Domain 5 — Governance, Safety and Risk (14%)

14% of the exam, roughly 9 questions. One of the three domains with no Foundations equivalent, and the one where regulated-sector experience shows.

5.1 LLM failure modes, named

You are expected to identify these precisely, because the mitigation differs for each:

5.2 Guardrails as layers

No single control is sufficient, and the exam rewards defence in depth in a specific order of strength:

1. Architectural — the system cannot perform the damaging action. Scoped tools, scoped credentials, no write path. Strongest, because it does not depend on the model's behaviour.
2. Deterministic validation — schemas, business rules, policy checks in code.
3. Model-based screening — a cheap classifier over inputs and over tool outputs, with schema-constrained results.
4. Prompt-level — hardened system prompts and untrusted-content policies. Useful, and the weakest layer, because it is probabilistic.
5. Human review — for the cases the stakes demand.

The examinable ranking — when one option hardens a prompt and another removes the capability, the removal wins. Prompt defences lower the probability of an attack succeeding; architectural ones remove the possibility of damage.

5.3 Human in the loop, designed properly

Where output affects someone's rights, livelihood, health or legal position, a qualified human reviews and owns the decision, and the use of AI is disclosed to those affected. The recognised high-risk domains are legal, healthcare, insurance, financial advice, employment, housing and lending, academic assessment and journalism.

The professional-level addition is that review must be designed, not merely required. That means deciding which cases are reviewed rather than all of them, presenting the reviewer with the evidence and the citations rather than a bare answer, measuring the override rate as a quality signal, and sizing the queue so the review actually happens. A review step that creates a two-day backlog will be bypassed, and the control will exist only on paper.

5.4 Regulatory landscape

What Anthropic provides on the commercial side, and which an architect is expected to know exists: SOC 2 Type I and Type II attestations, ISO/IEC 27001:2022 for information security, ISO/IEC 42001:2023 for AI management systems, and a HIPAA-ready configuration with a BAA available. Reports are requested through the Trust Portal. Commercial traffic — Team, Enterprise and the API — is not used to train models by default, and zero data retention arrangements are available for organisations that require them.

The distinction to hold onto: a vendor's certification is an input to your compliance case, not a substitute for it. You still own lawful basis, minimisation, retention, access control and audit evidence for your own system.

5.5 Building the audit trail

Assume you will have to demonstrate, months later, what the system did and why. That requires per-request records of the model and prompt version, the inputs and outputs, the retrieved sources and citations, validation and guardrail outcomes, who reviewed what and when, and the decision that resulted — retained for the period the regime requires and no longer, with sensitive fields redacted. Logs are also a disclosure surface: the easiest place to leak data you were careful about everywhere else.

← Previous: Domain 4 — Evaluation, Testing and Optimisation  |  Next: Domain 6 — Stakeholder Communication and Lifecycle →