Task 1.4: Implement multi-step workflows with enforcement and handoff patterns

• ARepeat the rule at the end of the system prompt, where recent instructions carry more weight

  Incorrect

  Moving or repeating a prompt instruction changes the odds, not the guarantee; the instruction is already being ignored at times.

• BAdd few-shot examples to the system prompt that show verify_identity always being called before the email change

  Incorrect

  Examples make the right order more likely but remain guidance, so some rate of skipped verification remains.

• CMake update_account_email reject any call that lacks a token issued by a successful verify_identity

  Correct

  A gate in the tool layer holds on every call, whatever Claude decides, which is what a requirement of zero violations needs.

• DLower the temperature of the agent's requests so that Claude follows the documented verification steps more consistently

  Incorrect

  Sampling settings do not turn an instruction into a rule; the model can still skip the step.

Prompt instructions have a non-zero failure rate. When an order of steps is a hard requirement, such as identity verification before an account change, put a programmatic prerequisite in front of the protected action.

• AResolve the first issue in full and then ask the customer to open a new conversation for each of the other two requests

  Incorrect

  This pushes work back to the customer and turns one contact into three.

• BSplit it into separate issues, investigate each with the shared customer context, and send one combined reply

  Correct

  Decomposing a multi-concern request into distinct items and synthesizing one answer covers every issue in a single contact.

• CStart a separate agent session for each issue and let each session reply to the customer on its own

  Incorrect

  Separate sessions lose the shared customer context and send the customer three disconnected replies.

• DEscalate any message that raises more than one issue to a human agent, since multi-part requests are complex

  Incorrect

  Each of these issues is routine; escalating on the count of issues lowers resolution rates without a policy reason.

Break a multi-concern request into distinct items, investigate each, and combine the results into one resolution. Independent items can be looked up in parallel because they do not depend on each other.

• AWhat the customer needs, stated so that the human can act on it

  Correct

  Anthropic's own buying agent hands a buyer to a rep so that the rep starts already knowing what the customer needs.

• BWhat the agent has already told the customer, such as a delivery date it quoted

  Correct

  A rep who knows what the customer has been told can continue the conversation instead of contradicting it or asking again.

• CA link to the session transcript in the agent platform's logs

  Incorrect

  The human agents cannot open the transcript, so a link gives them nothing they can use.

• DThe agent's own confidence rating from 1 to 10 for its diagnosis

  Incorrect

  A self-rating says nothing about what the customer needs or what they were told.

• EOnly the customer's most recent message, so that the human sees the current state of the case

  Incorrect

  The last message rarely states the whole request or what the agent already said, so the human would have to ask again.

A handoff to someone who cannot see the conversation has to carry it. In Anthropic's account of its buying agent, a rep picking up a handed-off buyer starts already knowing what the customer needs and what they have been told, so the customer does not repeat themselves.

• AIssue the discount first to calm the customer, then check the return

  Incorrect

  That grants the discount before the condition is met.

• BConfirm the return first, then issue the refund and discount

  Correct

  When one item depends on another's outcome, the steps run in order.

• CEscalate the discount question to a human every time

  Incorrect

  The policy is clear, so the agent can apply it.

• DRun all three lookups in parallel and issue whatever the results allow

  Incorrect

  Parallel work suits independent items; here the discount depends on the return.

Investigate independent items in parallel, but sequence steps whose eligibility depends on earlier results.

• AA generic "permission denied" so that internal rules stay hidden

  Incorrect

  A generic denial leaves the next step unclear.

• BAn instruction to escalate every blocked refund to a human

  Incorrect

  Most blocked refunds only need the verification step.

• CNo reason, so that Claude is not tempted to work around the gate

  Incorrect

  Without a reason Claude cannot tell what to do next.

• DA reason stating that verify_identity must succeed first

  Correct

  Claude reads the denial reason and can take the missing step.

Programmatic gates should explain their denials so the agent can recover, for example by naming the prerequisite tool to call.

• AWriting the CLAUDE.md line in capital letters makes it enforced

  Incorrect

  Emphasis changes salience, not enforcement.

• BDeny rules only apply in plan mode

  Incorrect

  Deny rules block in every permission mode.

• CA deny rule such as Bash(git push --force *) in settings blocks the command in every mode

  Correct

  Deny rules are enforced by Claude Code, including in bypass mode.

• DA path-scoped rule in .claude/rules/ blocks commands that match its paths

  Incorrect

  Rules are instructions; they do not block tool calls.

• ECLAUDE.md is context Claude tries to follow, not enforced configuration

  Correct

  Instructions in CLAUDE.md are advisory, which is why the rule was ignored.

Use permission deny rules (or hooks) for actions that must never happen; CLAUDE.md and rules files guide Claude but do not enforce.

• AA sentiment score for the customer at the moment of escalation

  Incorrect

  Sentiment says how the customer felt, not what the agent could not do, so it does not show what to improve.

• BThe full transcript of the conversation, attached to the ticket

  Incorrect

  A transcript per case holds the answer somewhere, but without a stated reason nobody can see patterns across hundreds of handoffs.

• CThe reason the agent is handing the case over, recorded with each escalation so the reasons can be reviewed for patterns

  Correct

  Anthropic's buying agent explains why each time it passes a buyer to a person, and those reasons shaped the improvements that cut the share needing a person by about half.

• DA confidence rating from the agent for how well it understood the request

  Incorrect

  A self-rating does not say what blocked the agent, so it cannot guide what to build next.

Treat every handoff as feedback. When the agent states why it is escalating, the reasons can be grouped and reviewed, showing which missing capabilities or policies send cases to people and what to improve first.