannot guarantee factual consistency across chunks, because each chunk is processed with different input text and no shared memory. Determinism affects sampling variance, not information flow between calls. Facts absent from a given chunk's input will still be absent from its summary regardless of temperature.

Instruct Claude Code in CLAUDE.md to never run dangerous commands.

Why it fails: Guidance in CLAUDE.md is contextual advice, not an enforced control. The model may still propose a dangerous command, especially under ambiguous instructions, and there is no hard block. While documenting intent is good practice, it does not by itself reduce the risk of arbitrary execution in a reliable, verifiable way, so it is not one of the two practices that actually constrain behavior.

Run the build inside a container with no network access and a read-only filesystem.

Why it fails: Container isolation is a valid defense-in-depth measure, but the scenario asks for practices that reduce risk while still allowing the needed commands to run as part of the build task. A read-only filesystem would often prevent the build from writing artifacts, breaking the task. Isolation changes the environment rather than governing which commands Claude Code may execute, so it does not directly address the stated concern within the workflow.

Enable `--dangerously-skip-permissions` to avoid prompts during the build.

Why it fails: Skipping permissions removes the confirmation step and allows Claude Code to run commands without review, which increases rather than reduces risk. The scenario is specifically about reducing the chance of arbitrary or destructive commands, so disabling safeguards is counterproductive. This flag is intended for isolated environments where risk is acceptable, not for a cautious build workflow.

Cache the results of expensive tool calls on the server side and return cached responses for identical requests.

Why it fails: Caching can improve performance, but it introduces complexity and potential staleness. For infrastructure management, data changes frequently, and cached responses could lead to incorrect actions. The scenario emphasizes efficiency and scalability, but caching is not a primary practice for scaling; statelessness and idempotency are more fundamental. Caching might be useful in specific cases but is not one of the two best practices here.

Use a single global lock to serialize all tool calls, preventing concurrent execution.

Why it fails: A global lock would severely limit scalability by forcing all requests to be processed one at a time. It would create a bottleneck and reduce throughput. For a scalable MCP server, concurrency should be managed carefully, but global locking is counterproductive. Statelessness and idempotency are better approaches.

Store session state in memory on each server instance to track client interactions.

Why it fails: Storing session state in memory ties clients to specific instances, which hinders horizontal scaling and can cause issues if an instance fails. For a scalable server, state should be externalized or avoided. Stateless design is preferred. This practice would make scaling more difficult, not easier.

The server must use a unique API key for every tool call it receives.

Why it fails: While authentication is important, requiring a unique API key for every individual tool call is not a standard requirement of MCP and would add significant management overhead. Typically, authentication is handled at the transport or session level when the host first connects to the server.

The server must rotate its connection ID every sixty seconds for privacy.

Why it fails: Frequent rotation of connection IDs is not a feature or requirement of MCP and would likely cause instability in the host-server communication. The protocol relies on stable sessions to manage the state of resources and tools. Privacy is better handled through proper data masking and secure transport layers.

All MCP tool results must be manually approved by a human operator.

Why it fails: While 'human-in-the-loop' is a valid pattern for high-risk actions, it is not a mandatory security requirement for all MCP implementations. Forcing manual approval for every result would destroy the speed and utility of most AI agents. Security should instead be built into the server's logic and permissions.

Rewriting entire binary files to optimize system performance.

Why it fails: The provided tools are generally optimized for text-based source code and standard shell operations. While an agent could theoretically use 'bash' to interact with binaries, 'text_editor' is specifically for viewing and editing human-readable text files, and none of the tools are built for automated binary optimization or low-level disk management.

Automatically upgrading the host operating system to the latest version.

Why it fails: System-level upgrades are outside the typical scope and safety boundaries of the Computer Use tools. These tools are intended for application-level tasks and development work. Attempting OS-level changes would likely fail due to permission restrictions or could lead to unstable environments that break the agent's own connection.

