Agentic AI Engineer interview questions

I would make task state durable and keep model and tool execution as replaceable, idempotent workers.

• Ten million tasks per month averages 3.9 per second, so I would capacity-test the measured hourly peak at 2 times headroom rather than size from the average.
• A workflow engine persists attempts, deadlines, budgets, leases, and typed events; workers may retry reads, but side effects require idempotency keys.
• Admission occurs only after identity and initial policy checks, quota and deadline reservation, and quorum acknowledgement of the durable task event; offered, rejected, and admitted load are reported separately.
• Every durably admitted task remains in the completion denominator, so later policy denial, degradation, or resource exhaustion counts as noncompletion; user cancellations follow one predeclared, separately reported rule.

I would separate recommendation from execution and place a deterministic transaction service behind a hard authorization boundary.

• The agent produces a typed transfer intent, but the service independently validates beneficiary, amount, currency, limits, sanctions result, and account ownership against fresh data.
• Every transfer needs a unique idempotency key and a signed approval bound to the exact intent hash; any field change invalidates approval.
• A dual-control gate applies above the institution's risk threshold, derived from fraud loss and regulation, while all new beneficiaries require out-of-band confirmation.
• Reconciliation compares bank acknowledgements with the side-effect ledger, and ambiguity enters manual investigation rather than an automatic retry.

I would expose task-oriented capabilities instead of letting the model compose raw APIs across all 20 systems.

• A tool gateway normalizes identity, schemas, timeouts, idempotency, and receipts, while search and mutation capabilities remain distinct.
• The agent may auto-run reversible reads and drafts; refunds, cancellations, and entitlement changes pass deterministic preconditions and risk-based approval.
• The mutation-opportunity denominator includes every account-changing intent reaching the deterministic decision boundary, including abstentions and denials; online receipts give provisional labels and delayed provider or human adjudication finalizes them.
• Promotion requires the one-sided 95% upper confidence bound on incorrect mutations to stay below 0.1% overall and by material risk slice after label maturity; pending and revised production labels are reported explicitly alongside the 10-minute SLO.

I would create an ephemeral repository-scoped workspace for each task and make tests and review evidence first-class outputs.

• A manifest pins commit SHA, build image, dependency caches, network policy, credentials, and allowed paths; cache keys include tenant and repository.
• Indexing is incremental by commit, but retrieved code and symbols are filtered before model context assembly to the authorized repository set.
• The agent works through bounded edit-test loops, publishes a patch plus command receipts, and cannot merge or push without a separate repository permission.
• Capacity tests run 650 mixed-language tasks and report queue time, sandbox startup, test time, patch acceptance, and leakage probes against the 20-minute SLO.

I would expand by capability and risk tier, not expose unrestricted desktop control to an arbitrary user percentage.

• Week one uses employees and read-only browser tasks; later cohorts unlock typed forms, then reversible writes, while payments and security settings stay blocked.
• A remote policy service constrains domains, UI actions, downloads, clipboard, and credentials, and a session recorder keeps screenshots plus action receipts.
• With zero severe events, a one-sided 95% upper bound below 1 per 100,000 needs roughly 300,000 representative independent sessions; slices and dependence increase the required effective sample, so deterministic forbidden-action tests remain separate gates.
• A server-side kill switch revokes the capability manifest and drains active sessions within 15 minutes, verified in every rollout stage.

I would separate MCP discovery and governance from the data plane that invokes each tool server.

• A signed catalog stores server identity, schemas, owners, scopes, data classes, risk tier, and compatibility versions; agents receive only authorized subsets.
• The gateway enforces authentication, policy, quotas, deadlines, and trace propagation without translating away MCP error semantics.
• A custom signed catalog uses cached snapshots plus a separate emergency-deny channel; privileged routing fails closed when signature, clock, deny health, or maximum bundle age cannot be proven.
• The 650-tool suite is 30% above the current 500 for forecast growth and rolling-version overlap; 40 ms leaves measured network margin.

I would make every published tool version immutable and require explicit compatibility declarations before alias promotion.

