« Interview Prep · Track Overview
The Battle Plan — This JD, Line by Line
Every accountability in the job description, with the answer you give and the place the material comes from. Read it once end to end; then use it as a lookup the night before.
Table of Contents
- How to use this
- 1. Platform architecture
- 2. Integrations and the model layer
- 3. Identity, security and governance
- 4. Infrastructure and run-state
- 5. Leadership and collaboration
- 6. The five conversations, and what each is really testing
- 7. The opening two minutes
- 8. When you do not know
- 9. The closing question
How to use this
Each row gives the JD line, the one sentence that answers it, and where the depth lives. The sentence is what you say first; the depth is what you say when they follow up — and they will follow up on two or three, not on all of them.
Do not recite. The purpose of having an answer for every line is that you are never surprised, and being unsurprised is most of what reads as seniority.
1. Platform architecture
| JD line | Your sentence | Depth |
|---|---|---|
| "Own the end-to-end technical architecture of the five-layer stack" | "Five layers plus three cross-cutting ones — control plane, identity, guardrails — and I can name what each one denies." | Phase 00 · Design 01 |
| "Architect the agentic runtime for MCP, A2A, ACP" | "One internal task model, protocol adapters at the edge. The protocol is a serialization decision; the task model is the architecture." | Phase 03 |
| "interoperable with hyperscaler agent fabrics" | "Foundry, Bedrock and ADK are kernels. I integrate them behind the same admission, identity and gateway boundary as our own." | Phase 03 |
| "Design the agent kernel: lifecycle, planning loops, memory, session affinity" | "Bounded loop with a step budget, externalized state, consistent-hash affinity as an optimization and never as a correctness requirement." | Phase 01 |
| "memory architecture (short-term, long-term, episodic)" | "Three stores with three different lifetimes and three different privacy postures — and episodic memory is the one that quietly becomes a data-retention problem." | Phase 01 |
| "scratchpad persistence, execution chains" | "Checkpoint per step so a run is resumable. Resumable is not exactly-once — effects are the action gateway's problem." | Phase 01 → 10 |
| "Architect the knowledge foundation: vector topology, hybrid retrieval, grounding" | "Index per tenant, partition per classification, barriers in a separate store. Isolation is a property of what you search, not of what you return." | Phase 06 · Design 04 |
| "knowledge graph integration (FIBO, OWL, SHACL, SPARQL)" | "The vector store answers 'what text is relevant'; the graph answers 'what is connected'. Ownership-path-to-a-sanctioned-entity is not a similarity query." | Phase 07 |
| "Design the control plane: policy-gated execution, KYA, registries, capability discovery" | "Default deny, deny overrides, and capability discovery that is authorization-aware — an agent should not see a tool it cannot call." | Phase 09 |
| "tracing and lineage at agent and tool granularity" | "Spans at agent and tool level with self-time computed as a union of child intervals, and lineage that answers descendants — 'what did this affect' is the 2 a.m. query." | Phase 14 · 15 |
If they push on one thing here, it will be the SLO. Have the composition ready: 98.96% naive, 99.65% after three named changes, and the changes in cost order.