The number of concurrent users accessing the application

Why it fails: While the number of users indirectly affects total usage, Anthropic's billing is strictly based on token volume rather than seat-based licensing or concurrent connection counts. A single user sending massive prompts could cost more than many users sending tiny queries, making token count the primary metric for cost management instead of user count.

The physical geographic location of the application server

Why it fails: Anthropic's API pricing is standardized across its global endpoints, meaning the physical location of your server does not change the per-token cost of the model. While network latency might vary based on region, the financial cost of the model inference itself remains consistent regardless of where the developer's infrastructure is hosted or deployed.

The programming language used to make the API calls

Why it fails: The choice of language, whether Python, JavaScript, or Go, has no impact on the cost of the model inference. The API is a RESTful service that charges based on the payload size in tokens. Using a specific SDK might change development time, but it does not alter the underlying billing structure for the tokens processed by Claude.

Deleting arbitrary user files without asking.

Why it fails: Deleting files without user authorization is a high-risk action that violates safety standards. The agent must always ask for explicit confirmation before removing files to prevent data loss, ensuring that the developer remains in control of their filesystem and can prevent accidental deletion of important assets.

Exfiltrating environment variables to remote servers.

Why it fails: Exfiltrating sensitive environment variables is a malicious action. Claude Code is designed to protect user privacy and does not send sensitive local environment data to external servers, prioritizing security and preventing potential credential leakage that could compromise the developer's infrastructure and system integrity.

The full source code of the function being called.

Why it fails: The model does not generate source code in the 'tool_use' block; it only generates the parameters (input) for the tool. The actual implementation of the tool resides on the developer's server or within the MCP server, kept separate from the model's output for security and architectural cleanliness.

The 'timestamp' of when the model decided to use the tool.

Why it fails: Timestamps are not a required or standard part of the 'tool_use' block schema in the Anthropic API. While developers might log timestamps for their own debugging or monitoring purposes, the model does not include them in the JSON payload it generates when it decides to call a tool.

The 'confidence_score' the model assigns to this specific tool call.

Why it fails: Anthropic models do not currently output a formal 'confidence_score' field within the 'tool_use' JSON block. The model either decides to use a tool or it doesn't. Any assessment of 'confidence' would be an external calculation or an interpretation of the model's text reasoning preceding the tool call.

Set the `temperature` to 0 for the Coordinator to ensure deterministic routing decisions.

Why it fails: Setting temperature to 0 reduces randomness but does not guarantee deterministic routing, as the model's outputs can still vary due to other factors. More importantly, deterministic routing is not essential for effective delegation; the Coordinator needs to adapt to context. This parameter tuning is not a core practice for managing multi-agent delegation.

Implement a separate memory store (e.g., a database) that the Coordinator queries before each delegation to check if the task was already completed.

Why it fails: While external memory can be useful, it is not essential for the Coordinator to manage delegation effectively. The conversation history already provides the necessary context. Adding an external memory store introduces complexity and potential consistency issues. The core requirements are maintaining conversation history and defining clear delegation tools.

Use the `max_tokens` parameter to limit the Coordinator's response length, ensuring it does not generate overly long delegations.

Why it fails: While `max_tokens` controls response length, it does not help the Coordinator manage delegation or maintain conversation state. Limiting tokens could truncate necessary reasoning or tool calls, harming performance. It is not an essential practice for effective delegation; proper context management and clear tool definitions are far more important.

Add a system prompt that tells Claude to never call `initiate_transfer` unless the user explicitly asks for it.

Why it fails: A system prompt is not an enforcement mechanism. Prompt injection can override or bypass instructions, and the model may still emit the tool call. Because the control lives inside the model's reasoning, it provides no hard guarantee. The scenario requires mitigation of tool abuse, which demands external enforcement rather than model-level guidance.

Log all tool calls and review them weekly for suspicious patterns.

Why it fails: Logging and review are detective controls that occur after the fact. They can help with incident response but do not prevent a fraudulent transfer from executing. The scenario asks for mitigation of tool abuse, which requires preventive controls. Detection alone leaves the funds already moved and the attacker's objective achieved.