• The registry stores input and output JSON Schema, side-effect class, auth scopes, timeout, owner, deprecation date, and implementation digest.
• Contract tests replay representative calls against old and new versions; removing fields or changing semantics requires a major version and consumer migration.
• Agents pin a registry snapshot per task, so a 24-hour workflow cannot see a different schema halfway through execution.
• Rollback moves a signed alias to the prior tested version, and a drill proves recovery under 10 minutes before daily deployment is allowed.

The runtime receives an internal one-call capability handle; provider OAuth tokens remain server-side under provider-defined TTL and audience semantics.

• The agent runtime receives an opaque grant handle, never a refresh token; the broker validates user, tenant, consent, scopes, audience, and tool intent.
• Incremental consent requests the narrow scope when needed, and high-risk actions bind a fresh user confirmation to the normalized call hash.
• The gateway enforces resource, tenant, audience, and replay on redemption; each provider must support exchange or revocation within five minutes, otherwise delegated actions fail closed.
• Cross-audience, replay, expired-consent, and confused-deputy tests are release gates for all 12 integrations.

I would put deterministic policy checks at every tool boundary and distribute signed policy bundles for local evaluation.

• Inputs include principal, tenant, agent version, tool, normalized arguments, data classification, risk tier, and prior approvals.
• Bundles have a 60-second critical TTL and an out-of-band deny stream; low-risk reads alone may use a declared longer last-known-good TTL.
• Missing identity, stale critical policy, or an unknown action fails closed, while low-risk reads may use a bounded last-known-good bundle.
• Critical decisions become unavailable after the freshness deadline; availability is reported separately for fresh-critical and last-known-good-eligible classes.

I would exchange attested workload identity and approved intent for a short-lived credential at the tool boundary.

• Strict allowlisted schemas reject secret-bearing values before prompt, event, or trace serialization; the model and telemetry receive only opaque grant handles, IDs, and reason codes.
• Regional stateless brokers verify tenant, tool, scope, policy, task lease, and revocation state, then inject audience-bound, single-task credentials directly into a protected adapter channel.
• Co-located policy snapshots and HSM-backed regional signers target p95 below 100 ms in named healthy regions, with latency measured from authenticated request to adapter receipt.
• If the broker, signer, policy freshness, or revocation check is unavailable, issuance and redemption fail closed; canary scanners remain defense in depth rather than the no-plaintext guarantee.

I would use disposable microVMs with separate profiles for code execution and browser interaction.

• Each run gets a fresh kernel boundary, read-only base image, capped CPU and memory, ephemeral disk, no host sockets, and a default-deny egress proxy.
• Browser sessions isolate profile, downloads, clipboard, extensions, and local network access; code sessions mount only declared inputs and an output directory.
• Images and browser builds are digest-pinned, scanned, and rotated, while syscall, DNS, file, and process events feed containment alerts.
• Startup below two seconds is gated on warm pools, but escape tests and tenant-crossing probes override the latency target.

Persist nondeterministic results as workflow events.

• A completed node records normalized input, manifest, model output, provider metadata, and validation; replay consumes it instead of calling the model.
• Only a missing terminal event creates a new attempt, and ambiguous effects first require provider idempotency or reconciliation.
• Deterministic migrators may reshape old state but never replace a recorded decision.

I would use an append-only event log as truth and periodic typed snapshots only as replay acceleration.

• Events carry task, sequence, schema version, command ID, actor, timestamps, and hashes; optimistic sequence checks prevent split-brain writers.
• An event is accepted after local quorum persistence, while cross-region replication lag is hard-capped at 30 seconds and admission pauses if that bound cannot be maintained, defining RPO at no more than 30 seconds.
• Snapshots are created at a measured replay-cost threshold, initially 200 events, and large artifacts use content-addressed references; neither snapshot cadence nor artifact copying defines RPO.
• Recovery drills restore sampled long tasks on fresh infrastructure and measure acknowledged-event loss separately from replay time, which must stay below five minutes.

I would assign each intended effect a stable identity before calling the external system.

