Guardrail Placement
Also: defense in depth for agents · layered guardrails · control points
Guardrails belong at input screening, output screening, and tool-call authorization — a single output filter is not enough.
Why CCAR-P tests this
Candidates must show they can place controls at every trust boundary, not just bolt one filter onto the final response.
An LLM application has three distinct enforcement points, and a robust design guards all three:
1. Input screening — inspect the incoming user message and any retrieved/MCP content before it reaches the model, catching injection attempts, disallowed requests, and untrusted instructions. 2. Output screening — inspect the model's generated response before it reaches the user or a downstream system, catching leaked secrets, PII, and policy-violating content. 3. Tool-call / action authorization — before any tool executes, check that this caller is allowed to perform this action on this resource with these arguments.
A single output filter is insufficient: it cannot stop a prompt injection that has already caused a destructive tool call, cannot enforce least-privilege on actions, and sees only text — not the side effects the agent has triggered. The most damaging failures (data exfiltration, unauthorized writes) happen at the tool boundary, which an output-only design never inspects.
Treat these as layers of defense in depth. Each layer fails closed, and the tool-authorization layer in particular enforces must-hold rules in deterministic code, not in the prompt.
Exam trap
"Add a content filter on the model's output" as the complete answer is the trap — it leaves the input and tool-call boundaries unguarded, where the worst damage occurs.
Commonly confused with
Independent, unofficial study material from Claude Cert Prep. Not affiliated with Anthropic.