Governance, safety and risk — study roadmap

This unit is CCARP-U5 · Governance, Safety & Risk Management, 14% of the blueprint. It carries five official objectives across two topics, and it is the domain where a confident, well-formed, entirely wrong answer does the most damage.

Topic	Objectives	What you must be able to do
T1 · Guardrails, risks, human-in-the-loop	LO1, LO2, LO3	Place each control in the right row, name the failure before fixing it, and gate on consequence and reversibility
T2 · Compliance and ethics	LO4, LO5	Verify eligibility per access path, split responsibility explicitly, and make an ethical requirement measurable

The five confusions this domain tests

Well-formed is not authorised. Strict mode guarantees the tool inputs match your schema. It decides nothing about whether this caller may take this action.
A policy in the prompt is a policy retrieved text can argue with. The decision that stops an action has to be taken outside the model, on the resolved call.
A missing fact, an unsupported claim and an unstable answer look identical from outside. Three faults, three different probes, three different remedies.
Supports compliance is not confers compliance. The addendum defines roles; the customer keeps its own. Access through a third-party platform is governed by that platform's terms.
An aggregate is where a group goes missing. A fairness number that passes overall can hide a slice that fails.

Sequence

T1 first, in objective order. LO1 gives you the three-row vocabulary; LO2 gives you the failure taxonomy that decides which control to reach for; LO3 gives you the gate that turns both into a decision somebody owns.
T2 second. Its compliance half is a reading exercise in careful verbs, and its ethics half reuses the measurable-criteria material from Unit 4 with fairness in place of accuracy.

Budget slightly more time on T1: it carries three objectives and six house skills against T2's two and four.

What to carry into the exam

For each objective, be able to state the decision, the evidence that would settle it, and the claim that evidence does not support. This domain is built almost entirely from true statements used to support conclusions they do not carry — a passing schema check read as a permission, a certification read as a compliant deployment, an evaluation read as a verified property.

Sources and their limits

Every factual claim is grounded in retained documentation, quoted verbatim with a recorded retrieval date and content hash. Three cautions:

This unit teaches architecture, not law. The documented material describes what the platform provides and what its terms allocate. Whether a given deployment satisfies a given regulation is a question for the organisation and its advisers, and nothing here answers it.
The objective names FedRAMP; this package does not teach it. No retained snapshot contains FedRAMP material, so nothing here is authored about it rather than invented. Study it from the certification body's own references.
Scope statements are per product and per access path. Eligibility described for one product does not extend to another, and reaching the same models through a third-party platform changes which terms govern.
Certifications and regional availability change. They were current at the retrieval date recorded with each snapshot. Check the current position before relying on one.

Every threshold, score and policy rule used in an exercise is a house fixture, labelled where it appears.