agents

Leaked keys remain one of the commonest breach causes, and agents create new places to leak them. The scored answer prefers no secret at all, then short-lived ones, and keeps them out of every model context.

A service account is the easy answer and the wrong one. The interviewer wants both identities visible in every call, scoped to the task, and revocable by the user.

A 1988 bug report that describes most agent incidents. The answer that scores turns it into a design rule: authority travels with the request.

An MCP server is an API that a model drives. The scored answer treats it as an OAuth resource server, authorises every tool call against the user, and keeps upstream credentials out of the client's hands.

Machine identities outnumber people in most organisations and are reviewed far less. The scored answer finds them, gives each an owner, shrinks their power and lifetime, and watches how they are used.

A confirmation click proves someone was present; step-up proves it was the user, recently. The scored answer decides which actions need it and wires it through tokens so the agent cannot fake it.

Trace a withdrawn grant through cached decisions, exchanged tokens and queued work. Define when new actions are denied and account for effects already dispatched.

A user agent string is a claim anyone can type. A signature over the request is a claim only the key holder can make. The interesting part is what that signature still does not tell the site.

A browsing tool is a URL fetcher whose destination is chosen by text anyone can write. The interviewer wants the defences in the tool and the network, not the prompt.

The model is not the attacker, but whoever wrote the document it just read might be. Every argument in a tool call is untrusted input.

File tools take paths from the model, and the model takes ideas from whatever it read. A string check for '..' is not confinement.

The commonest serious bug in AI tools is the oldest: fetching an object by ID without checking who is asking. The scored answer finds it, fixes it at the data access, and tests across users and tenants.

The model's guess is cheap; the proof is what matters. Strong answers describe the oracle that turns a hypothesis into evidence, and the triage that keeps maintainers from drowning.

A patch that makes the scanner go quiet is not the same as a patch that fixes the bug. The interview is about how you would tell the difference at scale, and what the tool itself can be tricked into doing.

Assume the code is hostile and design until that stops mattering. Then the interviewer adds a GPU and the internet, and you design again.

An MCP server is code you run or trust, plus text your model reads. The scored answer reviews who wrote it, what it can reach, what its tool descriptions say, and pins it so it cannot change silently.

The LLM list has one item for agency. The agentic list spends ten on it. The answer that scores explains why, and which new risks only exist once agents act, remember and talk to each other.

Longer thinking helps the model resist some attacks and gives others more room. The scored answer covers the reasoning trace as data, as a monitoring signal, and as an attack surface.

Trace the proposal to its executor, resource policy and task scope. A valid credential or tool schema does not by itself authorize this particular action.

Compare actual sources, identities, audiences, effects and persistence. Review what tools add without dismissing text-only harms or assuming user-scoped credentials authorize every task.

Compare controller-enforced workflows with mediated planner inputs. Trace opaque values, bounded fields, runtime branches and retries to the actual permission decision.

Use the seven-stage research framework without forcing every incident through every stage. Work a partial trace, model alternate paths and separate stored state from observed downstream influence.

Inventory the data, untrusted inputs and outbound routes, including tools with two roles. Propose one enforced restriction and explain what the first pass leaves unresolved.

Start with the useful task, its data paths and its effective authority. Produce explicit backend invariants, bounded execution and a testable release decision that covers ordinary work as well as denied effects.

Compare each task’s required effects with the functionality, permissions and autonomy the system exposes. Narrow the effective authority at enforceable boundaries while preserving legitimate workflows.

Review an integration by tracing model input, process access and credential recipients. Then name the component that refuses each unauthorized action.

Build a permission worksheet for each tool: acting principal, task grant, objects, recipients, bounds and enforcement. Treat reads and reversible writes as potentially consequential.

Distinguish metadata review from runtime authorization. Work through an uncalled tool, a changed definition and a server whose behavior changes without new metadata.

Design the review around a permitted action and an understandable consequence. Evaluate whether people catch relevant changes, while keeping authorization, exact-action binding and alternate delivery paths enforced outside the model.

Define automatic work within an existing grant, decisions that need new authority and prohibited effects. Assess data disclosure, impact, recovery and uncertain inputs without turning every step into another confirmation.

Follow the write, retrieval and execution paths separately. A remembered claim can persist without becoming policy; prove which records later tasks receive and which actions the resource service permits.

Contain affected authority, preserve evidence in parallel and reconcile actual effects. Work through shared inputs, queued jobs, uncertain outcomes and a tested path back to useful service.

Treat repository code and shell execution as part of the threat model. Define reachable files, credentials, services and publication paths, then verify the actual sandbox and CI handoff rather than trusting command names.

Connect task authority, evidence, dispatch attempts and observed effects. Learn what references, hashes and signed logs can establish, and test collection gaps without overcollecting sensitive data.

Separate model judgment from enforceable invariants, then inspect the inputs and state transitions used by the policy code. Deterministic code is useful only when its authority and facts are trustworthy.

