The Deploy half — condensed

The second master card, given over entirely to Domain 3 because Deploy is 40–45%
of the exam. If you revise nothing else on the morning, revise this.

Monitoring against evaluation

Telemetry is how it behaves. Evaluation is whether it is right.

A green dashboard is compatible with an agent that is systematically wrong. The
best single investment is the fallback and escalation log, with the question text.
And the dangerous metric is containment read on its own.

The four tuning causes

Content gap → create or connect the content.
Retrieval failure → restructure, add vocabulary, deduplicate, improve
metadata.
Instruction failure → instructions, topics, prompt actions.
Scope mismatch → extend scope deliberately, or reset expectations.

And the order to work in: instructions → grounding → retrieval → topics → model →
fine-tune. Cheapest and most reversible first.

Testing

Conventional testing breaks here for three reasons: non-determinism, quality as a
spectrum rather than pass or fail, and unbounded input.

The evaluation set is the durable asset — real questions, covering the tail,
versioned. Judge by deterministic checks, calibrated model grading, human review
and comparative evaluation.

Groundedness is the key knowledge measure. Over-refusal is a real failure. And the
bar for any change is: no worse on any dimension, better on at least one.

Lifecycle, minimum viable

Separate development and production, with production managed and read-only.
Everything in a solution, in source control, with a named owner and a register.
Knowledge change control and an evaluation gate.

And the definition that catches people: an agent is definition plus knowledge plus
connections plus model.

Security

An agent is an access amplifier, not an access boundary. Fix permissions before
rollout.

Acting identity is the highest-value control. Residency has three questions —
where it is stored, where it is processed, and where it goes at the moment of use
— and regional is not national. Connectors, MCP and web grounding are live egress.

Adversarial

Models cannot separate instruction from data, so the goal is containment rather
than prevention. Indirect injection through routine business content is the
realistic attack. Constraining capability beats every prompt-level defence
combined. Classify content as trusted or untrusted, not users. And the vulnerable
pattern to separate is untrusted input combined with privileged action.

Exam trap. Nearly every Deploy question rewards evidence over intent. Ask of
any control offered: is it enforced, or merely intended? Instructions, policies
and training are intent. Roles, environments, gates and logs are enforcement.

The one line to carry: intent is what you meant to happen; enforcement is what
happens anyway. The exam pays for the second.