Core to Deep Dive
Prepare for prompt injection, authorization, approval gates, data isolation, and safe high-impact actions.
Depth
Showing 4 of 4 questions
Short answer
Prompt injection is untrusted content attempting to alter model behavior or override instructions. Tool-using agents are more exposed because a successful injection can influence real actions, data access, messages, or transactions.
Interview-ready answer
I treat retrieved documents, web pages, emails, and tool output as data rather than trusted instructions. The runtime separates instruction channels, minimizes available tools and credentials, validates every action against policy and user intent, and requires approval for sensitive effects. Detection can add signals, but prevention depends on capability isolation because no prompt can reliably neutralize every adversarial string.
Common mistakes
Short answer
Separate planning from execution, use least-privilege credentials, validate intent and parameters, preview effects, require approval, add idempotency and transaction controls, and maintain auditable logs. Prefer reversible staged operations.
Interview-ready answer
The model may draft an action, but a policy layer evaluates actor, resource, scope, risk, and current user confirmation. For destructive or financial operations I use a two-phase flow: generate a human-readable preview, obtain explicit approval bound to exact parameters, then execute with a short-lived token or idempotency key. Where possible, actions enter a reversible pending state and a deterministic service enforces limits.
Common mistakes
Short answer
Require approval when actions are high-impact, irreversible, costly, externally visible, legally sensitive, ambiguous, or outside previously granted scope. Approval should show exact effects and expire if the action changes.
Interview-ready answer
I derive approval policy from risk rather than adding humans to every step. Read-only and reversible low-risk actions can proceed within delegated scope, while payments, deletion, external communication, permission changes, and sensitive data disclosure need explicit confirmation. The approval record includes actor, action, parameters, preview, timestamp, and policy version, and any material parameter change invalidates it.
Common mistakes
Short answer
Enforce tenant and user scope in every server-side data and tool operation, use least-privilege credentials, avoid model-controlled identifiers as authorization, and propagate trusted identity through traces, retrieval filters, caches, and memory stores.
Interview-ready answer
Authentication establishes the actor, but each resource access still needs authorization based on tenant, role, ownership, and action. The runtime injects trusted scope into tool calls rather than accepting it from model output. Retrieval indexes, memory, caches, background jobs, and logs must preserve the same boundary. I add row-level security where available, per-tenant encryption or keys for sensitive domains, audit trails, and adversarial tests that attempt cross-tenant references.
Common mistakes