Top 10 Authorisation Interview Questions
Browse 10 real-world technical and behavioral interview questions about Authorisation. Review scenarios, edge cases, and architectural best practices.
You are handed 200 lines of AI-generated code in an interview and told some of it is exploitable. Where do you look first?
Start a secure code review of AI-generated code at the trust boundaries, not at line one. Find where untrusted input enters and where it reaches a query, a shell, a file path or an authorisation decision, then check what is missing between them as hard as what is present.
A maintenance script updates your permissions table and every user in one tenant can suddenly edit everything. What should have stopped that, and how would you have found out?
Permission data is as privileged as the code that reads it, so a bulk write to it needs the same review, staged rollout and reversibility as a deploy. Derive grants from a source of truth rather than stamping them, assert tenant invariants continuously, and know how long a cached decision keeps the mistake alive.
A user's access to a document set is revoked. What has to happen across your RAG stack?
Revoke once in the authorisation store, then propagate to the index ACLs, every cache holding text or results, any derived summaries and embeddings, and the conversation transcripts still carrying passages. Answers already delivered cannot be recalled, so the guarantee you offer is a bounded window rather than erasure.
Walk me through what happens between a customer tapping a card and the merchant getting paid.
Authorisation is a real-time reservation of funds by the issuer that moves no money; capture tells the acquirer to collect the amount; clearing exchanges those records through the scheme and nets what each bank owes; settlement is the interbank transfer, after which the acquirer funds the merchant on its own schedule.
How do you design the tools an agent calls?
Give each tool one narrow purpose with a self-describing schema, return failures as structured results the model can act on rather than raising, take an idempotency key on anything that mutates, and put validation and authorisation in the executor because arguments produced by a model are untrusted input.
How do you enforce per-user permissions in a retrieval system?
Carry the authorised principal set on every chunk and pass the user's principals into the search as a filter, so the candidate set is legal before ranking. Filtering after retrieval leaks through counts and gaps, and destroys recall for the users with the narrowest access.
Customers want per-project roles rather than one global role. How do you model that, and where in the request does the check happen?
Model permission as a relationship between a subject, a role and a specific resource, not as a role stamped on the user, and push the check down into the data access predicate so a list query and a single-record fetch are authorised by the same rule.
You added an authorisation policy to an ASP.NET Core endpoint and it is not being enforced. Where do you look?
The pipeline is an ordered list you assembled, and authorisation cannot decide anything before routing has selected an endpoint to decide about. Registered in the wrong order it either runs against nothing or never runs at all, and neither produces an error - the request simply succeeds.
When do you take the customer's money, and how much fraud are you willing to accept?
Authorise at checkout and capture when the goods leave, because an authorisation is a reversible hold and a capture is a refund waiting to happen; then set the fraud threshold from the full cost of a decline against the full cost of a chargeback, which usually means accepting more fraud than instinct suggests.
Your authorisation host is answering some requests and timing out on others. Who decides whether a card is approved while that is happening, and what do you inherit afterwards?
Card authorization stand-in processing decides what happens when the issuer host times out. Schemes, chips and terminals may approve within configured limits, leaving the issuer to reconcile advice messages and losses later.