07 Orchestration Placement Diagnosis: Where a Need Belongs, and the Cost of Getting It Wrong
June 2026 (6433 Words, 36 Minutes)
Two ways to work through these cards. This page is the full exercise — all six cards, their scenarios, and the complete instructor key for each one (placement, kind of need, deciding axis, cost ledger, the tempting wrong placement and its cost, the one-sentence final placement, and a “draft the artifact” model answer). Read it linearly to study, or use it as the instructor and group-workshop guide (worksheet, warm-up example, group activity formats, rubric, debrief, grading scale all included below). For a gated self-study version where you decide each placement yourself before seeing the key, use the interactive quiz — the same six cards as placement + need + reflection questions with the analysis revealed after you submit.
Goal
In this exercise you treat six recurring needs in an AI-assisted development workflow as objects of study. For each need you decide where in the orchestration layer it belongs and why, then predict the cost of the tempting wrong placement, reasoned in context-budget and attention terms. This is a routing exercise: it cites budget reasoning only as justification, and it deliberately does not re-run the Lecture 7 lab’s three artifacts (the context-budget calculator, the buried-instruction experiment, the single-file CLAUDE.md redesign). By the end you will:
- Route a recurring need to the right orchestration mechanism — root CLAUDE.md, a subdirectory CLAUDE.md, a skill, memory, a tool/MCP server, a hook/CI gate, or out-of-scope;
- Classify the kind of need behind it — influence, enforcement, capability, or human ownership — using the completed three-layer model, extended with capability;
- Reason about placement as a shared, finite context window: the window has a fixed size, so every token an always-on block occupies is a token (and a slice of cost and latency) not available to the task — treat “budget” as window occupancy and cost, not as a single pool of attention split evenly among tokens (attention is normalised per head and per position and concentrates on what the model has learned to weigh, so this budget metaphor is a planning heuristic, not a literal attention law);
- Predict the concrete failure of a mis-placement — wasted window cost, lost-in-the-middle, never-loaded-so-absent, probable-not-guaranteed, stale memory, or widened blast radius.
This is the Lecture 7 sibling of the Lecture 6 “Prompt Strategy Diagnosis” exercise. There, the question was which prompting strategy fits this task; here it generalises to the orchestration layer: which mechanism should host this need, and what does the wrong host cost.
Learning objectives
After this exercise, students should be able to:
- Place a recurring need at the right point in the orchestration layer, and justify the choice on a named axis (frequency, scope, provenance, likely-vs-guaranteed, touches-the-world).
- Distinguish the four kinds of need — influence, enforcement, capability, human — and recognise that a placement decision sits inside a kind, not instead of it.
- Reason in budget terms about always-on standing charges vs. on-demand vs. free, treating the context window as one finite, shared resource (occupancy and cost) — every always-on token is window the task does not get, which is true regardless of how attention itself distributes.
- Predict the cost of a wrong placement mechanistically — name the failure mode and the mechanism behind it.
- Reject the
sterner CLAUDE.mdreflex — recognising that more or louder influence never substitutes for enforcement, a capability, or a better placement. - Answer “it depends” responsibly by naming the deciding condition rather than leaving it bare.
- Draft the artifact — sketch the SKILL.md, hook, MCP tool spec, memory note, or subdirectory file that the placement implies.
Recommended placement in the lecture
This exercise works best after students have worked through Lecture 7 §10 (the context budget) and §11 (the completed three-layer model), and ideally after the Lecture 6 “Prompt Strategy Diagnosis” workshop, because it reuses the influence/enforcement/human vocabulary and extends it.
Recommended sequence:
- Short recap of the four kinds of need (influence, enforcement, capability, human) and the placement menu.
- Introduce the diagnosis worksheet.
- Work through the warm-up example together.
- Students work in pairs or small groups on the cards.
- Groups present placements and the cost of the wrong placement.
- Instructor debrief connects answers back to context-budget engineering.
Duration options
Short version: 25–30 minutes
Use 3 cards (a good set: Card 1, Card 2, Card 6 — one skill extraction, one enforcement, one split-layer).
- 5 min: explain the task and show the placement menu
- 10–15 min: group work (placement only)
- 10 min: discussion and debrief
Standard version: 45–60 minutes
Use 4–5 cards.
- 5 min: recap the four kinds of need
- 5 min: instructor warm-up example
- 20–30 min: group work (placement + cost of the wrong placement)
- 15–20 min: presentations and debrief
Extended lab version: 90 minutes
Use all six cards and require students to draft the artifact for at least two of them.
