Study guides / CCAR-P / Domain 5

Stakeholder Communication & Lifecycle Management · Lesson 3 of 5

5.3 - Stakeholder Feedback Loops and Expectation and SLA Alignment

Align stakeholders on what a probabilistic Claude system can promise by separating service, quality and cost objectives, deriving SLOs and SLAs from evidence and dependency limits, and running feedback loops that handle disagreement and scope change.

Most stakeholders have spent their careers with deterministic software: same input, same output, failures are bugs. A Claude system breaks that intuition. Expectation management is therefore not a launch-day slide; it is a continuous loop of setting a measurable expectation, measuring against it, reviewing the results with the people affected, and adjusting either the system or the expectation. Scenario questions in this area tend to hinge on whether an answer promises something the technology or its dependencies cannot guarantee, and on whether disagreement and change are converted into measurements and process instead of argument.

Setting realistic expectations for a probabilistic system

Four facts should shape every expectation you set.

Express expectations as measured rates on a defined test set, with the review process that catches the residual errors, and say when they will be re-measured.

SLIs, SLOs and SLAs for a Claude system

The Google SRE book defines a service level indicator (SLI) as a carefully defined quantitative measure of some aspect of the service, a service level objective (SLO) as a target value or range for an SLI, and a service level agreement (SLA) as a contract with consequences for meeting or missing the SLOs it contains. If there is no explicit consequence, you are almost certainly looking at an SLO. The point for Claude systems is that “working” has more than one dimension, and each has a different owner and mechanism.

LayerExample SLIsMostly determined by
ServiceShare of requests answered successfully within a timeout; end-to-end latency percentile; capacity headroomYour retries, timeouts, queues and fallbacks, plus the dependency's availability and your rate limits
QualityTask success rate on a labelled sample; schema-validity rate; human override or rejection rate; escalation rate; pass^k consistencyPrompt, model, retrieval, validation and review design
CostCost per completed task; spend against the monthly budget or spend limitModel choice, effort settings, caching, batching, traffic mix

A system can be fully available and still wrong too often, so an availability-only SLA says nothing about what users care about.

Key concept

Commit externally only to what you can measure and control. Derive the service SLO from your dependency's documented behaviour plus your own resilience design; define the quality SLO as a rate on an agreed test set with a named review process; keep the internal SLO tighter than anything promised externally (the SRE book calls this a safety margin); and never sign an SLA stricter than the combination of your dependencies and fallbacks can support.

What your dependencies actually promise

Read the vendor's documentation before you write a number into a contract. Anthropic's service-tier documentation describes the standard tier as best-effort availability, and its rate-limit documentation describes limits as maximum allowed usage, not guaranteed minimums. The API documents transient errors you must design for: 429 for rate limits (with a retry-after header), 500 for internal errors, and 529 when the API is temporarily overloaded. The official SDKs retry transient failures with exponential backoff, twice by default. One 429 is different: reaching a monthly spend cap returns a 429 with no retry-after header and keeps failing until access resumes, so retrying does not help. A separate spend limit you set yourself returns a 400. Whether committed-capacity or uptime terms are available, and what they cover, changes over time; check the current service-tiers page and your contract.

The practical consequence is that your availability target is an engineering output: retries with backoff, timeouts, queues for asynchronous work, a defined degraded mode (for example, route to human handling or return a clearly labelled fallback), and capacity planning against your tier. Subscribe to the provider's status page.

Error budgets and agreeing the numbers

The SRE book is explicit that 100 percent is almost never the right target: the cost of each increment grows steeply and users rarely notice the difference. An error budget is the agreed room between perfect and the SLO. The SRE workbook adds the governance: product, development and operations must all agree that the SLO is worth meeting and what happens when the budget is spent (for example, prioritising reliability work or pausing risky changes), and the SLO should be reviewed often at first and less often once it proves appropriate. For a quality SLO the threshold is a business decision informed by the cost and reversibility of errors from discovery (lesson 5.1); you supply the measurement and the trade-offs.