2. Integrations and the model layer
| JD line | Your sentence | Depth |
|---|---|---|
| "Architect the LLM gateway and model abstraction layer" | "One narrow waist: auth, quota, cache, route, call, account. Every policy enforced once instead of in twelve agent codebases." | Phase 04 · Design 02 |
| "intelligent routing, fallback, retries" | "Four gates inside the router — classification, residency, budget, ladder — so the fallback passes them too. That is the bug nobody's component tests catch." | Design 02 |
| "prompt and response caching, semantic caching" | "Three tiers, three risks. Tenant-first keys, a high similarity floor, and never cache an entitlement-dependent answer — cache the retrieval instead." | Phase 05 |
| "rate limiting, token accounting, cost attribution, tenant isolation" | "Token bucket on both TPM and RPM, per tenant, with a guaranteed floor. One request can be 100k tokens; an RPM-only limit protects nothing." | Phase 04 |
| "model serving patterns: managed APIs, PTUs, self-hosted" | "Dedicated floor sized to p50, spill to PAYG, self-hosted for sovereignty rather than cost. The break-even is a utilization number and it moves with your token mix more than with price." | Phase 05 |
| "vLLM/TGI/Triton, KV-cache management, batching" | "Prefill is compute-bound, decode is memory-bandwidth-bound — which is why continuous batching helps decode enormously and prefill much less. Concurrency is a KV-memory question." | Phase 05 |
| "Lead integration architecture with core banking, payments, treasury" | "ISO 20022 as the contract, integer minor units, a transactional outbox for exactly-once effects, and finality as a scheme rule rather than a hopeful timeout." | Phase 12 |
| "Kafka, Event Hubs, the data product layer" | "Ordering is per-partition, so the partition key is the ordering guarantee. And schema compatibility determines deploy order — backward means consumers first." | Phase 12 |
| "Design the action gateway as the enforcement boundary" | "The model proposes, the platform disposes. Contract, side-effect class, idempotency key, dual control, breaker, audit — in that order." | Phase 10 |
| "idempotency guarantees, transactional safety" | "Exactly-once delivery is impossible; exactly-once effects is a key and a store. Three cases plus in-flight, and the in-flight case is the one people miss." | Phase 10 |
| "Engineer the tool layer and MCP server estate" | "Tools are versioned products with JSON-Schema contracts and a declared side-effect class. A tool with no declared side effect cannot be registered." | Phase 02 |
The likely follow-up: "what do you retry, and what do you fall over on?" Three flags, and a content filter is neither — otherwise you are shopping for a compliant model.
3. Identity, security and governance
| JD line | Your sentence | Depth |
|---|---|---|
| "agent identity and workload identity model, NHI" | "Agents are non-human identities with a lifecycle — registered, evaluated, suspended, retired — and no standing credentials. SPIFFE SVIDs, rotated, never on disk." | Phase 08 |
| "blended user-plus-agent identity for delegated actions" | "RFC 8693 token exchange. sub stays the human; act nests the agents. Delegation, never impersonation — impersonation destroys attribution." | Phase 08 · Design 03 |
| "the identity propagation chain across multi-agent flows" | "Derived from a verified credential, never asserted in the request. It appends, never replaces. Depth-bounded and cycle-checked at the authorization server." | Design 03 |
| "OAuth 2.1 and OIDC flows, JIT credential issuance, short-lived token exchange" | "Sixty-second credentials at the estate, audience-bound, scoped to a single resource instance — payments.release:PMT-771, not payments.release." | Phase 08 |
| "mTLS for agent-to-agent" | "And sender-constrained tokens (RFC 8705), so a token in a log file is not a credential." | Phase 08 |
| "zero trust: least privilege per agent and per task, continuous authorization" | "Continuous, not static: a lease with a TTL, re-evaluated, plus a kill switch that does not depend on the policy bundle." | Phase 09 |
| "KYA enforcement, prompt and output guardrails, PII/PHI/MNPI" | "The guardrail chain runs twice — over retrieved content before the prompt, and over the proposed action before the gateway. Different attacks, different targets." | Phase 11 |
| "prompt-injection defense" | "Not solved, and the design does not depend on the scanner. Side-effecting + derived from retrieval + unapproved = refuse. The attacker's ceiling is a human decision." | Phase 11 |
| "sensitive-action approval flows, human-in-the-loop escalation" | "Dual control above a threshold, approvers excluding the requester and every agent in the chain — otherwise self-approval through a delegated agent works." | Phase 10 |
| "CBUAE, model risk, Group governance: auditability, lineage, residency" | "The output of a run is an evidence pack, not an answer. Generated along the path, hash-chained, and complete or it names the missing artifact." | Phase 15 · Design 05 |
| "third-party model governance" | "Concentration risk stated honestly: 5% of traffic on the secondary continuously, a 6–8 week exit including eval re-baselining, and residual risk accepted by a named committee." | Phase 15 |
| "OWASP LLM Top 10 alignment" | "The coverage matrix is generated from the code, so a new risk row becomes a missing control rather than a gap in a spreadsheet." | Phase 11 |
This is the section most candidates hand-wave, which makes it the highest-leverage one to be precise in. If you get one deep-dive here, make it the delegation chain — it is concrete, it is standards-based, and most people cannot name RFC 8693.