- 10 min: recap and warm-up example
- 25 min: place and cost all six cards
- 25 min: draft the artifacts (SKILL.md, hook, MCP spec, memory note, subdirectory file, hook+permission sketch)
- 20 min: compare drafts
- 10 min: debrief and takeaways
Required prior concepts
Students should already be familiar with:
- CLAUDE.md / AGENTS.md and how they become tokens (§4) — the always-on rule (rule one) and the on-demand subdirectory splice (rule two)
- skills as context on demand (§7)
- the illusion of memory (§5) and CLAUDE.md vs MEMORY.md (§5.2)
- the tool-call loop (§8) and MCP, the standard interface (§9)
- the context budget (§10) — everything competes for one finite window
- the completed three-layer model — influence / enforcement / human (§11)
Placement menu reference sheet
Give students this compact reference before the exercise. The right-hand column is the single question that routes most needs.
| Mechanism | What it is | Cost profile | Decide this when… |
|---|---|---|---|
| Root CLAUDE.md / AGENTS.md | Always-on instruction file, loaded at session start (§4.1) | Always-on standing charge in every session | The need is genuinely always-on — relevant to (nearly) every session |
| Subdirectory CLAUDE.md | On-demand instruction file, spliced when a tool reads that subtree (§4.2) | On-demand: paid only by sessions that touch the subtree | The need is subtree-only — scoped to one directory |
A Skill (.claude/skills/<name>/SKILL.md) |
A codified prompting pattern, injected at invocation near the query (§7) | Free until triggered, then on-demand at the recency-advantaged position | The need is one-task-type — a recurring pattern for one kind of task |
| MEMORY.md | Model-authored, per-user, per-machine soft context (§5.2) | Small always-on charge, borne by one user; unverified | The need is a personal soft preference — fine to be unverified, follows the person not the repo |
| A Tool / MCP server | A capability the orchestration layer wires to the world (§9) | Tool descriptions are an always-on charge in every session; widens blast radius | The need is to touch the world — and the frequency justifies the standing cost |
| A Hook / CI check + permission scoping | Deterministic enforcement at the tool/commit interface (§11.2, §9.3) | Free in context-budget terms — runs outside the window | The need must be guaranteed, not merely made likely |
| Out-of-scope | Leave it off the always-loaded set entirely | Free | The need is rarely needed and cheap to supply ad hoc when it arises |
| A subagent / workflow (stretch / emerging) | Skills that invoke skills; phase-by-phase context loading (§7.3) | On-demand, per phase | The need is a multi-phase task whose phases each want different context — emerging, treat as stretch |
A dating caveat. The mechanism names and paths above are mid-2026 Claude Code specifics;
.claude/skills/,MEMORY.md, and the exact loader rules will date. The concepts — always-on vs. on-demand, influence vs. enforcement vs. capability, one shared budget — transfer to every orchestration layer. Keep the out-of-scope option live throughout: not every need deserves a permanent home.
The two cuts, restated
Every card is diagnosed twice.
- First cut — what kind of need is it? Extend Lecture 6’s three layers with a fourth:
- Influence — text that enters the context and biases the distribution (CLAUDE.md, skills, memory, prompts, tool results).
- Enforcement — a deterministic guarantee outside the model (hooks, CI, schema validation, scoped permissions).
- Capability — the system must touch the world; only a tool can (§9.3: what an AI system can do is determined by its tool surface, not its intelligence).
- Human judgment / ownership — what no automated layer can encode; the human owns the wrapper.
- Second cut — which concrete L7 mechanism hosts it? Use the placement menu above.
Throughout, treat “best solved by a sterner / better-worded CLAUDE.md” as a decoy. It is the reflex Lecture 7 is built to break: louder influence never becomes enforcement, never becomes a capability, and never fixes a placement.
Student worksheet
For each card, students fill out the following row.
| Question | Answer |
|---|---|
| The recurring need (in one line) | |
| How often does it arise? (every session / per-task-type / per-subtree / personal-recurring / rarely) | |
| FIRST CUT — kind of need (influence / enforcement / capability / human) | |
| SECOND CUT — concrete L7 mechanism | |
| Deciding axis (the one thing that settles it) | |
| Cost class of each candidate (always-on standing charge / on-demand / free) | |
| Tempting wrong placement + its concrete cost | |
| Final placement (one sentence) |
Instructor warm-up example
Warm-up need: “Use British spelling in prose” — but for a need that is genuinely always-on, to contrast with Card 4.
