multi tenancy

The CPU does work it later throws away, but the cache remembers. The strong answer explains that one sentence precisely, then turns it into isolation decisions for shared infrastructure.

Data keys, key-encryption keys, tenant isolation, rotation and crypto-shredding. The design is standard; the trade-offs at each level are the interview.

Using one key for several purposes quietly couples their security. The scored answer explains extract and expand, shows key separation by context, and says when HKDF is the wrong tool.

Validate tenant selection, enforce resource permissions, and test the boundaries that signed context and row-level security do not cover automatically. Follow one request through retrieval, caches and a queued job.

Every layer parses something an attacker wrote, every request costs real money, and tenants share hardware. Walk the path and price each risk.

GPUs were built for throughput, not mutual distrust. Each sharing mode makes a different promise about memory, and some make none.

A customer model is customer code: loading it can execute anything, and serving it shares expensive hardware. The scored answer isolates execution, scans and constrains artefacts, and keeps tenants apart on GPUs and networks.

Similarity search has no idea who is asking. The answer that scores makes the index enforce the source system's rules, at query time and over time.

An incident question disguised as debugging. The answer that scores treats it as a possible breach, preserves evidence, and checks the four usual causes in order of likelihood.

Caches are shared state, and shared state crosses tenants. The scored answer separates response caches from prompt prefix caches and keys each so one user can never read or detect another's data.

Fine-tuning moves data from a database you can query and delete into weights you cannot. The scored answer covers memorisation, tenant separation, poisoning and the deletion problem.

The service receives customers' source code all day. The scored answer protects that code across tenants, keeps secrets out of prompts and logs, and treats suggestions as untrusted output.

The assistant becomes a new client of every API the product has, with a confused-deputy problem built in. The scored answer finds the new trust boundaries and keeps the old access model intact.

Trace the data from its owner to each actual reader. Repair the access or reuse boundary, including caches, revoked permissions and retained artifacts.