Alignment Boundary
Also: training vs app-layer responsibility · safety boundary · shared responsibility line
The line between what model training covers and what your application layer must enforce itself.
Why CCAR-P tests this
Candidates must not assume model alignment removes the need for app-layer controls; the boundary defines who owns which risk.
The alignment boundary separates two kinds of safety: what the model's training provides (general helpful/harmless behavior, refusals for obviously harmful requests) and what your application layer must enforce (your specific policies, authorization rules, data-handling obligations, and business constraints).
The exam's core point: training is not your control layer. A well-aligned model still does not know your tenant boundaries, your spend limits, your regulatory obligations, or which actions are irreversible in your system. Those are must-hold rules that belong in deterministic code — authorization checks, redaction, escalation policy, fail-closed guardrails. Relying on the model to "just behave" for app-specific limits is placing a control on the wrong side of the boundary.
Use the boundary as a design question: for each risk, ask "does model training reliably cover this, or must my app enforce it?" Anything on the app side goes into your control register with an owner and evidence. Model alignment reduces baseline risk; it does not discharge your responsibility for the controls only you can define.
Exam trap
"The model is aligned, so we don't need our own authorization checks" is the trap — training covers general behavior, not your app's specific must-hold rules.
Commonly confused with
Related concepts
Independent, unofficial study material from Claude Cert Prep. Not affiliated with Anthropic.