Imagine a documentation repository where every file is prose and the whole team must use British spelling, enforced informally by review but not by any linter. Where does that belong?
Instructor key — click to reveal
First cut: influence (text that biases the distribution).
Second cut: root CLAUDE.md / AGENTS.md — because here the need really is always-on: every session in this repo writes prose, and the team shares the convention.
Deciding axis: frequency. The contrast with Card 4 is the whole point — Card 4’s British-spelling preference is personal (one developer, follows the person) and so belongs in MEMORY.md; this warm-up version is team-wide and every-session, so it earns its always-on standing charge in the shared, version-controlled CLAUDE.md.
Why not a skill? A skill is for one task type; “write British prose” is not a task type, it is a property of every task in this repo. Always-on is correct.
Teaching point: the same surface text (“British spelling”) routes to different mechanisms depending on frequency and provenance. Placement is never decided by the topic of the rule; it is decided by the axes. This is exactly the trap Card 4 sets — watch students who pattern-match “British spelling → CLAUDE.md” walk straight into it.
The six cards
Each card is a recurring need. Decide where it belongs and why, then predict the cost of the tempting wrong placement. The cards vary: some have one clean home, one is a genuine “depends,” and one splits across two layers.
Card 1: The always-on rule that is really a one-task rule
The need. A 25-line quiz-formatting block — the <details markdown="1"> rule, the two-trailing-spaces rule, the quiz front-matter rules — currently lives in this repo’s root CLAUDE.md, and is therefore loaded into every session, including the hundreds of lecture-writing and slide-building sessions that never touch a quiz. We want the block reliably present whenever someone authors a quiz, without charging its tokens to every other conversation. (This repo has no .claude/skills/ directory yet — this would be a genuine first extraction.)
Student task. Place the need on both cuts, name the deciding axis, work the cost ledger, identify the tempting wrong placement and its cost, then draft the artifact.
Instructor key — click to reveal
Placement (second cut): a Skill — .claude/skills/quiz-format/SKILL.md. Acceptable secondary: a _quizzes/CLAUDE.md subdirectory file (makes the cost on-demand), but the skill is the better fit because the trigger is the task (“author a quiz”), not “a tool happened to read a quiz file,” and a skill lands beside the query rather than at a mid-sequence splice point.
Kind of need (first cut): influence. A skill is still influence-layer material (§11.1); the only question is where and when that influence is injected.
Deciding axis: frequency (always-on vs. on-demand), reinforced by in-window position. The rule is needed only when authoring a quiz — the one-task-type signature the lecture names: “anything in your CLAUDE.md that is only relevant to one kind of task is a skill waiting to be extracted” (§7.2).
Cost ledger:
- Root CLAUDE.md = always-on standing charge: 25 lines in every session, the 90%+ that never author a quiz included.
_quizzes/CLAUDE.md= on-demand: paid only by sessions whose tools read under_quizzes/.- Skill = free until triggered, then on-demand at the query position.
Tempting wrong placement + cost: leaving it in root CLAUDE.md (where it is today). Cost = it occupies window in every session, including the 90%+ that never author a quiz (paid in tokens, cost, and latency), plus a lost-in-the-middle tendency: loaded at the top, the block can be attended to less as a long quiz-authoring session grows, so it may be weakest when you finally need it — a tendency that depends on the model and formatting, not a guaranteed proportional fade.
Final placement (one sentence): this belongs in a quiz-format skill because it is a one-task-type need that should cost zero until triggered and land beside the query, and keeping it in root CLAUDE.md would tax every non-quiz session and risk pushing the rule into the lost-in-the-middle zone (a model- and format-dependent tendency) just when a quiz session needs it.
Bridge: a skill is the L6 few-shot example promoted from a retyped habit to a versioned artifact (§7.1).
Draft the artifact — a minimal SKILL.md skeleton:
.claude/skills/quiz-format/SKILL.md
---
name: quiz-format
description: Use when authoring or editing an interactive quiz under _quizzes/ — the Jekyll/Marp formatting rules a quiz file must follow.
---
When writing a quiz file, follow these formatting rules:
- Every <details> block must be written `<details markdown="1">`, or markdown
inside it (bold, lists) renders as raw HTML.
- Each answer option line (A) … D)) must end with TWO trailing spaces, or the
options collapse into one paragraph.
