Agentic AI interview question · Security, permissions and sandboxing · staff level
Design the security architecture for an agent that can read and send company email.
Free to read in full. This is 1 of the 120 questions in the Agentic AI Engineering interview pack, with 153 diagrams. Get the pack, ₹999 · $20
Why it is asked
This tests whether you can design trust boundaries around a tool that is both a source of untrusted input and an exfiltration channel, and roll it out safely across a company.
The answer
Design it so that no single model output can send data outside the company without a code or human check. Email is the hardest case: every inbound message is untrusted input, and send is a way to steal data (data exfiltration).
Requirements: triage, summarize and draft replies; internal sends allowed, external only within rules; data loss prevention (DLP: scanning for data that must not leave) and audit.
Architecture:
- Identity: a delegated OAuth token (a limited access grant) for that one mailbox, never a company-wide account, held in a broker the model cannot see.
- Split processing: a quarantined model (isolated, with no tools) reads raw email and returns only typed, validated fields: the sender address checked against the directory, an intent from a fixed list, dates in a standard format, and message ids. Any free text it writes, such as a summary, is stored as an opaque reference ($SUMMARY_1) that code shows to the user or pastes into a draft. The planner model, which can call tools, never reads raw email or that free text. This is the dual LLM (large language model) pattern, and it works only if no free text crosses the boundary.
- Send gateway: every send passes fixed rules in code: internal recipients allowed; external recipients need user approval showing recipient, body and attachments; a DLP scan; an hourly rate limit.
- Audit: every read, draft and send is logged with the prompt version and approver.
Trade-off: approvals slow people down; widen auto-send only for patterns with near-zero rejections.
Rollout: drafts only for a pilot team, then internal send, then external with approval; run a red-team injection suite (your own testers' attacks) every release.
What the interviewer listens for
- Inbound email is untrusted input; send is an exfiltration channel
- Delegated, mailbox-scoped identity with tokens held outside the model
- Quarantined reader passes typed fields only; free text crosses as an opaque reference
- Deterministic send gateway: recipient rules, DLP, rate limits, approval
- Staged rollout: drafts, internal send, external with approval
Follow-ups the interviewer may ask
- Why not a single service account with access to all mailboxes? Hint: one injection then reaches every mailbox; per-user delegation limits the blast radius.
- How do you stop approval fatigue? Hint: approve only external or unusual sends, show a clear diff, and track rubber-stamp signals like approval time.
- How do you handle a legal hold or deletion request? Hint: the agent's logs and memory follow the same retention policy as the mailbox.
Common mistakes
- Letting the planner read raw email or a free-text summary of it
- Putting send rules in the system prompt instead of a gateway
- Using one broad service account for every user
Written by Roni Das, who builds distributed systems and AI systems for a living.
Learn it properly
This is taught step by step in the course lesson Agent Identity and Authorization: Whose Authority Is It?.
One question is not enough for the interview.
This is 1 of the 120 questions in the Agentic AI Engineering pack
Each question has why it is asked, a full answer, what the interviewer listens for, the follow-ups, the common mistakes and a diagram (153 diagrams in all). A PDF you keep, junior to staff level.
120 questions153 diagramsjunior to staff
India: UPI, cards or netbanking through Razorpay. Elsewhere: PayPal. Download at once from My packs.
More free questions from this pack
Free questions from the other packs
- What do temperature and top-p control, and what values would you use for data extraction versus brainstorming? (AI Engineering)
- What is hybrid search, and how do you merge keyword and vector results with Reciprocal Rank Fusion? (AI Engineering)
- Users ask "list all X" questions and RAG returns only five items. Why, and what do you do? (AI Engineering)
- How do you check that an LLM judge agrees with human reviewers? (AI Engineering)
- Cut the cost of an LLM feature serving 10 million requests a day by 60% without hurting quality. Walk through your plan. (AI Engineering)
- Why are LLMs bad at counting letters or reversing a word? (GenAI and LLM)
- Write out scaled dot-product attention with the shape of every tensor. (GenAI and LLM)
- How does speculative sampling keep exactly the target model's distribution? (GenAI and LLM)
- What is GRPO, and how do verifiable rewards train reasoning models? (GenAI and LLM)
- Design a system that answers questions from 300-page contracts accurately. (GenAI and LLM)
- What happens, step by step, when an LLM server handles one request? (Inference Engineering)
- Derive the KV cache size formula and work it out for Llama 3 70B. (Inference Engineering)
- What is PagedAttention? (Inference Engineering)
- When does speculative decoding stop helping or make things worse? (Inference Engineering)
- Design a service to serve Llama 3 70B at 10 QPS with latency targets. (Inference Engineering)
- A model scores 95% accuracy offline but users say it is useless. What do you check first? (ML Engineering)
- How do you train on a dataset that does not fit in memory? (ML Engineering)
- A long distributed training job dies at hour 20. How do you make training fault tolerant? (ML Engineering)
- How does request batching on a GPU trade latency for throughput? (ML Engineering)
- An online model metric dropped 8% overnight. How do you debug it? (ML Engineering)
- You need to show delivery times for 20 cities. Would you use histograms, box plots, violin plots or ECDFs, and why? (Data Science)
- A test is 99% accurate and you test positive. What is the chance you have the disease? (Data Science)
- What share of first-time buyers make a second purchase within 30 days? Write the SQL. (Data Science)
- How would you forecast daily orders for the next four weeks, and how do you know the forecast is any good? (Data Science)
- A coupon A/B test shows a small average lift. How do you find which users the coupon actually works for, and who should get it next time? (Data Science)
- Compute the cosine similarity of a = (3, 4) and b = (4, 3) by hand. What does the result mean? (Maths for ML)
- A batch of 32 MNIST images goes into a dense layer with 128 units. What are the shapes, and what is the rule for when two matrices can be multiplied? (Maths for ML)
- A disease affects 1% of people. A test catches 90% of sick people (sensitivity) and wrongly flags 9% of healthy people (false positive rate). You test positive. What is the chance you are sick? (Maths for ML)
- Why do we not use mean squared error for classification with a sigmoid output? Compare the gradients numerically. (Maths for ML)
- Compute scaled dot-product attention by hand for two tokens with d_k = 2. (Maths for ML)
- A customer says: "We want AI for our support team." What do you do in the first meeting? (Forward Deployed Engineer)
- The customer's admin offers you a global admin account "to save time". What do you ask for instead, and why? (Forward Deployed Engineer)
- Your connector writes tickets into the customer's system. A request timed out, the connector retried, and now there are duplicate tickets. How do you make the writes safe to retry? (Forward Deployed Engineer)
- The customer wants RAG over 10 million documents, all behind their firewall. Size it for me on the whiteboard. (Forward Deployed Engineer)
- One deployment of your AI platform must serve 50 business units of the same enterprise. How do you design multi-tenancy? (Forward Deployed Engineer)