You are selecting a model for a new production workload and must complete the upstream steps before testing candidate models empirically.
Which two steps must be completed BEFORE running a representative sample on a candidate model? (Select two.) Each correct answer presents part of the solution.

• A. Select the lightest model that consistently meets the quality bar across the sample.
• B. Choose a candidate model based on the requirements profile and known capabilities.
• C. Retest the model choice when a new model version becomes available.
• D. Sign off the production rollout plan with the platform and security teams.
• E. Define the quality bar, latency tolerance, and expected volume for the workload.

The compliance team at a firm has approved a Claude Skill that generates client-facing investment summaries. The Skill includes the firm's required disclaimers and prohibited-language list. A product manager has asked whether additional guardrails are needed at the application layer or whether the Skill alone is sufficient.
Which two guardrail responsibilities should remain at the application layer rather than the Skill? (Select two.) Each correct answer presents part of the solution.

• A. Apply the prohibited-language list that the compliance team maintains and updates.
• B. Log every generated summary to the firm's compliance audit trail for retention.
• C. Verify the requesting user is authorized to generate investment summaries at all.
• D. Apply the disclaimer template that the compliance team has standardized firm-wide.
• E. Format output sections according to the firm's standardized house style guidelines.

A security audit uncovers two issues: (1) all end users share a single API key, and (2) tool calls are executed without logging the initiating user.
Which two mitigations directly address these specific findings? (Select two.)

• A. Enforce RBAC at the retrieval layer before content enters the model context.
• B. Validate structured outputs against a schema before downstream actions are executed.
• C. Add actor attribution to tool-call logs so each call records the initiating user identity.
• D. Move credentials out of the prompt context and resolve them from a server-side secret store.
• E. Replace the shared API key with per-user OAuth tokens carrying scope-restricted permissions.

You are building an ethics-review checklist for deployments supported by artificial intelligence.
Which two checks belong on the list? (Select two.)
Each correct answer presents a complete solution.

• A. Confirm that vendor licensing terms permit the planned production use of the model.
• B. Confirm that high-impact decisions retain human accountability rather than being attributed to the model.
• C. Restrict ethics review to outputs that exceed a defined model-confidence threshold.
• D. Verify that outputs do not rely on generalizations about people that the underlying data does not support.
• E. Confirm that latency and throughput targets are met across supported user populations.