- Front matter must declare: layout: quiz, title, date, tags, lang, permalink,
and a quiz: map (id, version, passingScore, allowRetry, showFeedbackImmediately).
[one short worked example of a correctly formatted question + answer block]
Card 2: “Always run add-anchors before committing a lecture”
The need. Lecture anchors must be regenerated by scripts/add_anchors.py whenever headings change, and the CI job check-anchors.yml already fails the PR if the committed anchors are stale. A teammate, tired of CI failures, proposes adding a strongly-worded paragraph to root CLAUDE.md: “ALWAYS run uv run add-anchors after editing a lecture. NEVER commit stale anchors.”
Student task. Place the need on both cuts, name the deciding axis, work the cost ledger, identify the tempting wrong placement and its cost, then draft the artifact.
Instructor key — click to reveal
Placement (second cut): a hook / CI check — and the good news is it already exists (check-anchors.yml); a local pre-commit hook can move the gate even earlier.
Kind of need (first cut): enforcement. “Anchors must never be stale at commit time” is a binary, deterministic property — the defining shape of the enforcement layer.
Deciding axis: influence vs. enforcement — likely vs. guaranteed. You do not want this biased, you want it guaranteed, and only the enforcement layer truncates the distribution (§11.2).
Cost ledger:
- The sterner CLAUDE.md paragraph = always-on standing charge: more tokens in every session, paid forever, to do the job unreliably.
- The pre-commit hook /
check-anchors.ymlgate = free in context-budget terms: it runs outside the token window and costs the model zero tokens (and the CI gate is already paid for).
Tempting wrong placement + cost: a strongly-worded paragraph in root CLAUDE.md. Cost = probable-not-guaranteed. It is influence masquerading as enforcement — it works in short sessions and fails when accumulated tokens outvote the rule (intermittent compliance, softmax arithmetic over a sequence — §6.2), while spending always-on tokens to do a job a free deterministic check already does for certain. The deeper cost is a false sense of safety.
Final placement (one sentence): this belongs in a hook / the existing check-anchors.yml gate because it must be guaranteed, not merely likely, and putting it in a sterner CLAUDE.md paragraph would buy only probabilistic compliance — failing exactly in the long sessions where it matters — while charging always-on tokens for the privilege.
Bridge: this completes L6’s “prompting cannot fix this — it needs enforcement,” with the hook given a street address at the commit interface (§9.3).
Draft the artifact — a hook trigger + command + pass/fail:
Trigger: pre-commit (and the existing check-anchors.yml on every PR)
Command: uv run add-anchors --check # regenerate, diff against committed files
Pass: no diff — committed anchors already match the regenerated output → commit proceeds
Fail: diff present — anchors are stale → abort the commit, print the offending files,
tell the author to run `uv run add-anchors` and re-stage
The CLAUDE.md paragraph may stay as a one-line nudge (“anchors are enforced by check-anchors.yml; run uv run add-anchors first”) — but the load-bearing guarantee is the gate, not the prose.
Card 3: “Let the agent read and file tickets in our tracker”
The need. Instructors want Claude Code to look up open issues and open new ones from inside a session, instead of copy-pasting between the chat and the tracker.
- Realization A: connect a Jira/GitHub MCP server so the capability is available in every session.
- Realization B: when a session needs ticket text, paste the issue that one time and leave the tracker unwired.
The need arises about twice a week. Which wins?
Student task. Resolve the A/B — but only with a named condition. Place the need on both cuts, name the deciding axes, work the cost ledger, identify the tempting wrong placements and their costs, then draft the artifact.
Instructor key — click to reveal
Placement (second cut): Depends — and the deciding condition is how often the need actually arises (frequency). At twice a week, B (paste-when-needed) wins. A bare “it depends” is wrong: it names no condition and settles nothing. The discipline of the card is naming the hinge.
Kind of need (first cut): capability. Reading and filing tickets means the system must touch the world — reach a service outside the token sequence — which only a tool can do (§9.3: what an AI system can do is determined by its tool surface, not its intelligence).
Deciding axes (two):
- Always-on vs. on-demand — an MCP server’s tool descriptions occupy tokens in every conversation whether or not a tool is called (§9.2), the same standing charge as instruction files.
- Blast radius — every connected server widens what a hallucinated or injected sequence can do; wiring a tool is a security decision every time (§9.3).
For a genuinely frequent need both costs amortise; at twice a week neither is justified.
