Anthropic · CCAR-P
Capability bloat and access control
CCAR-P · Lesson 8 of 18 · 59:38
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the Claude Certified Architect – Professional exam, on the exam guide version 1.0, effective July 2026. In this lesson: capability bloat, consolidated tools and namespaces, least privilege for agents and subagents, whose identity an agent acts with, OAuth 2.1 and token audiences for remote MCP servers, token passthrough and the confused deputy, and enforcing authorization behind the tools. Includes three original practice questions.
Preview the topics
- Harborline’s agent has five tools that list claims in slightly different ways, and it often calls the wrong one. What should the architect do?
- Harborline’s support agent reads claim files through a tool with one shared admin key. In a test, a customer gets another customer’s claim, just by giving its number. What is the core gap?
- Harborline’s remote MCP server receives a user’s access token from the client, and sends that same token on to the policy API behind it. What is wrong?