4. Infrastructure and run-state
| JD line | Your sentence | Depth |
|---|---|---|
| "Terraform, networking, private endpoints, egress control" | "The resource graph is a DAG; plan is a diff over it; a ForceNew attribute change is a replace, and knowing which attributes those are is the difference between a change and an outage." | Phase 13 |
| "AKS and container orchestration" | "Gang scheduling for anything with GPUs, and admission control as policy-as-code that fails closed — a policy engine that errors must not admit." | Phase 13 |
| "policy-as-code (OPA, Azure Policy)" | "Cedar where I need analyzability — being able to mechanically ask 'can any principal do X' is a question a regulator asks and Rego cannot answer in general." | Phase 09 |
| "SLO design, error-budget management" | "The SLI is a validity predicate, not HTTP 200. A 200 carrying 'I can't help with that' is not availability." | Phase 14 |
| "observability (OpenTelemetry) at agent and tool granularity" | "Cardinality is a product, not a sum — agent × tool × tenant × model × outcome. Budget it before you ship it." | Phase 14 |
| "incident response, post-mortems" | "Mitigation is not resolution, and action-item completion rate is the only honest measure of whether a post-mortem culture is real." | Phase 16 |
| "capacity planning" | "Forecast against lead time, not against today — a capacity signal that alerts inside the procurement lead time is a signal that arrives too late to act on." | Phase 14 |
| "cost governance for a growing fleet" | "Cost per successful action. A 30% failure rate multiplies effective cost by 1.43 — which is how an eval budget gets funded." | Phase 14 |
The follow-up to prepare: "how do you alert on a non-deterministic system?" Multi-window multi-burn-rate, with a minimum event count so a quiet hour cannot page, and the 14.4 derived rather than quoted: 2% of the budget in 1/720 of the window.
5. Leadership and collaboration
| JD line | Your sentence | Depth |
|---|---|---|
| "genuine two-in-a-box with the Platform Product Owner" | "Undivided accountability, not a partition. Both own availability, cost, security posture and the roadmap — including the pager." | Phase 16 |
| "shared on-call" | "The product owner carries it. It sounds performative and it is the single most effective mechanism in the model — a PO who has been woken by a retry storm makes different roadmap decisions, unlobbied." | Phase 16 |
| "shared accountability for major architectural decisions" | "Reversibility decides who signs. Reversible: one owner, recorded. Irreversible or externally visible: both. Unresolved: escalate with both written positions, never the average." | Phase 16 |
| "regulator conversations" | "Both of us, same story, and the artifact does the work — an evidence pack rather than a deck." | Phase 15 |
| "critical incidents" | "Roles before heroics: incident commander, comms, ops. And the comms cadence is a commitment, not a courtesy." | Phase 16 |
| "testing discipline: unit, integration, evaluation, red-teaming" | "Four kinds, and only some of them gate a release. Evaluation and red-team are gates for agents; that is the row a generic ORR does not have." | Phase 16 |
| "operational readiness reviews" | "A gate, not a grade. Any mandatory criterion failing fails the review at any advisory score, and every criterion names the artifact that proves it." | Phase 16 |
| "technical mentorship of platform engineers" | "A standard in code is a control; a standard in a wiki is a suggestion. I mentor by moving rules into publish()." | Phase 16 |
| "represent the platform in senior technical forums" | "Five audiences, five different answers. EA wants fit; Cyber wants the threat model; Model Risk wants validation; Audit wants evidence; the CTTO wants the roadmap and the risk in one page." | Phase 16 |
| "engage with hyperscaler and vendor technical teams" | "Buy the mechanism, build the policy. No vendor knows that a release above 100k needs two approvers neither of whom is in the delegation chain." | Phase 16 |
6. The five conversations, and what each is really testing
| # | Conversation | Surface question | Real question | Win it by |
|---|---|---|---|---|