Increase the model's temperature to make its behavior less predictable to attackers.

Why it fails: Raising temperature increases randomness and makes outputs less reliable, which worsens security and usability. It does not prevent a tool call; it only makes behavior harder to test and reproduce. Security controls should be deterministic and external. This option neither blocks unauthorized transfers nor improves authorization.

Increase the max_tokens setting so Claude has more room to reason about whether input is malicious.

Why it fails: Token limits govern output length, not security reasoning. Giving the model more space to generate text does not create a reliable injection detector and can actually give an attacker more room to steer the conversation. This does not address the authorization gap and is not a recognized prompt injection control.

Cache responses for identical user inputs to reduce the number of times Claude processes potentially malicious text.

Why it fails: Caching changes how often the model is invoked, not whether an injected instruction is honored. A cached response could even replay a previously successful injection to other users if keys are not properly scoped. This does not reduce the risk of unauthorized actions and introduces additional data-isolation concerns, so it is not an effective control.

Lower the temperature to zero so Claude becomes deterministic and cannot be manipulated.

Why it fails: Temperature affects sampling randomness, not susceptibility to adversarial instructions. A deterministic model can still reliably follow an injected command every time, which is worse for security. Determinism aids reproducibility and testing, but it is not a mitigation for prompt injection and does not prevent unauthorized actions.

Polling tools/list repeatedly to detect when the tool has finished executing.

Why it fails: tools/list enumerates available tools and their schemas; it reports nothing about the execution state of a specific call. Polling it would add load and still never reveal completion or partial output, so it does not provide progress or cancellation behavior for the slow operation.

Closing the transport and reinitializing the session to interrupt the operation.

Why it fails: Dropping the transport aborts everything in the session, not just the one slow call, and forces a fresh initialize handshake. It is a blunt instrument that discards unrelated in-flight work and state, so it fails the requirement to cancel a single request while keeping the session alive.

Setting a long client-side timeout and retrying the same request until it succeeds.

Why it fails: Retrying a slow tool call risks duplicate side effects and provides no incremental output or user-driven cancellation. A long timeout simply makes the client wait blindly, which is the opposite of staying responsive, so this approach does not meet either stated requirement.

Remove all speaker labels to reduce token count before sending the transcript.

Why it fails: Speaker labels are the primary signal for attributing an action item to an owner. Stripping them saves a small number of tokens but makes correct attribution nearly impossible, which is the core failure mode in overlapping-speaker transcripts. Token savings here trade away the exact information the task depends on.

Set the max_tokens parameter as high as possible so the model never truncates an action item.

Why it fails: A high max_tokens ceiling prevents truncation but does nothing to improve extraction quality. If the model misattributes a speaker or includes a side conversation, a larger budget simply gives it more room to produce wrong items. Output length limits are a safety net, not a reliability technique.

Ask the model to include every sentence that mentions a task, regardless of who said it.

Why it fails: This instruction directly undermines the goal by pulling in hypotheticals, jokes, and side conversations. Action items require attribution and commitment, not mere mention. Broadening the inclusion criterion increases false positives and makes the output unusable for task tracking.

Raise the temperature so Claude explores a wider range of possible answers and settles faster.

Why it fails: Temperature controls sampling randomness, not the number of tokens processed. Raising it makes outputs less deterministic and can harm answer quality on policy questions, while doing nothing to reduce the token volume of the 60,000-token corpus that must still be read on every request.

Add a system instruction telling Claude to read the corpus more quickly to save tokens.

Why it fails: Instructions do not change how the model tokenizes or processes input; the full corpus is still encoded and attended to regardless of wording. Such an instruction consumes tokens itself and cannot reduce the cost of the corpus, so it fails to deliver the requested reduction.

Convert the corpus to a single long paragraph with no headings to reduce whitespace tokens.

Why it fails: Whitespace and headings are a negligible fraction of a 60,000-token corpus, and removing structure makes it harder for Claude to locate relevant policy text. The token savings are trivial while answer quality can degrade, so this does not meaningfully reduce per-request processing.

