Forward Deployed Engineer interview question · Integrating with messy enterprise data · junior level
The customer's admin offers you a global admin account "to save time". What do you ask for instead, and why?
Free to read in full. This is 1 of the 100 questions in the Forward Deployed Engineer interview pack, with 127 diagrams. Get the pack, ₹999 · $20
Why it is asked
This tests judgment and security hygiene. A good FDE turns down convenient but risky access and asks for something precise.
The answer
I thank them and ask for a dedicated service account with only the permissions the integration needs, on only the data it needs. A service account is a non-human identity used by one system. Least privilege means giving the smallest set of rights that still lets the job work.
Why not the admin account:
- Blast radius: if our credential leaks, an attacker gets the whole tenant (the customer's entire account), not three tables.
- Audit: every action looks like the admin did it, so nobody can tell our sync from a person.
- Fragility: human accounts get MFA prompts (second-step login codes), password expiry and get disabled when the person leaves, and then our sync breaks at night.
- Compliance: auditors flag shared human credentials.
What I ask for, concretely:
- Snowflake: a role with USAGE on one warehouse, database and schema, and SELECT on the named tables, granted to a user of TYPE = SERVICE with key-pair authentication (logging in with a private key file instead of a password).
- Postgres: a read-only role with SELECT on one schema, pointed at a read replica.
- AWS: an IAM role (a set of AWS permissions) our account can use, limited to one S3 bucket prefix.
I write the request as a short table: system, identity, permission, reason, owner, review date. Admins approve that quickly because it is easy to check, so it rarely costs time. If they insist on the admin account for a first test, I agree only for a sandbox, with an expiry date written down.
What the interviewer listens for
- Ask for a dedicated, non-human service account.
- Scope: only the systems, objects and actions the integration needs.
- Reasons: blast radius, clean audit trail, no MFA or leaver breakage.
- Put the request in a reviewable table with an owner and review date.
Follow-ups the interviewer may ask
- The integration later needs write access to one table. What do you do? Hint: request a second, separate grant for that table only, with its reason.
- How do you authenticate the service account without a password? Hint: key pairs, workload identity or OAuth client credentials, with keys stored in a secrets manager.
- Who should own the service account? Hint: a named team on the customer side, so it is reviewed and not orphaned.
Common mistakes
- Accepting admin access because it makes the first demo faster.
- Sharing one service account across several integrations, so audit and revocation lose meaning.
- Forgetting that a Snowflake role also needs USAGE on the warehouse, database and schema.
Written by Roni Das, who builds distributed systems and AI systems for a living.
One question is not enough for the interview.
This is 1 of the 100 questions in the Forward Deployed Engineer pack
Each question has why it is asked, a full answer, what the interviewer listens for, the follow-ups, the common mistakes and a diagram (127 diagrams in all). A PDF you keep, junior to staff level.
India: UPI, cards or netbanking through Razorpay. Elsewhere: PayPal. Download at once from My packs.
More free questions from this pack
- A customer says: "We want AI for our support team." What do you do in the first meeting? (mid)
- Your connector writes tickets into the customer's system. A request timed out, the connector retried, and now there are duplicate tickets. How do you make the writes safe to retry? (mid)
- The customer wants RAG over 10 million documents, all behind their firewall. Size it for me on the whiteboard. (senior)
- One deployment of your AI platform must serve 50 business units of the same enterprise. How do you design multi-tenancy? (staff)
Free questions from the other packs
- What do temperature and top-p control, and what values would you use for data extraction versus brainstorming? (AI Engineering)
- What is hybrid search, and how do you merge keyword and vector results with Reciprocal Rank Fusion? (AI Engineering)
- Users ask "list all X" questions and RAG returns only five items. Why, and what do you do? (AI Engineering)
- How do you check that an LLM judge agrees with human reviewers? (AI Engineering)
- Cut the cost of an LLM feature serving 10 million requests a day by 60% without hurting quality. Walk through your plan. (AI Engineering)
- Why are LLMs bad at counting letters or reversing a word? (GenAI and LLM)
- Write out scaled dot-product attention with the shape of every tensor. (GenAI and LLM)
- How does speculative sampling keep exactly the target model's distribution? (GenAI and LLM)
- What is GRPO, and how do verifiable rewards train reasoning models? (GenAI and LLM)
- Design a system that answers questions from 300-page contracts accurately. (GenAI and LLM)
- What happens, step by step, when an LLM server handles one request? (Inference Engineering)
- Derive the KV cache size formula and work it out for Llama 3 70B. (Inference Engineering)
- What is PagedAttention? (Inference Engineering)
- When does speculative decoding stop helping or make things worse? (Inference Engineering)
- Design a service to serve Llama 3 70B at 10 QPS with latency targets. (Inference Engineering)
- Compute the cosine similarity of a = (3, 4) and b = (4, 3) by hand. What does the result mean? (Maths for ML)
- A batch of 32 MNIST images goes into a dense layer with 128 units. What are the shapes, and what is the rule for when two matrices can be multiplied? (Maths for ML)
- A disease affects 1% of people. A test catches 90% of sick people (sensitivity) and wrongly flags 9% of healthy people (false positive rate). You test positive. What is the chance you are sick? (Maths for ML)
- Why do we not use mean squared error for classification with a sigmoid output? Compare the gradients numerically. (Maths for ML)
- Compute scaled dot-product attention by hand for two tokens with d_k = 2. (Maths for ML)