Feedback loops that improve the system

A feedback channel is only useful if it has an owner, a cadence and a destination. Typical channels: in-product corrections, reviewer override logs, tagged support tickets, scheduled output sampling and a periodic stakeholder review. The destination for failures should be your eval set. Anthropic's guidance suggests starting small with tasks drawn from real failures and turning user-reported failures into test cases, so the suite reflects actual usage and effort goes where impact is highest. Every prompt or configuration change made in response to feedback then runs against the regression set, which prevents fixing one complaint by silently breaking three other cases. Close the loop by telling stakeholders what changed, and review at a cadence that matches maturity, for example weekly triage at launch and periodic SLO reviews afterwards.

Disagreement and scope change

Disagreement about quality (“this output is wrong” versus “it is fine”) should be turned into a measurement: add the contested examples to the labelled set, agree a rubric and grader, check how well reviewers agree with each other, and escalate to the decision owner named in discovery if the disagreement is really about risk appetite. Scope change (“can it also handle X?”) is a new requirement, not a tweak. Run a lightweight discovery, estimate the effect on quality, latency, cost and review load, extend the eval set, and decide explicitly whether the new capability gets its own objective or is labelled best-effort. Silently widening a prompt to absorb new work is how regressions and broken promises begin.

Common exam distractor

Be wary of answers that accept a stakeholder's demand for near-perfect accuracy or a fixed uptime figure as a contractual promise, that pass the vendor's availability through as your own SLA, or that define success as a single average metric. Also wrong: refusing to commit to anything because “AI is probabilistic”, and answering each complaint with an ad hoc prompt edit and no regression run. The best answer separates service, quality and cost objectives, bases them on measured evidence and documented dependency behaviour, agrees an error budget and policy, and routes feedback into the eval set.

Exam traps

Practice question

A logistics firm is deploying a Claude-based summariser for customer claim emails. The sponsor wants the contract to state 99.99 percent uptime and 99 percent accuracy. Your service depends on the Claude API's standard tier, and you have an eval set of labelled emails. What is the best response?

  • A Propose separate objectives: a service SLO derived from the dependency's documented behaviour plus your retries, timeouts and fallbacks; a quality SLO as a rate on the agreed test set with a review step; and an SLA limited to what you can measure and control. Correct

    This is grounded in evidence and documented dependency behaviour, covers both service and quality dimensions, and uses safety margins and error budgets. It gives the sponsor concrete, honest commitments.

  • B Accept both figures because Claude is a leading model, and cover any shortfall by retrying failed requests automatically and adding a disclaimer to every summary saying that it may contain errors, which the sponsor can cite later.

    Retries do not guarantee availability or correctness, and disclaimers do not remove contractual exposure. Accepting figures unsupported by evidence or dependency terms sets the project up to breach.

  • C Refuse to commit to any measurable target because output from a language model is probabilistic and cannot be guaranteed, and offer instead to report best-effort results informally each quarter with no thresholds or consequences attached.

    This under-serves the stakeholder. Probabilistic systems can be governed by measured rates, error budgets and review processes. Refusing all commitments gives them nothing to plan around.

  • D Adopt the vendor's published uptime figure as your own SLA and report accuracy as the average score from a public benchmark for the model, since both are independently published and therefore defensible to the sponsor and to procurement.

    Your availability depends on your whole stack and fallbacks, and the standard tier is best-effort, so passing it through is unsafe. A public benchmark measures other tasks, not your emails.

Build exercise: Write an expectations and SLO charter with a feedback loop

Advanced · 60 minutes

You'll practice:

  1. For the claim-email summariser (or a scenario of your choice), draft an SLI/SLO table with at least two service, three quality and one cost indicator. For each, state the measurement method, the data source, the target as a placeholder to be set from evidence, and who signs it off.

    Separating layers prevents a single vanity metric and forces you to say how each number would actually be measured.

    You should see: A table of at least six SLIs, none of which is 'accuracy' without a definition, each with a method and an owner.

