A teammate is reviewing the team's threat model for a Claude application and has asked you to identify the categories of AI-specific threats that the model should cover. The teammate has already listed traditional web application threats and wants to know what additional categories apply to a Claude application.
Which AI-specific threat categories would you add?
Your Claude application's token costs have grown faster than expected. The team has not been tracking token usage by feature, so the team cannot identify which features are driving cost. The team is debating how to respond.
How would you respond?
Your Claude agent has access to a tool that retrieves customer records. A teammate has noticed that the agent occasionally calls the tool with arguments the schema does not declare, and the tool's downstream service returns an error each time. The teammate proposes loosening the schema so the tool accepts whatever arguments the model produces.
How would you respond?
The team is debating whether to integrate with the Claude API directly or through a third-party abstraction layer that supports multiple LLM providers. The team has identified that all current and projected use cases run on Claude, no internal customer has requested LLM portability, and the team's product roadmap does not mention multi-provider support over the next two years. The third-party abstraction would add roughly 15 percent overhead in code complexity and introduce one additional dependency.
Which integration approach would you recommend?