Speaker notes: Welcome. Teasing: “Today we are hiring a colleague. He works in your terminal, he never sleeps, and at the end of the session he will be an employee of your CI/CD pipeline. The real question of the day: how to write your employment contract.” Announce the certification weight of this chapter.
Speaker notes: 90 seconds. Question to the room: “Who actually executes a tool call?” Expected response (Session 5 of the intermediate level, reworked): never the model, always your code. Today, this principle is embodied in a product: Claude Code.
Speaker notes: Clear contract. Make it clear that the exam tests *judgment* (scenarios), not rote flags. Each part ends with a standard certification question.
Speaker notes: Emphasize “agentic”: this is the loop of Session 3, embodied. Counterexample: autocompletion suggests the following line; Claude Code completes the *task*, including tests.
Speaker notes: THE slide to memorize. Announce: “the session plan is this table, line by line.” You will come back to this at the end. On the exam, many questions boil down to: what level (persuasion/capacity/control) for what need?
Speaker notes: Breaks a common preconception. Architect consequence: what you want him to *always* know must be in CLAUDE.md; the rest he will find when he needs it.
Speaker Notes: On custom commands: a Markdown file = a reusable prompt versioned with the project. Useful examples: production launch checklist, review template, migration procedure. It's team tools, not a gadget.
Speaker notes: 8 minutes max. The permission requests that appear are your Part C teaser: “note that I have to approve — who decides what gets rubber stamp?” Us, in 30 minutes.” If no network: Backup screenshots prepared.
Speaker Notes: The onboarding analogy works very well. Each line invested in CLAUDE.md saves dozens of downstream corrections — this is the best return on investment of all tooling.
Speaker notes: The 4 sections: overview, conventions, commands, gotchas. Emphasize *exact and copyable* commands: `poetry run pytest`, not “run tests”. Certification question: which section reduces execution errors the most? → the exact commands.
Speaker notes: Test of the generic file: “if this CLAUDE.md could describe any project, it does not describe yours.” You will reuse this test by correcting Exercise 1.
Speaker notes: Monorepo use case: different conventions between the front and the back. Transition exercise: “to you — 20 minutes to write the billing-api CLAUDE.md. The web builder can scaffold, but the final densification is manual.”
Speaker Notes: Slide pivot after exercise and break. Announce: the most important part of the session AND the trickiest in the exam. Slow down the pace.
Speaker notes: Chapter 13 of the guide. Build the leaderboard WITH the room before posting. `WebFetch` surprises in “medium”: unreliable web content = prompt injection vector, plus exfiltration possible. `Bash` unconstrained = SSH access given to the agent.
Speaker Notes: Simple mental model that solves 80% of scenario questions. Session 5 least privilege, applied to a coding agent.
Speaker Notes: Three rules: (1) patterns by command prefix — `Bash(git diff:*)` covers variants; (2) `deny` ALWAYS wins over `allow`; (3) the unlisted → interactive confirmation… or headless refusal. This third rule sets up Part E—set the scene now.
Speaker notes: The reassuring point AND the worrying point on the same slide, deliberately. The defense against injection is not “the model is smart” but “even manipulated, it CANNOT execute what is denied”. Permissions protect against manipulation of the model itself.
Speaker notes: 5 minutes, web page projected, the room votes. Response: Read/Glob/Grep/LS + `Bash(git diff:*)`, all else refused. Deliberate trap: someone will propose `Write` “to write the review” — no, the review goes out to standard output, it's the pipeline that posts the comment.
Speaker Notes: This distinction comes up in the exam in ten different forms. Wording to note: security policies go into hooks/permissions (deterministic), preferences and conventions in CLAUDE.md (probabilistic).
Speaker notes: Have the room verbalize one use case per event before showing the example column. PreToolCall subtlety: blocking sends a *message* to the model, which adjusts its strategy — it's a dialogue, not a silent wall.
Speaker notes: Family 3 speaks to participants in a regulated environment: the audit log of the agent's actions is what the auditor will ask for. A PostToolCall hook that logs tool + parameters + result = native auditability.
Speaker notes: THE reading grid for the exam. Typical question: “curl prohibited externally but allowed internally” → hook (conditional logic), not permission (too binary). Have a 2 minute debate then launch Exercise 3 (hook design — 15 min start time).
Speaker Notes: Transition after the hooks exercise. The same binary, a flag: the agent becomes a pipeline component. Ask the killer question: “Who clicks “allow” at 3 a.m. in a CI runner?” → person. Next slide.
Speaker notes: Almost certain question on exam (“job stops, tool refused, cause?” → missing permission). On the anti-pattern: if you really have to allow everything, it's disposable container + no outgoing network + zero secrets. Otherwise it's a flaw, not a pipeline.
Speaker notes: Strengths of the AI review: obvious bugs, conventions, error handling oversights. Weaknesses: business relevance, substantive architecture. Hence “non-blocking” – we harden it later, with supporting data, when the team trusts it.
Speaker notes: The “permission + hook marriage” is the most elegant pattern of the session: permission opens the capacity, the hook finely restricts it. This is exactly the bonus question in Exercise 2 — say it explicitly.
Speaker notes: Order of magnitude, without engraved number: “the cached token costs a fraction of the full token”. The real CI lever is not the price but the trigger discipline: revise each push of a PR of 40 commits = waste; revise upon opening + upon request = reasonable.
Speaker notes: 5 minutes in plenary with the web page, then launch the framework for Exercise 2 (to be completed at home, reread in Session 7). Check that each pair has chosen their pattern before letting them go.
Speaker notes: Return to slide 5, “nature” column in addition. Have a participant rephrase: “What goes where?” Security → never in the probabilistic. This is the sentence to take for the exam.
Speaker notes: Recommended flash oral quiz: Q2, Q5, Q9. Collect the exit tickets — they tell you what printed (and what didn't). Remember that Exercise 2 will be reread at the opening of Session 7: the fatal mistake “allows everything + secrets” caps the grade.