    Hints
    1. If this number went bad, which user-visible problem would it explain?
    2. Take service SLIs from request success and latency, quality SLIs from labelled samples, reviewer overrides and schema validity, and cost from spend per completed task.
    3. Example row: 'Quality: summaries matching the senior handler's label on the weekly 100-email sample; target set after baseline run; owner: head of claims; measured by blind double review.'
  2. Write a one-page 'dependency reality' section: list the API errors you must handle (429 with and without retry-after, 500, 529, timeouts), what your system does for each, and your degraded mode. Read the current Anthropic errors, rate-limit and service-tier pages first and note anything your SLO must not assume.

    This turns 'we depend on a vendor' into concrete engineering and shows what you can and cannot promise externally.

    You should see: A table mapping each failure class to retry policy, fallback and user impact, plus a list of assumptions you deliberately did not make (for example, guaranteed capacity).

    Hints
    1. Which failures clear on their own, and which need a human or a budget change?
    2. Retry with backoff on transient errors, honour retry-after when present, treat a spend-cap 429 as an alert rather than a retry case, and define what the user sees when the model path is down.
    3. Example: 'Spend-cap 429 (no retry-after): stop retrying, page the owner, switch to manual queue, notify support; expected duration: until cap raised or next billing period.'
  3. Define the error budget policy. State what happens when the quality SLO or the service SLO budget is exhausted (for example, freeze prompt and model changes, prioritise fixes, increase review sampling), who has authority to invoke it, and how product, engineering and operations agree the numbers.

    An SLO without a consequence for missing it is only a wish. The policy is what aligns stakeholder incentives.

    You should see: A half-page policy with triggers, actions, an authority and a review cadence.

    Hints
    1. What would you actually do differently the week after the budget is gone?
    2. Tie actions to each layer: quality breach means tighter review and no new features; service breach means reliability work; cost breach means model or effort review.
    3. Example: 'If the override rate exceeds the threshold for two consecutive weeks, freeze prompt changes except fixes, raise human review sampling to 100 percent for the affected category, and review at the Friday quality meeting.'
  4. Design the feedback loop: list four channels (for example reviewer overrides, end-user ratings, support tickets, weekly sample grading), and for each give the owner, cadence, and where the data goes. Then write the rule that every prompt or configuration change must pass the regression eval before release. Include the procedure for a scope-change request.

    This makes feedback an engineering input rather than anecdote and closes the loop with stakeholders.

    You should see: A channel table, a change gate, and a scope-change procedure that starts with a lightweight discovery and ends with an updated eval set and decision record.

    Hints
    1. Where does a single bad output end up in your system, and who sees it?
    2. Every confirmed failure becomes a test case; every change runs the regression set; every scope change triggers a mini-discovery, eval extension and stakeholder sign-off.
    3. Example: 'Support tags a ticket ai-error -> triager reproduces within two working days -> case added to eval set with expected label -> fix proposed -> regression run -> release note to stakeholders.'
  5. Implement a tiny consistency calculation. Given repeated trials per task (each a list of booleans), compute the fraction of tasks where all k trials passed (pass^k) and the fraction where at least one passed (pass@k), and compare them for k=1, 3, 5 using invented data. Explain in two sentences which figure belongs in a customer-facing reliability statement.

    It shows why average or best-case metrics can overstate reliability, which is a common source of over-promising.

    You should see: For invented data with moderate per-trial success, pass@k rising toward 1 as k grows while pass^k falls, and a clear explanation of why the latter reflects consistency.

    Hints
    1. What does 'at least one attempt succeeded' hide from a customer who only sees one attempt?
    2. Group trials by task, then apply all() for pass^k and any() for pass@k over the first k trials.
    3. def pass_stats(results, k):
          tasks = list(results.values())
          all_k = sum(all(t[:k]) for t in tasks) / len(tasks)
          any_k = sum(any(t[:k]) for t in tasks) / len(tasks)
          return all_k, any_k
      
      results = {'t1': [True, True, False, True, True], 't2': [False, False, True, True, False], 't3': [True] * 5}
      for k in (1, 3, 5):
          print(k, pass_stats(results, k))

Sources