« Interview Prep · Track Overview
Short questions, short answers. The answers are written the way you would actually say them — one
to three sentences, no hedging, and the number when there is one.
Cover the answer column. Say your answer out loud — the gap between what you can recognize and
what you can articulate is exactly the gap the interview measures.
Mark every question where your spoken answer was worse than the written one. Those are your revision
list; there will be twenty or so and they are the whole value of the exercise.
# Question Answer
1 Name the five layers. Users & Channels, Agent Kernel, Control Plane, Knowledge Foundation, Action Gateway — plus three cross-cutting: model, identity, infrastructure. 2 Five layers at 99.9% each — platform availability? 0.999⁵ = 99.5% , which is 3 h 36 m a month. You cannot promise more than the product of your serial dependencies. 3 How do you get it back up? Make dependencies degradable rather than serial, add redundancy where the failure domains are genuinely independent, and take slow dependencies off the synchronous path. 4 What is the SLI for an agent platform? A validity predicate , not HTTP 200: an answer was produced, it cited a retrieved document, and no guardrail blocked it. 5 99.9% — how much downtime a month? 43.2 minutes. 6 Why is 14.4 the page burn rate? It is derived: 2% of the budget in 1/720 of the window → 0.02 ÷ (1/720) = 14.4. 7 What is the first thing you write in a design? The latency budget, per stage, with headroom — because the headroom is the fallback decision. 8 A fallback with no headroom is what? Decoration. If it does not fit the remaining budget it will never complete inside the request. 9 Why is the p95 of a chain worse than the max of the p95s? Tails compound — the chance that at least one hop is slow rises with the number of hops. 10 Cost per token or cost per action? Cost per successful action. A 30% failure rate multiplies effective cost by 1.43. 11 The one sentence for the whole architecture? "The model proposes, the platform disposes." 12 What makes a layer worth having? It denies something. A layer that denies nothing can be deleted.
# Question Answer
13 20 steps at p = 0.95 — task success? 0.95²⁰ ≈ 36% . You fix it by reducing n, not by improving the prompt. 14 Three ways to raise it? Fewer, coarser tools (lower n); validation and deterministic tools (higher p); checkpoints and compensation (failure ≠ task failure). 15 Where does session state live? Externalized — Redis or a database. Never a worker's memory. 16 Then why session affinity? As a cache optimization , never a correctness requirement. Losing affinity must cost latency, not the session. 17 Consistent hashing, 3 → 4 nodes? ~25% of keys move, versus ~75% for modulo. 18 Does checkpointing give exactly-once? No — resumability. Exactly-once effects is the action gateway's job. 19 Three memory types and their risk? Short-term (context, cheap), long-term (curated, a data-retention question), episodic (past runs, the one that quietly becomes a privacy problem). 20 Scratchpad token growth over n steps? Quadratic: nb + a·n(n−1)/2. At b=1k, a=2k, n=10 that is 100,000 input tokens, not 20,000. 21 How do you attack that term? Summarization, compaction, and prefix caching. 22 Why a step budget? An unbounded loop is an unbounded bill and an unbounded blast radius. It is also the only defence against a planner that loops on ambiguity. 23 What ends a run? Success, step budget exhausted, a blocking denial, or an escalation. Four terminal states, all recorded. 24 LangGraph or your own kernel? Use a framework in the kernel. Frameworks model the flow; none of them model the principal , which is the gap the platform fills.
# Question Answer
25 What is MCP, in one line? A JSON-RPC protocol for agent-to-tool access with capability advertisement and schema-enforced calls. 26 What does a tool registry hold? Name, semantic version, JSON Schema, declared side-effect class , owner, and the scopes required. 27 Why is the side-effect class mandatory? It drives retry policy, approval policy and idempotency requirements. A tool without one cannot be registered. 28 The four side-effect classes? read, write_idempotent, write_non_idempotent, irreversible. 29 Tool versioning scheme? Semantic. A required-field addition or a type change is major; a new optional field is minor. 30 What is authorization-aware discovery? An agent's tool list is filtered by what it may actually call — it should not see a tool it cannot use. 31 Why does that matter? Visibility is a side channel, and a model that can see a tool will eventually try it. 32 Validation before or after invariants? Schema first, then business invariants. You cannot check an invariant on a malformed payload. 33 Return the first error or all of them? All, sorted. A caller who fixes one and resubmits should not find the second on the next round trip. 34 Who owns a tool? A named team, with an SLO. An unowned tool in the estate is an outage with no pager.
