Domain 7 – Security and Safety (8.1%)

• AI Application Security (3.2%)
• Guardrails and Safe Deployment (2.3%)
• Claude Hooks (1.0%)
• Identity, Secrets, and Key Management (1.6%)

CCDV-F Domain 7 · Task 7.1

What You Need to Know

Prompt injection is text that tries to give Claude instructions it should not follow. One context, no channel separation — nothing structural separates commands from data.

Two Threat Models

Model	Adversary	Mitigations
Direct / jailbreaks	The user of your application	Harmlessness screen, input validation, system prompt boundaries, policy for repeat offenders; metadata.user_id (hashed opaque ID)
Indirect	Whoever influenced content Claude reads on the user’s behalf (email, web page, uploaded file, tool result)	The class that matters in agentic applications

Put Untrusted Content in a Tool Result

1. Deliver third-party content inside tool_result blocks, never in system prompts or plain user text
2. Say what the content is and where it came from
3. State the untrusted-content policy in the system prompt
4. JSON-encode the untrusted string where possible
5. Do not put your own instructions inside a tool result — send them in a following user turn

Screen What Comes Back, in Code

Inbound: harmlessness screen with a lightweight model (Haiku) + structured outputs for a boolean verdict. Outbound from a tool: screen raw output before returning as tool_result. A classifier is probabilistic — sits alongside deterministic controls, never instead of them.

Least Privilege Over the Tool Surface

Three moves (not interchangeable):

1. Remove the tool — strongest; Claude does not see it
2. Scope the tool — deny matching calls in every permission mode
3. Narrow the credential — read-only where reading is enough; end-user entitlements, not service account

Evaluation order: hooks → deny rules → ask rules → permission mode → allow rules → canUseTool callback. Auto-approved tools never reach canUseTool. For a check that must run on every call, use a PreToolUse hook.

Everything in Context Can Leave Through the Response

Rank the fixes: (1) don’t put the sensitive value in context; (2) output check for what must never appear; (3) telling the model to keep a secret (fragile). Constrain the outbound path — which tools can send, fetch or write, and to where.

CCDV-F Domain 7 · Task 7.2

What You Need to Know

A guardrail is a check with an enforcement point. A behaviour shaper is different: the model reads something and decides. Ask three questions: What does it inspect? Where does the code run? What happens when it fires?

The Four Layers

Layer	What it can catch
Input checks	Classification, pattern filtering, redaction, shape validation — cheap, probabilistic, channel-specific
System prompt / model training	Shape behaviour; enforce nothing
Tool-level controls	Which tools exist, credential scope, approval requirements, deterministic pre-execution blocks — where enforcement lives
Output checks	Validate shape, classify against policy, redact, and block the resulting action

Content Policy Is an Engineering Obligation

Anthropic’s Usage Policy has three parts: Universal Usage Standards, High-risk Use Case Requirements, Additional Use Case Guidelines.

High-risk Areas (eleven): legal, medical, finance, credit, insurance, housing, employment, education and credentials, healthcare access, public benefits and services, legal status and adjudication.

Two controls on every High-risk AI Recommendation:

1. Qualified human-in-the-loop — meaningful review before delivery/decision; authority to change it
2. Disclosure — the person receiving advice or subject of the decision is clearly told AI was used

Consumer-facing chatbots/agents must disclose that users are interacting with AI (at beginning of each chat session or in the product interface).

Secure by Design

• Least privilege — smallest tool set and narrowest credential scope; remove rather than deny
• Privacy — minimisation applied to the context window; data the task does not need never enters
• Identity and access management — every tool call resolves to an identity with checkable entitlements

Fail Closed on the Security Path

When the classifier times out, validation is inconclusive, or the approval service does not answer: refuse the consequential action and hold it. Do not proceed unguarded. Separate the consequential action from the whole feature; held work has a queue and a notification.

Rollout and Observation

Stage the exposure. Monitor security-relevant events. Red-team with documents and tool outputs that deliberately contain injection attempts. A guardrail you cannot see firing is a guardrail you cannot maintain.

CCDV-F Domain 7 · Task 7.3

What You Need to Know

A hook is your own code, wired to a named point in the agent’s lifecycle. It gives deterministic control: certain actions always happen rather than relying on the LLM to choose.

Blocking With PreToolUse

PreToolUse fires before a tool call executes. Exit code 2 blocks (reason on stderr reaches Claude). Exit 0 means no objection (normal permission flow still applies). Any other non-zero exit with plain-text/empty stdout is a non-blocking error — the action proceeds. Set onFailure: "block" to make any failed run block.

JSON form: hookSpecificOutput with permissionDecision of allow, deny, ask or defer. Precedence when several hooks differ: deny → defer → ask → allow. Exit 2 wins regardless.

Matchers

Exact name (letters, digits, _, -, spaces, commas, |) or unanchored JavaScript regex (any other character). mcp__archive matches no tool; mcp__archive__.* matches every tool on that server including ones added later.

Other Safety Events

• UserPromptSubmit — before Claude processes the prompt; decision: "block" stops it. Can keep a pasted secret from the model, not from local history.
• PostToolUse — cannot undo a call that has run; updatedToolOutput replaces the output before it reaches Claude. PreToolUse for outbound inputs; PostToolUse for inbound results.

Where It Sits in the Permission Order

Hooks evaluate first. A blocking hook stops the call before permission rules are consulted. In bypassPermissions mode, hooks still execute and can block. A hook returning allow does not clear a matching deny or ask rule.

What a Hook Cannot Do

Only what you can express as a check on an observable action (tool name + input). Intent rules are not hook-shaped. Async hooks cannot block. A command hook that times out does not block. prompt and agent hook types are model evaluations — not deterministic. Where the rule is a boundary, use command.

CCDV-F Domain 7 · Task 7.4

What You Need to Know

Three jobs: managing secrets/credentials/API keys; identity validation and authentication; authorised access monitoring.

Where Keys Live

Anything shipped to a client is public. The client talks to your backend, which holds the credential and calls Claude. Benefits: credential off the client; place to authenticate the end user; enforcement point for per-user rate limiting and quota.

Keep keys in a secrets manager, injected at run time. Distinct key per environment. Environment read, never a literal.

Key Types

Type	Identity
Personal key	Acts as the user it belongs to
Service account key	Acts as a service account — for shared/automated workloads
Workspace key	Acts as no one; legacy

Expiration chosen at creation (3h / 1d / 7d / 30d / custom / Never); cannot be changed. Limits lifetime of a leaked credential but is not a substitute for secret hygiene.

Workload Identity Federation — workload exchanges an IdP identity token for a short-lived Claude token. No sk-ant-api... string to mint, distribute or rotate.

Exposure Playbook (Order Matters)

1. Kill the credential — disable, delete or rotate first
2. Remove it from wherever it leaked — git history, build caches, CDN, screenshots
3. Fix the design that put it there
4. Review the access logs for unauthorised use

Admin API can only read, rename and change status of existing keys (not provision).

Verification and Attribution

Authenticate at the edge; verify level at the point of use, per action. Agent acting on somebody’s behalf carries that person’s authority in its tool calls. Distinct key per service so an anomalous spike names its source. Usage and cost attribution runs per key and per workspace.

Offboarding: personal keys stop and are archived when owner is removed; service account keys keep working unless the service account is archived; workspace keys keep working whoever created them.