Top 6 Least privilege Interview Questions
Browse 6 real-world technical and behavioral interview questions about Least privilege. Review scenarios, edge cases, and architectural best practices.
A customer's API token turns up in a public repository. What do you do in the next hour, and what in your token design decides how bad this is?
The damage is fixed before the leak by three earlier decisions: whether the token can be revoked and how fast that takes effect, how narrowly it was scoped, and whether your audit trail can attribute actions to that specific credential rather than only to the tenant.
A maintenance script updates your permissions table and every user in one tenant can suddenly edit everything. What should have stopped that, and how would you have found out?
Permission data is as privileged as the code that reads it, so a bulk write to it needs the same review, staged rollout and reversibility as a deploy. Derive grants from a source of truth rather than stamping them, assert tenant invariants continuously, and know how long a cached decision keeps the mistake alive.
What is indirect prompt injection, and how would you defend an assistant that reads user-supplied documents?
Indirect prompt injection is when instructions hidden in content the model reads are followed as if they came from you. Instructions and data share one token sequence, so there is no complete fix and the defence is architectural: least-privilege tools, filtered output, and human approval for side effects. It also connects llm security to the point an interviewer is testing.
What does least privilege look like in practice, and what is separation of duties there to prevent?
Least privilege is a lifecycle problem rather than a grant: narrow entitlements, time-bound elevation instead of standing admin rights, and reviews that can revoke. Separation of duties exists to stop toxic combinations, where two individually reasonable permissions let one person both act and conceal it.
You are shipping an agent that can call tools. How do you stop it exfiltrating data?
Assume the agent's context can be manipulated and control the exits instead. Scope each tool to the least data it needs, resolve the caller's identity in the executor rather than from a model-supplied argument, treat generated arguments as hostile input, and allow-list egress destinations.
Your pipeline deploys using a long-lived cloud access key stored as a CI secret. What would you change and why?
Replace the stored key with OIDC federation so each job exchanges a short-lived signed token for temporary credentials, then make the trust policy specific to a repository, branch or environment. Also narrow the pipeline's own token, pin third-party steps to commit SHAs, and attest what you built.