PREPARING FOR CERTIFICATION

CAPSTONE ASSESSMENT A capstone assessment gives you a flawed system and asks you to find every problem. Read the following description and list at least four problems, each with its layer and fix, before looking at the answer key. A company runs a document-summarizing agent. It reads any file path the user types, including paths outside the shared folder. It keeps the full conversation of a four-hour session in every model call. It calls an outside tool server downloaded from a public list, trusting every tool description as written. It retries a failed upload instantly and forever. It has no tests, and nobody has looked at its logs, which record only the final answer. It tells users it is a person named Alex. Answer key. Problem one, files outside the shared folder, belongs to Governance and Tooling, and the fix is a permission gate that resolves paths to their final form and allows only the shared folder. Problem two, the full conversation in every call, belongs to Context, and the fix is a context builder with compaction and an external notes file. Problem three, unvetted outside tools, belongs to Governance and Tooling, and the fix is origin checks, description validation, an allow-list, and treating tool output as untrusted. Problem four, instant unlimited retries, belongs to Lifecycle and Execution, and the fix is exponential backoff with an attempt limit and a clear stop. Problem five, no tests, belongs to Verification, and the fix is an evaluation set with normal, edge, and adversarial cases, run after every change. Problem six, logs that record only the final answer, belongs to Observability, and the fix is spans and traces for every model and tool call. Problem seven, pretending to be a person, belongs to Governance and ethics, and the fix is clear disclosure that users are talking with an automated agent. If you found four or more with sensible fixes, you are thinking like a harness engineer.