# Question Answer
35 Why an internal task model? So protocols are adapters at the edge. The protocol is a serialization decision; the task model is the architecture. 36 What is an Agent Card? The A2A capability descriptor — what the agent can do, how to reach it, and how to authenticate. 37 Delegation depth limit? 3 for us, enforced at the authorization server. More requires a named exception with an expiry. 38 Why at the AS rather than the framework? An agent that forgets to check is a bug; an AS that forgets is a vulnerability — and only one of those is in my control. 39 How do you detect a cycle? The requesting actor already appears in the chain. Refuse, naming the chain so the operator sees a loop, not a recursion limit. 40 Does the chain append or replace? Appends. Replacing loses the human, and the human is the only accountable party in it.41 Where does the chain live? In the act claim of a signed token. Never in a request field — that would be forgeable. 42 Delegate agent is down. What happens? Degrade: the screening is deferred to a human, the answer stands, and the platform says so. 43 Group Compliance's AS is down — same answer? No. At an organizational boundary you refuse or escalate ; you never record a screening you did not perform. 44 What crosses an org boundary? A minimal payload — counterparty and reference, not the case file — with the classification travelling with it.
# Question Answer
45 Why a gateway at all? So residency, cost, tenant isolation and accounting are enforced once instead of in twelve agent codebases. 46 You just built a single point of failure. Deliberately. Stateless, multi-AZ, no synchronous control-plane call, routing table as data with a canary — and a higher availability target than anything it calls. 47 The four routing gates? Classification, residency, budget, degradation ladder — all inside the router. 48 Why inside? So the fallback passes them too. Routing and residency each tested separately is how confidential data reaches the wrong region at 3 a.m. 49 What is retryable? 429s and 5xx. Not a timeout on a non-idempotent call, and never a content filter. 50 Why not fall over on a content filter? Because that is shopping for a model that will do what your primary refused. It is one line of code and an audit finding. 51 Cache order relative to quota? Quota first — otherwise the cache is a quota bypass for the tenant with the best hit rate. 52 Three cache tiers? Exact response, prefix/prompt, semantic. Increasing hit rate, increasing risk. 53 Cache key rule? Tenant first, always. And never cache an entitlement-dependent answer — cache the retrieval instead. 54 Rate limit on what? TPM and RPM. One request can be 100k tokens; an RPM-only limit protects nothing. 55 Where does the tenant come from? The token. Anything the caller can set, the caller can forge. 56 Redis down — fail open or closed? Open on cache, closed on quota. A cache outage should cost latency; a quota outage would blow a hard external provider limit for everyone.
# Question Answer
57 Prefill vs decode? Prefill processes the input in parallel and is compute-bound; decode emits one token at a time and is memory-bandwidth-bound. 58 Why does batching help decode more? Because the weights are read once for the whole batch, and decode is bandwidth-limited by exactly that read. 59 KV cache size formula? 2 · L · H_kv · d · S · b — the leading 2 is keys and values. 60 Worked: L=32, H=8, d=128, S=8192, fp16? ~1.07 GB per sequence. On 50 GB of free HBM that is ~46 concurrent 8k sequences. 61 So what limits concurrency? Memory, not compute. That is why GQA matters so much for serving economics. 62 70B fp16 weights? ~130 GiB — it does not fit one 80 GiB card. Tensor parallel or quantize. 63 Batch-1 decode arithmetic intensity? About 1, against a ridge point around 300. You are three orders of magnitude off roofline. 64 PTU or PAYG? Dedicated floor at p50 demand for the latency-sensitive tier, spill to PAYG, batch on the cheapest thing. 65 Break-even? A utilization number: (monthly PTU cost ÷ PAYG per-1k) × 1000, divided by what the capacity actually serves at your token mix. 66 What moves it most? The input/output mix — enough to move break-even utilization from ~77% to ~40%. Not the price. 67 A non-cost reason for dedicated capacity? Latency. It removes shared-pool congestion and 429s, which is often the real reason. 68 Risk of a 1-year commitment? It is a bet against deprecation. Price the exit before signing.
