Choosing the Compliant Path Over Abandonment or Rule-Breaking
CoreDistinguish appropriate from inappropriate use cases · Difficulty 2/5
Explanation
A recurring exam pattern presents a borderline scenario with four answer choices shaped like: do it anyway, do a half-measure that sounds safe but isn't, abandon the task, or find the actual compliant adjustment. The correct answer is almost always the fourth option.
Worked Example
A PM wants to upload a spreadsheet with customer names and account numbers for trend analysis, but policy restricts regulated personal data. The best action is to remove or anonymize the personal identifiers before uploading, per policy. This lets the analysis proceed without exposing protected data.
The tempting wrong answers each fail for a specific reason:
- Upload as-is since it's internal -- fails the 'it's just internal' trap; internal use still must follow data-governance rules.
- Upload but tell Claude not to retain it -- fails because instructing a model 'don't retain this' does not satisfy a policy control. The control is not exposing the regulated data in the first place, not a promise about downstream retention.
- Skip the analysis entirely -- fails because abandoning value unnecessarily is also a wrong answer when a compliant path (anonymization) was available.
Why This Pattern Matters
The exam is testing whether the test-taker recognizes that responsible use is rarely a binary between 'do the risky thing' and 'do nothing.' There is almost always a middle path -- minimize, anonymize, redact, or restructure the request -- that preserves the value of the work while respecting the restriction.
Common exam traps
- 'Upload it but tell Claude not to keep it.' Telling the model not to retain data is not a substitute for anonymization or policy compliance -- it addresses a downstream promise, not the upstream exposure.
- Skipping the analysis entirely when anonymization would have made it compliant -- abandoning value unnecessarily is also a wrong answer.
Key Takeaways
- The correct move for a borderline case is usually to find the compliant adjustment, not to proceed as-is or abandon the task
- Anonymizing/removing identifiers before uploading is the standard compliant path for regulated personal data
- 'Don't retain this' is not a policy control -- the control is not exposing the data in the first place
- Abandoning a task unnecessarily when a compliant path exists is itself a wrong answer on the exam
Glossary Terms
Related Concepts
Data Classification, Minimization, and Anonymization
Classify data as public, internal, confidential, or regulated before deciding how to handle it
Anthropic's Usage Policy as the Outer Boundary
The AUP is the outer boundary of acceptable use; organizational policy layers additional rules on top
Screening a Whole Use Case: The Four Delegation Criteria
The same four criteria that screen a single delegated workflow step also screen an entire use case: reversibility, consequence of error, need for human creativity/empathy, and accountability