Cost ledger:
- MCP server (A) = always-on standing charge (tool descriptions every session, called or not) plus a standing widening of the attack surface every day.
- Paste-when-needed (B) = on-demand: the issue text costs tokens only in sessions that need it, and wires no new capability.
- API docs in CLAUDE.md (the trap) = always-on standing charge that buys nothing.
Tempting wrong placements + costs:
- Always-wiring the MCP server (A) for a twice-a-week need: a widened blast radius and an always-on token charge seven days a week for a two-day-a-week payoff.
- Worse — pasting the tracker’s API docs into CLAUDE.md and telling the model to use the API: instructions bias a distribution, they do not grant a capability, so the model still cannot reach the tracker and hallucinates plausible-but-wrong calls, while the docs become an always-on charge. This is L6’s “using prompting for the wrong tool” generalised to orchestration.
Final placement (one sentence): this is a capability that belongs in a wired MCP tool when the need is frequent enough to amortise its always-on token charge and widened blast radius — and at twice a week it is not, so paste-when-needed wins; always-wiring would tax budget and attack surface seven days a week, and pasting API docs into CLAUDE.md would grant no capability at all.
Draft the artifact — an MCP tool spec sketch (for the frequent-need case where wiring does win):
Server: github-issues (an MCP server wrapping the tracker)
Tools exposed (each: name, description, input/output schema):
list_open_issues
description: List open issues, optionally filtered by label or assignee.
input: { repo: string, label?: string, assignee?: string }
output: [ { number: int, title: string, url: string, state: string } ]
permission: read-only
create_issue
description: Open a new issue. Requires title; body optional.
input: { repo: string, title: string, body?: string, labels?: [string] }
output: { number: int, url: string }
permission: write — scoped to the course's repo only; human-confirm before create
Budget note: every tool's description above is paid in EVERY session once the
server is wired — justify the standing charge with real frequency before wiring.
Card 4: “Remember that I prefer British spelling and terse commit messages”
The need. This preference is genuinely personal (yours, not the team’s), genuinely recurring (most sessions), low-stakes, and verified by nothing — no test checks it, no convention enforces it.
- A: write it to the model-authored MEMORY.md.
- B: commit a “Preferences” block to the version-controlled root CLAUDE.md.
Student task. Place the need on both cuts, name the deciding axis, work the cost ledger, identify the tempting wrong placement and its cost, then draft the artifact. This is the rare card whose best home really is memory — and the card whose inverse lesson matters most.
Instructor key — click to reveal
Placement (second cut): MEMORY.md (model-authored, per-user, per-machine). This is the rare card where memory is the right home.
Kind of need (first cut): influence. A memory file is “influence the model wrote for itself in an earlier conversation” (§11.1).
Deciding axis: ephemeral-vs-persistent + provenance (who authors it). The preference is persistent across sessions (not ephemeral prompt text), personal (should follow the user, not the repo), and unverified-but-low-stakes — the exact profile MEMORY.md is for: soft context, fine to be unverified (§5.3).
Cost ledger:
- MEMORY.md = small always-on charge (~50–500 tokens for the whole memory file), borne by you alone, per-machine.
- Preferences block in root CLAUDE.md = always-on standing charge multiplied across the whole team — every teammate pays your preference’s tokens in every session.
- Type-in-the-prompt = on-demand but re-paid every session; wrong for a recurring need.
Tempting wrong placement + cost: committing a Preferences block to the team’s root CLAUDE.md. CLAUDE.md and MEMORY.md are the same transport with opposite provenance (§5.2); CLAUDE.md is shared with everyone who clones the repo, so this ships one developer’s taste as always-on tokens into every teammate’s session.
The inverse lesson (emphasise this): memory is right here precisely because the fact is soft and personal. Memorising a load-bearing technical fact — “the auth service runs on port 8081” — is the opposite trap: born possibly-wrong, never verified against the repo, re-injected into the privileged early positions of every future session until deleted (§5.3), producing the AI-era “works on my machine” divergence. Soft preference is the only kind of content that belongs in memory.
Final placement (one sentence): this belongs in MEMORY.md because it is a soft, persistent, per-user preference that is safe to be unverified, and committing it to the team’s root CLAUDE.md would broadcast one person’s taste as always-on tokens in every teammate’s session.
Draft the artifact — a memory note:
~/.claude/projects/<project-id>/memory/preferences.md
# User preferences (soft — verify nothing against this)
- Prose: British spelling (colour, behaviour, optimise).