# Question Answer
69 One index with a filter — what is wrong? Recall collapses for narrowly entitled users, counts and latency form a side channel, a filter is one refactor from a breach, and it cannot be proved. 70 The rule? Isolation is a property of what you search , not of what you return. 71 Your topology? Index per tenant, partition per classification, barriers in a separate store. 72 Why are barriers separate? A barrier is not a clearance level. A confidential deal memo passes a confidential clearance check — that ordering bug is an MNPI leak. 73 Check order? Barrier, then desk scope, then classification rank. 74 Why hybrid retrieval? Financial text is full of exact tokens — PMT-771, an LEI, pain.001 — that embeddings smooth over and BM25 nails. 75 Why RRF over a weighted blend? BM25 scores and cosine similarities are incomparable scales that drift. RRF uses only ranks, so there is nothing to calibrate. 76 RRF formula? Σ 1/(k + rank_i), k = 60. 77 Chunking approach? Structure-aware splits with ~15% overlap, and the parent title and section path prepended — "the limit is 5 million" is useless without which limit. 78 What do you shed first under load? The cross-encoder reranker. It is ~40% of the retrieval budget and it is not a control . 79 Do you index prices? No. Anything that changes by the second is a tool call. An indexed price is a wrong price with a citation. 80 Embedding model changes — what happens? Dual-write both vector spaces, backfill, cut over per tenant, retire the old. At 400M chunks that is a programme, not a config change.
# Question Answer
81 Why a graph as well as a vector store? The vector store answers "what text is relevant"; the graph answers "what is connected". 82 A query only the graph can answer? "Is this counterparty connected, through any ownership path of length ≤ 4, to a sanctioned entity?" 83 What is FIBO? The Financial Industry Business Ontology — a standard OWL vocabulary for financial entities and relationships. 84 What is SHACL for? Validating the graph's shape: every counterparty has an LEI, a jurisdiction and a screening date. A violation is a data-quality ticket, not a runtime surprise. 85 RDFS/OWL entailment in one line? Facts you did not state but that follow — subclass, subproperty, transitivity — materialized or inferred at query time. 86 SPARQL basic graph pattern? A set of triple patterns with shared variables; evaluation is a join over bindings. 87 Do graph results need entitlement? Yes. An ownership edge can itself be MNPI — same three dimensions applied to triples. 88 Graph is slow — what do you do? Fire it in parallel with retrieval, and if it does not return in budget, proceed and flag reduced grounding.
# Question Answer
89 Why not a service account per agent? The audit record then names a robot, least privilege becomes per-agent instead of per-task, and there is a standing credential to steal. 90 What replaces it? RFC 8693 token exchange: sub stays the human, act nests the agents. 91 Delegation or impersonation? Delegation. Impersonation makes the agent indistinguishable from the human downstream and destroys attribution. 92 How does act nest? Innermost is the most recent actor; the AS only nests an actor it authenticated via the actor_token. 93 What narrows at each hop? Scopes — monotone, enforced by the AS as a set-containment check. 94 Scope at the estate? A single resource instance: payments.release:PMT-771, not payments.release. 95 Credential lifetime there? 60 seconds, audience-bound to the specific endpoint, minted per action. 96 What is SPIFFE for? Workload identity: an attested, short-lived SVID delivered at runtime, so the agent holds no long-lived secret. 97 Bearer token in a log file? A credential — unless it is sender-constrained (RFC 8705 mTLS binding or DPoP), in which case the log line alone is useless. 98 Time to revoke an agent? Propagation + token TTL + in-flight. Roughly 6.5 minutes with 5-minute tokens — and it should be measured, not estimated. 99 How do you shorten it? Shorter TTLs, a revocation list at the resource server, and an out-of-band kill switch that does not depend on the bundle. 100 Compromised agent — blast radius? Its scopes, for five minutes, attributable, and still facing the gateway's dual control and idempotency. Bounded by construction.
# Question Answer
101 Default posture? Default deny, with deny overriding allow. Absence of a record is not permission. 102 What is KYA? Know Your Agent: a registry entry with an owner, a risk tier, an evaluation record and a lifecycle state, checked at runtime. 103 Control plane unreachable — what happens? Fail static : last known-good bundle, staleness alarm, hard stop past a defined age.104 Why not fail closed? Because then the control plane's availability becomes the platform's, which is a self-inflicted outage. 105 Why not fail open? It is a hole. And the hard stop is what stops fail-static becoming fail-open over a long outage. 106 Policy call on the hot path? No — a local bundle, pushed, with a TTL. A network call per request is a serial dependency you do not need. 107 What is continuous authorization? A decision lease with a TTL, re-evaluated, plus a kill switch — not a static grant checked once at start-up. 108 OPA or Cedar? Cedar where analyzability matters: "can any principal do X" is a question a regulator asks and Rego cannot answer in general. 109 Does a denial get recorded? Always. A decision with no record is indistinguishable from a control that never ran. 110 Behavioural posture check? Graduated, not categorical: a stale evaluation blocks a high-impact action but not a read.
