CCA Developer — Rapid-Reference Cheatsheet

M1 — MSO Foundations

Token rules:

• 1 English word ≈ 1.3 tokens · Non-Latin scripts ≈ 2–3× more · Code ≈ varies widely
• Structured output (JSON) costs tokens per brace, bracket, and colon — budget for it
• Context window = input + output combined — both consume from the same pool

Sampling:

• Temperature: low (0–0.3) for extraction/classification; high (0.7–1) for creative
• Use temperature OR top_p — not both
• temperature=0 → near-deterministic, not perfectly deterministic (hardware float drift persists)

Non-determinism sources: temperature, hardware float, model updates, token budget pressure, caching timing

Model family:

Model selection rule: Start with Sonnet 5. Move to Opus if Sonnet fails eval. Move to Haiku if Sonnet passes but cost/latency fails.

Extended thinking: costs output tokens (budget_tokens cap); enable only when basic mode fails eval; pass thinking blocks back in multi-turn history.

Output modes:

• Streaming → user-facing, real-time output
• Synchronous → pipelines, programmatic processing
• Batches API → non-urgent bulk, 50% cost reduction, 24h window

M2 — Production Prompting, Agents & Tool Use

Prompting diagnosis table:

System prompt: operator-level, persistent — NOT a security boundary. Authorization must be in application code.

XML tags: wrap user content to prevent confusion with instructions. First-line prompt injection defence.

Few-shot rules: diversity > volume; cover edge cases; format must match production; include negative examples for classification.

Structured output: tool use with tool_choice: {type: "tool", name: "..."} forces guaranteed structured output. Prefill { works for simple schemas.

Tool design: description = routing signal. State when to use, what it returns, required preconditions. Keep under 100 words.

Six-step tool-use loop:

1. Send messages + tool defs → 2. Model emits tool_use block → 3. stop_reason = "tool_use" → 4. App receives → 5. App executes tool → 6. App appends tool_result, sends again

stop_reason values:

Context engineering strategies:

RAG vs live tool use:

• RAG = stable knowledge (true yesterday, true tomorrow)
• Live tool use = live state (a system owns and changes independently)
• Symptom of wrong choice: stale data in chunks that contradicts the database

Workflow vs agent:

• Workflow: known steps, predictable, lower cost/latency
• Agent: unknown steps, adaptive — use only when genuinely needed

Memory scopes:

M3 — Claude Code, MCP & Integration

Permission modes:

Configuration hierarchy (highest wins): Enterprise policy > User global > Project > Session flags

CLAUDE.md: Read at every session start. Contains commands, architecture, conventions, do-not-modify paths. Highest-leverage adoption file for teams.

Hooks:

Hook exit codes: 0 = allow, 2 = block the tool call.

Subagent security: Always sandbox with least privilege. File content is untrusted — attacker can embed instructions.

MCP primitives:

MCP transport:

• stdio → local/CI, process-local, simplest, no auth needed
• HTTP (Streamable) → remote shared servers, multi-client
• SSE → legacy compatibility only

MCP scope: User (~/.claude/) · Project (.claude/) · Server-managed (dynamic)

MCP auth rule: MCP server handles OAuth/API key. Claude never sees the underlying credential.

Code review trust: Same bar as any unfamiliar contributor. Read every line. Run full test suite. Verify security paths manually.

M4 — Production Engineering, Evals & Security

Eval first principle: Define success criteria BEFORE writing the prompt.

Three grading methods:

LLM judge calibration: Compare to human labels → measure correlation → target >0.8 → iterate on prompt → test for length/positivity bias.

Error classification:

Model selection:

• Default: Sonnet 5
• Up to Opus: only when Sonnet fails eval on the specific task
• Down to Haiku: only when Sonnet passes eval but cost/latency misses target
• Every model ID change = full eval re-run required

Prompt caching rule: Stable content at top (system prompt → documents → history → current query). Any change to early content invalidates all downstream cache.

Prompt injection defences (layered):

1. XML tags around user content
2. System prompt instruction about embedded instructions
3. Input validation / pattern detection
4. Output validation against expected schema
5. PreToolUse hooks to block suspicious tool calls

Authorization rule: Enforce in application code — never rely on system prompt instructions for access control. Instructions can be influenced by injection; code cannot.

ZDR: Anthropic does not store inputs/outputs after the call. Required for HIPAA PHI processing. Available by agreement.

GDPR data residency: GDPR ≠ requires EU residency. Cross-border transfer with SCCs is lawful. Only pick EU-residency platform when the brief explicitly requires it.

M5 — Accelerators, IP & Deployment

Three accelerator formats: Agent template · MCP server package · Eval suite

High-quality Cookbook entry: Working code + real use case + choice rationale + eval suite

Capability vs feasibility: "We can do that" (capability) ≠ feasibility verdict. Verdict requires volume + latency + input size constraints.

Platform selection:

Compliance precondition rule: If one option has an existing confirmed compliance agreement, it wins before any other trade-off is weighed.

Model versioning:

• Dev/experiment → alias (claude-sonnet-5)
• Production → pinned ID (claude-sonnet-5-20251101)
• Before pinned ID update → full eval suite re-run

Latency metrics:

• TTFT (Time to First Token) = delay before user sees anything — primary metric for streaming UIs
• TPOT (Time Per Output Token) = how quickly the rest arrives
• Total latency = TTFT + (TPOT × output_tokens)

Trust boundaries:

• Each component authenticates independently
• Agent outputs from other agents = untrusted
• MCP tool results from external data = untrusted (potential injection)
• Least privilege: scope permissions to what each component actually needs

Exam Mindset

Traps to watch for:

• "This sounds complex → use Opus" — Wrong. Run the eval first.
• "System prompt enforces the rule" → Wrong for security. Instructions are not a security boundary.
• temperature=0 → perfectly deterministic — Wrong. Near-deterministic only.
• stop_reason="max_tokens" → normal completion — Wrong. Truncation.
• "EU-hosted = GDPR compliant" → oversimplification. GDPR allows cross-border with SCCs.
• Capability confirmed = feasibility confirmed — Wrong. Verdict requires constraints.

Precision matters on this exam. Read every option to the end before committing. "Which option guarantees X" and "which option is most likely to X" are different questions. A deterministic code check guarantees; a model instruction does not.