- Commit messages: terse — imperative subject line, no body unless non-obvious.
(These are personal and low-stakes. Do NOT store load-bearing technical facts here —
ports, endpoints, schema details — those go stale and are never verified; check the
repo for those instead.)
Card 5: A tests-only convention in a monorepo
The need. A convention applies only inside tests/: fixtures go in conftest.py, and tests must be parametrized rather than looped. This is a large repo; most sessions never touch tests. A colleague put the rule in root CLAUDE.md “to be safe.”
Student task. Place the need on both cuts, name the deciding axis, work the cost ledger, identify the tempting wrong placement and its cost, then draft the artifact.
Instructor key — click to reveal
Placement (second cut): a subdirectory CLAUDE.md at tests/CLAUDE.md, loaded on-demand when a tool reads under tests/. (A skill could also carry a test-writing pattern — a defensible runner-up — but the natural fit for “a convention scoped to a directory subtree” is the subdirectory file, whose trigger matches the scope precisely.)
Kind of need (first cut): influence. A style convention biases the model toward the house style — influence-layer material wherever it sits. This is a pure placement question within the influence layer (the twin of Card 1, with a different mechanism).
Deciding axis: always-on vs. on-demand timing, used as a budget instrument. Rule two of CLAUDE.md loading injects a directory’s CLAUDE.md only when a tool reads under it (§4.2) — “paid only by conversations that actually touch the tests,” the lecture’s own example of the directory tree as a budget instrument.
Cost ledger:
- Root CLAUDE.md = always-on standing charge: paid in every session, including the majority that never touch tests.
tests/CLAUDE.md= on-demand: injected only when a tool reads undertests/— zero cost to non-test sessions, and the test sessions get exactly what root would have given them.
Tempting wrong placement + cost: keeping it in root “to be safe.” Cost = a tests-only rule paid as a standing charge in every non-test session — window, cost, and latency spent for nothing in sessions that never touch tests — and one more competitor that can push the genuinely always-on rules toward the lost-in-the-middle zone (a model- and format-dependent tendency), while buying the test sessions nothing they would not have received on demand. “To be safe” is the exact instinct §10.1 warns against: every always-on token is a token of window the work does not get.
Final placement (one sentence): this belongs in a subdirectory tests/CLAUDE.md because the convention is scoped to one subtree and should be paid on demand by the sessions that read it, and keeping it in root CLAUDE.md “to be safe” would charge every non-test session for it and add a competitor that can push the always-on rules toward the lost-in-the-middle zone.
Bridge: the context-budget point applied to placement — relevant context sharpens the model’s continuation, while irrelevant always-on context spends window for no benefit and can add distractors that pull the model off-task (an effect that depends on the model and the content, not a fixed share of the window) (§10.1).
Draft the artifact — a tests/CLAUDE.md snippet:
tests/CLAUDE.md
# Conventions for this test suite
- Put all fixtures in `conftest.py`; do not define fixtures inline in test modules.
- Tests must be parametrized with `@pytest.mark.parametrize`, not written as loops
over cases inside a single test function.
- One behaviour per test; name tests `test_<unit>_<condition>_<expected>`.
This file is invisible to every session that never reads under tests/ — which is exactly the point.
Card 6: A hard “no-secrets-in-logs / no-prod-deploy” rule that keeps slipping
The need. The assistant must never write code that logs secrets and must never run a production deploy. The team keeps adding sterner CLAUDE.md wording — “NEVER log credentials, this is CRITICAL” — and it still occasionally slips, especially after the model reads a web page or issue that contains an injected instruction.
Student task. Place the need on both cuts — note this one splits across two kinds of need — name the deciding axis, work the cost ledger, identify the tempting wrong placement and its cost, then draft the artifact.
Instructor key — click to reveal
Placement (second cut): enforcement + permission scoping at the tool interface — a secret-scanning hook/CI, schema validation on the deploy tool, scoped non-prod credentials, and a human approval gate in front of the irreversible.
Kind of need (first cut — SPLIT): influence AND enforcement, both creditable. A CLAUDE.md line (“don’t log credentials”) still makes the good behaviour likelier — real, useful influence worth keeping — but the guarantee the task demands can only come from enforcement. The split is the lesson: do not let the influence half stand in for the enforcement half. (Treat a student answer of “enforcement only” as essentially correct and “influence only” as the failure; the sterner CLAUDE.md decoy must not be selected.)
