OpenAI Agent, Tool & MCP Security interview questions

Giving an agent a card number is the wrong design. The scored answer separates consent, spending limits and agent identity, and shows how 2025-26 protocols handle each.

A skill is instructions plus code that runs with the agent's own permissions, with no process boundary in between. The scored answer reviews it like software and like a prompt, because it is both.

Review an integration by tracing model input, process access and credential recipients. Then name the component that refuses each unauthorized action.

Inventory the data, untrusted inputs and outbound routes, including tools with two roles. Propose one enforced restriction and explain what the first pass leaves unresolved.

Start with the useful task, its data paths and its effective authority. Produce explicit backend invariants, bounded execution and a testable release decision that covers ordinary work as well as denied effects.

Compare each task’s required effects with the functionality, permissions and autonomy the system exposes. Narrow the effective authority at enforceable boundaries while preserving legitimate workflows.

Build a permission worksheet for each tool: acting principal, task grant, objects, recipients, bounds and enforcement. Treat reads and reversible writes as potentially consequential.

Distinguish metadata review from runtime authorization. Work through an uncalled tool, a changed definition and a server whose behavior changes without new metadata.

Design the review around a permitted action and an understandable consequence. Evaluate whether people catch relevant changes, while keeping authorization, exact-action binding and alternate delivery paths enforced outside the model.

Define automatic work within an existing grant, decisions that need new authority and prohibited effects. Assess data disclosure, impact, recovery and uncertain inputs without turning every step into another confirmation.

Follow the write, retrieval and execution paths separately. A remembered claim can persist without becoming policy; prove which records later tasks receive and which actions the resource service permits.

Contain affected authority, preserve evidence in parallel and reconcile actual effects. Work through shared inputs, queued jobs, uncertain outcomes and a tested path back to useful service.

Treat repository code and shell execution as part of the threat model. Define reachable files, credentials, services and publication paths, then verify the actual sandbox and CI handoff rather than trusting command names.

Trace which private data can reach which destinations when browsing and email share a task. Rank harms by the capabilities and checks actually present, and preserve useful combined workflows within a narrow grant.

Connect task authority, evidence, dispatch attempts and observed effects. Learn what references, hashes and signed logs can establish, and test collection gaps without overcollecting sensitive data.

Separate model judgment from enforceable invariants, then inspect the inputs and state transitions used by the policy code. Deterministic code is useful only when its authority and facts are trustworthy.

Bound work where it is dispatched, account for concurrent branches and retries, and keep uncertain operations reserved. Choose limits from workload evidence and operational capacity, then preserve useful progress when a bound is reached.