The model requires the tool's input_schema to be omitted so it can choose parameters freely.

Why it fails: The input schema tells the model what parameters are valid. Omitting it removes the structure the model needs to produce correct arguments and typically results in malformed or rejected tool calls. Schemas are required for reliable tool use, not optional overhead.

The model automatically retries a failed tool call until it succeeds without developer intervention.

Why it fails: There is no automatic retry of tool execution. If a tool fails, the developer must send the error back as a tool_result and let the model decide whether to try again. The SDK does not orchestrate retries on its own, so the application owns that control flow.

The model executes the tool itself and returns the result directly in the same response.

Why it fails: Claude does not execute tools. It only requests them by emitting a tool_use block. Execution happens in the developer's application, which then sends the output back as a tool_result. Confusing the request with execution is a common misunderstanding that leads to broken agent loops.

Run `claude --add-context architecture.md` to load the architecture document into the session.

Why it fails: Claude Code does not have an `--add-context` flag. Context is typically provided via `CLAUDE.md` or by mentioning files in the conversation. This command does not exist, so it would fail. Developers should use supported methods like `CLAUDE.md` or referencing files directly.

Include detailed comments in each source file describing the overall system design.

Why it fails: While comments can be helpful, they are not a recommended way to provide high-level context to Claude Code. The agent may not read all files, and comments are scattered. A centralized `CLAUDE.md` is more effective. Relying on comments alone is inefficient and may lead to inconsistent understanding.

Use the `/context` command to manually upload a PDF of the architecture diagram.

Why it fails: Claude Code does not have a `/context` command for uploading PDFs. While you can share files by referencing them in the conversation, there is no built-in command to ingest PDFs as context. The agent can read text files, but binary formats like PDFs are not directly supported.

Hard-code a shared service account token in the client binary so all users inherit the same permissions.

Why it fails: A shared service account token collapses all users into one identity, defeating per-user authorization and creating a serious audit and least-privilege problem. If the binary leaks, the credential is exposed to everyone. MCP servers that advertise user-specific permissions expect per-user credentials, so this approach would either be rejected or silently grant excessive access, which is unacceptable for a secure integration.

Disable TLS termination to reduce latency, since MCP messages are already structured JSON.

Why it fails: JSON structure provides no confidentiality or integrity on the wire. Disabling TLS would expose access tokens and tool results to interception and tampering. Latency savings are negligible compared with the security risk, and many OAuth-protected servers will refuse plaintext connections outright. Structured payloads are not a security control, so this choice undermines the entire remote integration.

Cache all tool results on the client indefinitely so users avoid repeated permission checks.

Why it fails: Indefinite caching can serve stale or revoked data and bypasses the server's authorization model over time. If a user's permission is withdrawn, cached results would still be returned, creating a data exposure. Caching should be scoped, short-lived, and invalidated on authorization changes. Persistent caching is not a security practice and conflicts with the requirement for user-specific permission enforcement.

Log every tool invocation with its arguments and retain the logs for forensic analysis after an incident.

Why it fails: Audit logging is valuable for detection and after-the-fact investigation, but it is detective rather than preventive. The exfiltration request still executes and sensitive query parameters still leave the boundary. Logging alone does not stop the injected instruction from causing a second `fetch_url` call to an attacker-controlled endpoint.

Increase the model's temperature setting so it is less likely to follow deterministic hidden instructions embedded in fetched content.

Why it fails: Temperature controls randomness in token sampling, not instruction-following priority. Higher temperature makes outputs less predictable rather than more resistant to prompt injection, and it can increase the chance of erratic tool calls. It does not enforce any boundary on which URLs the tool may retrieve, so the exfiltration path remains fully open.

Raise the `max_tokens` value on each API request so the agent has enough context to distinguish legitimate instructions from injected ones.

Why it fails: The `max_tokens` parameter caps the length of generated output, not the input context, and it has no effect on instruction hierarchy. Giving the model more room to generate text does not create a security boundary, so injected instructions in fetched pages can still drive the tool loop and leak parameters.