Security and Safety
4 build exercises to practise the concepts in this domain.
7.1 — Draw the Trust Boundary, Then Close It in Four Passes
Advanced
45 minutes
- How to inventory every channel by which untrusted text reaches a context window
- How to deliver third-party content as a labelled, JSON-encoded tool_result
- How to cut a tool surface by removal, scoping and credential narrowing
- How to add a screening call with structured outputs and branch on the parsed verdict
- How to treat your own logs and your provider arrangement as part of the PII decision
7.2 — Name the Enforcement Point for Every Layer You Claim to Have
Intermediate
35 minutes
- How to audit a guardrail set by enforcement point rather than by intention
- How to decide fail-closed behaviour for each consequential action in writing
- How to narrow a credential and prove the narrowing
- How to check a deployment against the high-risk obligations in the Usage Policy
7.3 — One Rule, One Hook, One Proof That It Fired
Beginner
25 minutes
- How to tell a hook-shaped rule from a preference
- How to register a PreToolUse hook with a matcher narrow enough to be safe
- How the exit-code contract decides whether a gate blocks or quietly fails open
- How to name what a given hook will never catch
7.4 — Give Every Caller Its Own Identity, Then Prove You Could Investigate One
Intermediate
35 minutes
- How to inventory every place a Claude credential currently exists
- How to split a shared key into per-service, per-workspace identities
- How to run the exposure playbook in the documented order against a disposable key
- How to turn on the attribution you would need during an incident