• The ledger records normalized intent hash, tenant, principal, tool version, approval, idempotency key, attempt, status, and provider receipt.
• States distinguish prepared, dispatched, confirmed, rejected, and unknown; an unknown outcome blocks retry until exact provider reconciliation resolves it.
• The outbox closes database-to-queue atomicity, not database-to-third-party atomicity; every money, message, or data mutation is eligible only with native provider idempotency or exact read-after-write reconciliation by stable business key.
• Duplicate rate is measured by semantic effect over all covered mutations, not HTTP attempts; providers lacking both mechanisms cannot serve any covered effect.

Treat override as a scoped, expiring policy artifact.

• Bind reviewer, case, intent hash, denied rule, rationale, effect limit, expiry, and second approval; dispatch rechecks current state.
• Audit the original decision and outcome; changed arguments require reapproval.
• Training keeps it as an exception until policy owners independently adjudicate a rule change.

I would require every mutable tool to declare its forward effect, idempotency behavior, reversibility class, and tested compensation.

• Fully reversible calls expose a versioned undo command; conditionally reversible calls state expiry and preconditions; irreversible calls require approval before dispatch.
• A saga records completed effects and executes compensations in reverse dependency order, each with its own idempotency key and receipt.
• Compensation failure pauses the workflow and pages the owning team instead of asking the model to improvise another mutation.
• The 30-minute recovery gate applies only to tool chains whose worst-case compensation timing has passed fault-injection tests.

I would treat generated code as an untrusted proposal that can request review but can never publish or authorize itself.

• Each proposal records source, generating agent and task, input provenance, reproducible build, schemas, requested scopes, data classes, network destinations, side-effect class, owner, and expiry; a hermetic builder produces the artifact digest.
• Automated tests and an independent reviewer approve the exact digest and capability manifest; the registry and credential broker accept signatures only from principals unavailable to the proposing agent.
• The signed artifact runs in a default-deny sandbox, and every call still passes the policy gateway with task-scoped credentials; expiry removes the temporary alias, while active tasks remain pinned to an auditable version.
• Activation p95 is measured from final approval to catalog visibility, excluding review time; an emergency deny revokes routing and new credentials within five minutes, and rollback restores the prior signed artifact while preserving proposal, review, and execution receipts.

I would represent the task as milestones that expand into small executable subplans only when their prerequisites are ready.

• The top level holds objectives, acceptance tests, budgets, and dependencies; leaf plans stay near 5 to 10 steps so failure does not invalidate 100 decisions.
• Each completed leaf emits structured findings, provenance, and unresolved questions into durable state rather than appending raw history.
• A deterministic packer orders evidence by declared priority, deduplicates it, and counts system text, user input, summaries, retrieved evidence, selected tool schemas, and reserved output tokens against a hard 32,000-token limit for every call.
• Critical-path branches run in parallel only within shared tool, token, and two-hour budgets; if the packed call cannot fit without dropping required evidence or output reserve, it fails validation instead of truncating implicitly.

I would use a supervisor over capability-scoped specialists, not a fully connected conversation among 30 agents.

• A router selects at most the few roles justified by case type, and each role has distinct tools, data scope, output schema, and budget.
• Specialists exchange signed artifacts through workflow state rather than free-form peer messages, limiting prompt growth and spoofed authority.
• The action service derives approver and executor from distinct principals with non-overlapping grants, rejects the same principal or credential controller in both positions, and prevents the supervisor from reassigning credentials or minting approval authority.
• Replay tests measure routing accuracy, handoff count, latency, conflicts, and attempted separation-of-duties bypass before adding a role.

I would make the blackboard typed, tenant-partitioned workflow state rather than a shared natural-language document.

• Entries declare owner, schema, task scope, provenance, version, expiry, and read-write capability; authorization runs before query or subscription.
• Compare-and-swap versions prevent agents from silently overwriting one another, and append-only findings preserve competing hypotheses.
• Ordering is per tenant-task partition; the one-second SLO covers healthy named regions, while partitioned writes fail or queue and reads expose staleness.
• Tenant-isolation tests, stale-write conflicts, and poisoning fixtures gate each schema before agents may consume it automatically.