Top 5 Access control Interview Questions
Browse 5 real-world technical and behavioral interview questions about Access control. Review scenarios, edge cases, and architectural best practices.
A customer reports seeing another company's records in your admin console. Walk me through the first hour, and then tell me what you change so this class of bug cannot happen again.
Treat it as a confirmed breach until proven otherwise: preserve logs, scope who saw what, and start the disclosure clock alongside the investigation. The cause is almost always tenant scoping living in application code, where one forgotten filter leaks everything - so move enforcement below the code, to row-level security.
A release goes out and afterwards users can see records they were never entitled to. How would you find out, and how long would it take?
Entitlements change through deployment paths that no access review inspects, so the only reliable detection is a snapshot of effective permissions diffed on every release, with the diff cleared by someone who did not ship it.
How do you design a system so an auditor can prove who accessed a record and why?
You need a purpose-built audit trail, not application logs: guaranteed-capture, append-only records of actor, subject identifier, action, server time, outcome and stated purpose, made tamper-evident by hash chaining and anchored write-only storage, and held where whoever can change the data cannot change its record. It also connects access control to the point an interviewer is testing.
What metadata do you store alongside each chunk, and what is each field for?
Each chunk needs its source document and version, its section path, an anchor precise enough to open, effective and ingestion dates, and the permission set that governed the original — because filtering, citation, freshness and access control are all served from metadata rather than from the vector.
How would you know if a clinician had opened the record of a patient they were not caring for?
Role-based access permits this by design, so the control cannot be authorisation alone. You need a recorded relationship between clinician and patient, a break-glass path that costs something to use, read events in the audit log, and someone whose job is to review the exceptions.