Bound work where it is dispatched, account for concurrent branches and retries, and keep uncertain operations reserved. Choose limits from workload evidence and operational capacity, then preserve useful progress when a bound is reached.

Separate task authorization, path resolution and safe publication. A resolved path is only a snapshot; test concurrent changes, protected targets and aggregate limits without treating a few passing cases as proof.

Contain financial actions and reconcile provider state in parallel. Work through a synthetic exposure table, uncertain dispatch, cancellation limits and the evidence needed for a controlled restart.

Trace field origin through telemetry, summaries and response proposals. Preserve evidence, verify current targets and playbooks, and test both missed threats and harmful containment.

Define current task authority and forbidden effects, test policy and agent behavior together, and report proposals, outcomes and useful completion with honest denominators and uncertainty.

Map the caller, task grant, data audience and execution boundary at each handoff. Explain how a valid internal message can still request an unauthorized action.

Choose narrow extraction or full-text reading according to the task. Preserve source evidence and uncertainty, and enforce data audiences and action authority independently of extracted claims.

Distinguish profile, device and account boundaries, then bind UI actions to the intended app, recipient and effect. Screenshots and accessibility trees provide observations, not trusted authorization.

Separate false-information spread, borrowed authority and runaway work. Put shared limits and stop checks at the propagation paths, then recover without repeating completed effects.

Review customer, operator and service authority separately. Enforce order access and email release policy, govern contact changes, and test valid work alongside unauthorized reads and disclosures.

Map effective authority, test component and handoff boundaries in authorized isolation, and report captured effects with coverage limits. Keep adaptive discovery separate from estimates of production risk.

Design investigation, response policy and execution with distinct authority. Build an action matrix, handle failed dependencies and tenant boundaries, and evaluate useful work alongside missed incidents and wrongful containment.

Design a refund ledger that handles authorization, concurrent reservations, distinct partial refunds and uncertain provider outcomes. A stable retry key helps, but does not enforce the business budget.

Freeze the resolved purchase, authenticate the approver and verify the same action at execution. Then handle mutable addresses, simultaneous workers and a supplier timeout without treating a hash as a complete transaction protocol.

Separate proposal, verification and deployment authority. Bind approval to the executed artifact and environment, protect every policy dependency, and plan for drift, partial application and limited rollback.

Choose fixed query tools or bounded exploratory SQL, then verify the database role, tenant context, views, callable functions and resource controls. Read-only and row limits alone do not protect confidentiality or cost.

Compare each proposed action with the task’s existing grant, current policy and remaining budget. Continue within that scope; stop when authority expires or the action changes materially, and preserve the state of work already dispatched.

Separate enforceable permissions from behavioral review. Measure the checker on the proposer’s actual failures, track legitimate actions it blocks, and test the execution service even when every model recommends proceeding.

Define the compromise scope and secret boundary, map direct and indirect capability paths, and assemble evidence with explicit assumptions. Denial tests and model refusals are useful observations, not universal proofs.

Treat a wider memory audience as a publication decision. Check the publisher, evidence, disclosure scope and version separately; repeated copies, familiar account names and a verified label do not establish all four.

Define memory classes and their purpose, then inventory active records, derivatives, in-flight tasks and restored copies. Report retrieval denial and physical removal as separate milestones with evidence for each.

Define the partner identity, permitted operations, disclosure rules and commitment states. Verify claims against authorized evidence and reconcile disputed or uncertain effects.

Separate reachable authority, forbidden proposals, gate decisions and confirmed effects. Compare designs with matched tasks, explicit denominators and uncertainty; tool counts and zero observed failures are not universal risk scores.

Compare actions with current grants and policy, distinguish unusual behavior from violations, and handle legitimate task revisions. Verify observation coverage and respond to the affected operation.

Map influence through memory, retrieval, tool metadata, outputs and shared artifacts. Separate persistence from actual impact, govern publication, and recover with explicit coverage of derivatives and ongoing work.

Browser origin isolation still applies to web content. Explain the separate authority of an agent that reads and acts across sites, then constrain data flow, destinations and consequential actions at the agent boundary.

Design-time controls decide what an agent may do. Runtime protection watches what it actually does, at four different layers, and each layer catches something the others miss.

Separate a suspicious signal, a verified effect and a causal hypothesis. Then contain the real path, scope exposure and record what is still unknown.

Design records for identity, context provenance, authorization and actual effects. Include missing-event coverage and a protected way to retrieve evidence.

Define what the stop control guarantees at admission and commit. Include queues, retries, accepted actions and a separately authorized restart.

Design a bounded assessment workflow from approved requirements to verified findings. Separate genuine mechanism discovery from new wording, scorer errors and unresolved effects.

Security asks who can steal the data. Privacy also asks what the agent itself collects, infers, remembers and passes on, about the user and about everyone in their inbox who never agreed to anything.