A consumer business allows its Customer Support Resolution Agent to issue refunds up to 500 on its own, and up to 900 when the customer's account is more than 12 months old. The rule is written in the system prompt and repeated in the project CLAUDE.md. A quarterly audit of 5,000 sessions finds 14 refunds between 500 and 900 paid on accounts younger than 12 months, and compliance requires that count to reach zero. Which change most effectively meets that requirement?
- ASet the maximum on the amount field in the process_refund input schema to 500, so that any larger value fails validation before the tool is invoked and the agent has to hand the case to a human instead.
- BAdd a PreToolUse hook on process_refund that reads the requested amount and the account age already retrieved in the session, and blocks the call when the amount is above 500 on an account younger than 12 months. Correct
- CRestate the two thresholds at the top of the system prompt with the amounts in bold, repeat them in the project CLAUDE.md beside the refund guidance, and re-run the audit at the end of the next quarter.
- DRoute every refund request through a separate classifier subagent that predicts whether the requested amount is permitted for that account and returns an approval flag the main agent is instructed to respect.
Why A is wrong: Tempting because schema validation is genuinely deterministic and would stop every breach. It also blocks the permitted 900 refunds on established accounts, since a static field maximum cannot express a limit that varies with account age, so it buys compliance by breaking a sanctioned path.
Why B is correct: Correct because the hook evaluates the two-part condition in code before the refund is submitted, so a call that breaches the policy cannot execute whatever the model concluded, which is what a compliance figure stated as zero requires.
Why C is wrong: Tempting because the instruction is already close to correct and clearer wording usually improves adherence. Prompt guidance yields probabilistic compliance, so it lowers the breach count without driving it to zero, and the audit surfaces that a quarter later.
Why D is wrong: Tempting because a second opinion sounds like a control. The check is a simple comparison of an amount against an account age, so a predicted flag adds latency and cost while swapping one probabilistic judgement for another rather than enforcing the limit.