# Question Answer
111 What is it for? It is the bank's enforcement boundary — the only path from a model's proposal to a bank action. 112 Order of checks? Contract, then idempotency key, then dual control, then breaker, then execute, then audit. 113 Exactly-once delivery? Impossible. Exactly-once effects is a key and a store. 114 The idempotency cases? New, completed-replay, conflicting-payload-same-key, and in-flight — the one people miss. 115 Dual control threshold? 100,000 USD here, inclusive. Above it, two distinct approvers. 116 Who cannot approve? The requesting user, the acting agent, and every agent in the chain — otherwise self-approval through a delegated agent works. 117 Circuit breaker settings? Failure ratio over a window, with a minimum throughput so two failures out of three do not open it, and half-open probes to recover. 118 Saga compensation order? Reverse. And you must handle orphans — a step that succeeded but whose result was never recorded. 119 Downstream circuit is open — deny? No: degrade . The answer stands, the action is deferred. A dependency outage is not a policy denial. 120 Missing approval — denied? Escalated. Denied ends a workflow; escalated opens one, and they have different SLIs.121 Audit log shape? Hash-chained over canonical JSON, with the trace id on every record. 122 Does the chain prevent tampering? No — it makes it evident . Prevention needs the head anchored outside the platform.
# Question Answer
123 Is prompt injection solved? No, and the design does not depend on the scanner. 124 So what stops it? Containment: side-effecting + derived from retrieval + unapproved = refuse. The attacker's ceiling is a human decision. 125 Where does the chain run? Twice — over retrieved content before the prompt, and over the proposed action before the gateway. 126 Which documents are tainted? The ones that passed the scan. Failing means dropped; passing means it is in the prompt and attacker-influenceable. 127 Does taint propagate? Yes — a summary of a poisoned document is poisoned. That is the hard engineering. 128 Noisy-OR, and why? 1 − Π(1 − w). Summing exceeds 1.0; max throws away corroboration. 129 Normalization before matching? NFKC, then strip invisibles. Otherwise a homoglyph defeats every string matcher you have. 130 A barrier removes a document — is the request failed? No. That is a control acting , not halting. Collapsing the two makes every filtered document look like an outage. 131 OWASP LLM coverage? A matrix generated from the code, so a new risk row becomes a missing control rather than a spreadsheet gap. 132 How do you grade a red-team run? On containment — did it reach a human rather than an action — not on detection.
# Question Answer
133 Money in code? Integer minor units with a per-currency exponent. Divide last, never float. 134 Why? 1.15 * 100 is 114.99999999999999, and int() of that is 114. That is a real payment.135 Exactly-once effects across a boundary? Transactional outbox: write the state and the message in one transaction, relay separately, dedupe at the consumer. 136 Kafka ordering guarantee? Per partition. So the partition key is the ordering guarantee. 137 Schema compatibility and deploy order? Backward compatibility means consumers deploy first; forward means producers first. Getting it backwards is the outage. 138 When is a payment final? When the scheme says so — settlement dominates the cut-off. Finality is a rule, not a timeout. 139 A Terraform attribute change that replaces? A ForceNew attribute. Knowing which ones those are is the difference between a change and an outage. 140 Admission policy engine errors — admit? No. Fail closed. A policy engine that errors must not admit.
# Question Answer
141 Alerting pattern? Multi-window multi-burn-rate, with a minimum event count so a quiet hour cannot page on one failure. 142 Span self-time? Total minus the union of child intervals — not the sum, or concurrent children double-count. 143 Cardinality budget? It is a product: agent × tool × tenant × model × outcome. Budget it before shipping, not after the bill. 144 Degradation ladder rule? Quality may degrade; safety may not. No control is ever a rung , checked at construction. 145 Descend and ascend symmetrically? No — jump down fast, step up one rung at a time. Symmetric recovery oscillates. 146 The six reproducibility pins? Base model, prompt, policy, tool set, guardrails, and retrieval snapshot — the last is the forgotten one. 147 Evidence pack property? Generated, not assembled — and complete, or it names the missing artifact. 148 Two-in-a-box in one sentence? Undivided accountability, including the pager. Not a partition of tech and product. 149 Who signs an irreversible decision? Both owners. Reversible: one, recorded. Unresolved: escalate with both written positions, never the average. 150 What is an ORR? A gate, not a grade: any mandatory criterion failing fails the review at any advisory score, and every criterion names the artifact that proves it.