authorization

The order lookup is the whole interview. Candidates who spend ten minutes on jailbreaks and two on authorization have it backwards.

Ten seconds of definition, then the part that scores: why most access bugs happen to users who logged in perfectly.

Documents are shared with people, folders, teams and links. Roles alone collapse under that, and the interviewer wants to see you notice when.

A 1988 bug report that describes most agent incidents. The answer that scores turns it into a design rule: authority travels with the request.

An MCP server is an API that a model drives. The scored answer treats it as an OAuth resource server, authorises every tool call against the user, and keeps upstream credentials out of the client's hands.

Zero trust is a set of engineering decisions, not a product. The scored answer names them, shows how they replace network location as a trust signal, and admits where they are hard.

Scattered permission checks drift apart until one is wrong. The scored answer weighs a central decision service against latency, availability and consistency, and keeps enforcement close to the data.

A confirmation click proves someone was present; step-up proves it was the user, recently. The scored answer decides which actions need it and wires it through tokens so the agent cannot fake it.

Validate tenant selection, enforce resource permissions, and test the boundaries that signed context and row-level security do not cover automatically. Follow one request through retrieval, caches and a queued job.

Scanners rarely find it, because every request looks valid. Finding it at scale is a testing design problem, not a scanning problem.

Work through tenant, role, object and field checks, then extend the review to bulk exports, permission changes and resource budgets with executable acceptance cases.

The commonest serious bug in AI tools is the oldest: fetching an object by ID without checking who is asking. The scored answer finds it, fixes it at the data access, and tests across users and tenants.

GraphQL lets clients ask for exactly what they want, which includes things you did not mean to give them and queries that cost a thousand times a normal one. The scored answer moves controls to where GraphQL actually decides things.

A WebSocket starts as an HTTP request that carries the user's cookies and skips CORS. The scored answer explains the hijack, then the controls that a long-lived connection needs that a normal request does not.

Trace the proposal to its executor, resource policy and task scope. A valid credential or tool schema does not by itself authorize this particular action.

The assistant becomes a new client of every API the product has, with a confused-deputy problem built in. The scored answer finds the new trust boundaries and keeps the old access model intact.

Build a permission worksheet for each tool: acting principal, task grant, objects, recipients, bounds and enforcement. Treat reads and reversible writes as potentially consequential.

Separate model judgment from enforceable invariants, then inspect the inputs and state transitions used by the policy code. Deterministic code is useful only when its authority and facts are trustworthy.

Design a refund ledger that handles authorization, concurrent reservations, distinct partial refunds and uncertain provider outcomes. A stable retry key helps, but does not enforce the business budget.