Skip to content
AI Security

Interview question · Identity, OAuth & Access Control

How do you inventory and govern service accounts, API keys and AI agent identities?

Machine identities outnumber people in most organisations and are reviewed far less. The scored answer finds them, gives each an owner, shrinks their power and lifetime, and watches how they are used.

hardNewPreparation tags: Microsoft, Amazon, GoogleUpdated Nov 2026

Machine identities outnumber people in most organisations and are reviewed far less. The scored answer finds them, gives each an owner, shrinks their power and lifetime, and watches how they are used.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

10 answers per topic instead of 5, plus saved progress and bookmarks · costs nothingor unlock all 529 remaining answers · $25

Every worked answer in all 17 topics, every lesson in every course, the full concept curriculum, the complete practice-test bank, and the downloadable security field guides.

6 months · One payment · No auto-renewal

What if · the follow-ups in this answer

The answer works through 6 follow-ups like an interviewer would

An audit finds 4,000 service accounts and API keys across cloud, SaaS and CI systems, most without owners, and AI agents are adding more each month.

  1. Where do you inventory non-human identities?
  2. What do you do with ownerless identities?
  3. How do you reduce the risk of those that remain?
  4. How do you detect misuse?
  5. Why do AI agents add urgency?
  6. How would you tackle the sprawl?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Premium opens every answer and ladder.

UP NEXT ON YOUR JOURNEY
Next in this trackWhat does zero trust mean in practice, beyond the slogan?Next in this trackWhen should authorisation move out of application code into a central policy engine or service, and what are the trade-offs?Next in this trackWhat is OAuth consent phishing, and how do you detect and prevent it?
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.