| 1 | Platform architecture | "design the platform" | can you compose an SLO and name refusals? | saying the composed number before you are asked |
| 2 | Agentic depth | "how does your runtime work?" | mechanism or framework? | describing the loop, the step budget and the checkpoint — never a framework name first |
| 3 | Model & serving economics | "managed or self-hosted?" | can you decide with numbers? | the break-even as a utilization, and the mix caveat |
| 4 | Identity & governance | "how does an agent authenticate?" | the hardest part of the JD | RFC 8693, act nesting, monotone narrowing, 60-second credentials |
| 5 | Run-state & operating model | "tell me about an incident" | have you carried a regulated pager? | a specific incident, with the number, and what changed in the mechanism afterwards |
Conversation 4 is where the role is won or lost. It is the accountability most candidates treat as somebody else's, and the one the JD spends the most words on.
7. The opening two minutes
You will be asked to introduce yourself. Do not narrate your CV; frame the role.
"I build the substrate that other teams' agents run on. The thing I care about most in a bank is the boundary between a model's suggestion and a bank action — the model proposes, the platform disposes — because that boundary is where identity, policy, contract and evidence all have to say yes. In my last platform I owned the five layers, shared the pager, and the number I'd point at is that we could take any action from any month and produce the identity chain, the policy version, the model version and the approvals in under a minute. Happy to go deep anywhere; the parts I find most interesting are the seams between layers, because that's where the failures actually live."
Four things that does: states the layer you operate at, gives them a memorable sentence, offers a concrete capability rather than an adjective, and invites the follow-up you want.
8. When you do not know
The most common failure at this level is a confident guess. The formula:
"I don't know. Here's how I'd find out, here's what I'd expect, and here's what would change my answer."
Three worth having ready:
"I don't know CBUAE's current position on cross-border inference for confidential data. I'd get it from the outsourcing guidance and Compliance rather than infer it, and I'd design assuming in-country until told otherwise — that assumption is cheap to relax and expensive to add."
"I don't know whether our scanner catches that injection class. I'd measure against AgentDojo and report the containment rate rather than the detection rate, because the architecture is built to survive detection failures."
"I don't know how long revocation actually takes on that platform. It's measurable — revoke a test agent and time it — and I'd expect the real number to be worse than the estimate, because it's the sum of bundle propagation, token TTL and in-flight requests."
Each names the source, the expectation, and the falsifier. That is what a senior technical forum rewards.
9. The closing question
They will ask what you want to know. Ask something diagnostic — each of these tells you whether the platform is real, and signals that you know which question to ask:
- "Does the platform publish an error budget, and has a freeze ever actually triggered?" — whether the operating model is real or aspirational.
- "Where does session state live, and what happens to in-flight runs during a deploy?" — platform maturity in one sentence.
- "When a tool's schema changes, how do you find out who breaks?" — whether the estate is governed.
- "What's your measured input-to-output token ratio, and how much capacity sits idle?" — whether cost is managed or assumed.
- "When an agent delegates to another team's agent and the outcome is wrong, who owns it?" — whether there is a topology or a diagram.
- "How does two-in-a-box resolve a genuine disagreement?" — whether the operating model has been tested.
If the answer to (1) is "we haven't needed to freeze", the error budget is decorative. If the answer to (5) is a pause, the platform is a diagram. Neither is a reason not to take the job — they are the job — but you should know before you say yes.