access control

Reading rwx bits is the easy half. Interviewers check whether you know what execute means on a directory, why setuid binaries are an attack surface, and what the sticky bit does and does not protect.

The definition takes one sentence. The interview is about the four ways privilege actually moves, and why most escalations are misconfigurations rather than exploits.

Turning off passwords is the easy half. The interview is about the other half: how keys are issued, how long they live, how a host proves itself, and how you cut someone off at 5pm on a Friday.

Ten seconds of definition, then the part that scores: why most access bugs happen to users who logged in perfectly.

The people who build frontier models need access to them, which is exactly the risk. The scored answer reduces who can touch weights directly, makes exfiltration hard and visible, and does it without poisoning research culture.

A design round in miniature. The answer that scores follows the data through both halves of the pipeline and spends most of its time on authorization, where real leaks happen.

Similarity search has no idea who is asking. The answer that scores makes the index enforce the source system's rules, at query time and over time.

The connector copies documents out of a system that enforces permissions into one that must re-create them. The scored answer treats permission fidelity and freshness as the core problem.

Most bad retrieval is a quality bug; some of it is an attack or an access failure. The scored answer separates the cases quickly and checks the security ones first.

Similarity scores, result counts, snippets and ranking all say something about what is in the index. If authorization is applied after search, the search itself is the leak.

Mythos-class models and Gemini's Flash Cyber variants did not ship to everyone. Knowing why, and what joining a vetted-access programme commits you to, is now a governance interview staple.