Deciding axis: likely-vs-guaranteed, with blast radius behind it. For adversarial inputs, assume the influence layer is defeated — safety properties must live in enforcement, not in prompts (§9.3).
Cost ledger:
- Sterner CLAUDE.md rule = always-on standing charge that grows with each ALL-CAPS escalation, and buys no guarantee.
- Secret-scanning hook / CI + schema validation = free in context-budget terms (run outside the window).
- Scoped non-prod credentials + a human approval gate = free in budget terms (configuration and permissions, not tokens).
Tempting wrong placement + cost: a sterner, ALL-CAPS CLAUDE.md rule. Cost = it confuses influence with enforcement. A model that emits a destructive call because an attacker buried an instruction in a page it read is not malfunctioning — it is completing the most contextually plausible continuation. A stern instruction makes the bad action less probable but never impossible, and widens nothing about the blast radius; the false sense of safety is itself the cost. The defense is a narrower tool surface, never a sterner file.
Final placement (one sentence): this belongs in enforcement plus permission scoping at the tool interface (secret-scanning gate, schema validation, scoped non-prod credentials, human approval on the irreversible) because a safety property must be guaranteed, not merely made likely — and relying on a sterner CLAUDE.md rule would confuse influence with enforcement, leaving the system defeatable by a single injected instruction while feeling safe.
Bridge: the capstone of L6’s three-layer model — you cannot replace enforcement with more influence; only the enforcement layer truncates the distribution (§11.2).
Draft the artifact — a hook + permission sketch:
1. Secret-scanning hook (pre-commit + CI)
Command: run a secret/credential scanner over the diff (e.g. a gitleaks-style rule)
Pass: no credential-shaped strings, no logging of secret-typed values → proceed
Fail: block the commit/PR, report file+line — deterministic, not advisory
2. Deploy tool: scoped + schema-validated + gated
- The deploy tool the model can call is wired ONLY to non-prod by default
(scoped credentials: prod credentials are not present in the model's tool surface).
- Input schema validated before execution: { environment: enum[dev, staging] } —
"prod" is not a legal value the model can pass.
- Any prod deploy requires a human approval gate at the interface (the orchestration
layer holds the call and asks a human), never an automatic tool call.
3. Optional, kept SHORT: one CLAUDE.md line nudging "never log credentials" —
influence that helps a little, but is NOT the guarantee.
Group activity formats
Option A: Placement only
Each group receives two cards.
For each card:
- Name how often the need arises.
- First cut: which kind of need (influence / enforcement / capability / human)?
- Second cut: which L7 mechanism?
- Name the deciding axis.
- Name the tempting wrong placement and its concrete cost.
Each group presents one card in 2 minutes — and must say the cost of the wrong placement, not just the right answer.
Option B: Placement plus draft
Each group receives one card and must also draft the artifact — the SKILL.md skeleton, hook spec, MCP tool spec, memory note, subdirectory snippet, or hook+permission sketch the placement implies. The draft forces the placement from a label into something runnable.
Option C: Placement review
Treat an existing root CLAUDE.md as a code artifact under review. Students “review” it line by line and tag each block with a placement verdict:
- Genuinely always-on — keep in root
- One-task-type — extract to a skill
- Subtree-only — move to a subdirectory CLAUDE.md
- Personal soft preference — move to memory
- Needs a guarantee — replace with a hook/CI
- Needs to touch the world — this is a tool, not a rule
- Rarely needed — out-of-scope
- Sterner wording proposed where placement is the real fix — reject
Debrief questions
- Which needs looked like CLAUDE.md material at first but belonged somewhere cheaper?
- Where did “to be safe” (Card 5) or “be thorough” turn out to be a budget mistake?
- Card 3: what exactly was the condition that decided A vs. B — and why is a bare “it depends” not an answer?
- Card 4 is the only card whose home is memory. What made it the exception, and what would have made it the trap instead?
- Where did someone want to prompt a capability into existence (Card 3, option C)? Why can’t influence grant a capability?
- Card 6 split across two layers. Why is “enforcement only” closer to right than “influence only,” and why must the
sterner CLAUDE.mdbox stay unchecked? - For each card, state the cost of the wrong placement in one phrase (wasted window cost / lost-in-the-middle / never-loaded / probable-not-guaranteed / stale memory / widened blast radius).
- Which placements were free in budget terms — and why is “free” almost always the enforcement layer?
Assessment rubric
Use this rubric if the exercise is graded. Weight the cost-ledger and mis-placement-cost dimensions heavily — naming the right home is the easy half; reasoning about the cost of the wrong home is where the learning is.
| Criterion | Weight | Excellent | Satisfactory | Needs improvement |
|---|---|---|---|---|
| Placement (second cut) | 15% | Correct mechanism, with the secondary option acknowledged where relevant | Correct mechanism | Wrong mechanism, or a label with no mechanism |
| Kind of need (first cut) | 15% | Correct kind, split recognised on Card 6, decoy never selected | Correct kind on most cards | Confuses influence with enforcement or capability |
| Deciding axis | 15% | Names the single axis that settles it, precisely | Names a relevant axis | Vague ("it's better") or no axis |
| Cost ledger | 25% | Classifies every candidate as always-on / on-demand / free, reasoned against one finite shared window (occupancy and cost) | Classifies the main two candidates | No budget reasoning; treats tokens as free |
| Mis-placement cost | 25% | Names the specific failure mode (wasted window cost / lost-in-the-middle / never-loaded / probable-not-guaranteed / stale memory / widened blast radius) and the mechanism behind it | Names a plausible cost | "It's worse" with no mechanism |
| Artifact draft (extended version only) | 5% | A concrete, plausible skeleton matching the placement | A rough sketch | Missing or mismatched to the placement |
Suggested grading scale
For a short in-class activity (per card):
- 2 points: correct placement (both cuts)
- 2 points: deciding axis named
- 3 points: cost ledger (always-on / on-demand / free)
- 3 points: mis-placement cost named with its mechanism
Total: 10 points per card.
For a larger homework assignment:
- 15% placement accuracy (both cuts)
- 15% deciding axis
- 25% cost-ledger reasoning
- 25% mis-placement-cost analysis
- 20% artifact drafts
The 50% weight on cost-ledger + mis-placement is deliberate: a student who routes every card correctly but cannot say why the wrong route is expensive has memorised a lookup table, not learned context engineering.
Instructor notes
Common student mistakes
- Pattern-matching keywords without cost reasoning. “Security → enforcement, done” — without saying what the sterner-rule alternative actually costs. The cost is the lesson; the label is not.
- Forcing every need into a mechanism. Not everything deserves a permanent home — keep the out-of-scope option live (and remember Card 4’s home is memory, not a mechanism at all in the CLAUDE.md/skill sense).
- Treating split-layer answers as wrong. Card 6 is genuinely influence and enforcement; mark “enforcement only” as essentially correct and do not penalise a student who keeps a short influence line alongside the enforcement. The only failure is selecting the
sterner CLAUDE.mddecoy or relying on influence instead of enforcement. - Bare “it depends.” On Card 3, “it depends” with no named condition earns nothing. The whole skill is naming the hinge (frequency) — a conditional answer is excellent only when the condition is explicit.
- Pattern-matching the topic. Card 4 (“British spelling”) routes to memory; the warm-up’s near-identical “British spelling” routes to root CLAUDE.md. Students who route by topic instead of by axis will get exactly one of them wrong.
- Treating tokens as free. “Just put it in CLAUDE.md to be safe” (Card 5) is the most common and most expensive instinct — every always-on token is a token denied to the work.
Instructor emphasis
Repeat this sentence several times:
The right question is not “Where can this rule live?” but “How often is it needed, what does it guarantee, does it touch the world — and what does the wrong home cost in the one budget every tenant shares?”
And the standing reminder, since the paths will date:
The mechanism names are mid-2026 Claude Code specifics and will change. The axes — always-on vs. on-demand, influence vs. enforcement vs. capability, one finite shared window (occupancy and cost) — will not.
Final takeaway slide
Use this as the final slide of the exercise.
Orchestration placement diagnosis
A good AI-supported developer does not merely write CLAUDE.md.
A good AI-supported developer can:
- Name how often a need arises, and what it must guarantee.
- Decide its kind — influence, enforcement, capability, or human ownership.
- Route it to the right mechanism — root file, subdirectory file, skill, memory, tool, or hook.
- Reason about every candidate against one shared, finite window — its occupancy and cost.
- Predict the concrete cost of the tempting wrong home.
- Refuse to fix a placement problem by wording a file more sternly.
Placement is context engineering. The window is finite, so a token an always-on block occupies is a token of window (and a slice of cost) the task does not get.