Topic 9: AI Security & Guardrails interview questions

AI guardrails are controls that constrain, monitor, or verify model behavior and the actions around it. They can include input screening, access control, prompt and output validation, tool permissions, human approval, rate limits, and audit logs. They are needed because models are probabilistic and can be manipulated, hallucinate, leak sensitive information, or invoke tools incorrectly. Good guardrails are layered and tied to concrete risks; a system prompt alone is not a dependable security boundary. Interview signal: Use guardrails as layered enforcement around inputs, retrieval, tools, outputs, and operations—not as a magical prompt.

I would map assets, users, model providers, tools, data stores, trust boundaries, and actions that can affect the outside world. Then I would enumerate threats such as prompt injection, sensitive-data leakage, excessive agency, insecure plugins, supply-chain compromise, denial of service, model theft, and tenant isolation failures. For each threat, I would identify preventive controls, detection signals, recovery steps, and tests. I would prioritize risks by impact and likelihood, especially irreversible or privacy-sensitive actions. Interview signal: Threat-model actors, assets, trust boundaries, abuse cases, impact, likelihood, and concrete mitigations before choosing controls.

Prompt injection occurs when untrusted text attempts to override instructions or manipulate a model into revealing data or taking an unintended action. It can appear in user input, retrieved documents, web pages, emails, images, or tool results. Mitigation is layered: separate instructions from data, minimize exposed context, use least-privilege tools, validate arguments in code, require approval for sensitive actions, and treat model output as untrusted. Testing should include direct, indirect, encoded, and multilingual attacks. Interview signal: Distinguish direct and indirect injection, then enforce tool authorization and data boundaries independently of model instructions.

First, I classify the data and decide whether the task needs the sensitive fields at all. I minimize, redact, tokenize, or mask values before sending prompts, and enforce tenant-aware authorization before retrieval. I verify provider retention and training settings, encrypt data in transit and at rest, restrict logs, and define deletion periods. Outputs also need scanning because a model may reproduce secrets. Access should be auditable, and sensitive workflows should have a tested incident-response process. Interview signal: Classify, minimize, redact, encrypt, retain, and audit sensitive fields before they enter prompts, retrieval, or traces.

Least privilege means an agent receives only the identity, data, tools, permissions, and time it needs for its current task. A read-only research agent should not have email, payment, shell, or database-write access. Permissions should be scoped by user, tenant, object, operation, and environment, with short-lived credentials where possible. I would enforce policy in the tool or service itself, not only in the agent prompt, and require explicit confirmation for high-impact actions. Interview signal: Apply least privilege to tools, records, fields, destinations, rate, and time; a broad read token is still excessive agency.

Tool calls should pass through deterministic validation before execution. I would use typed schemas, allowlists, length and range limits, canonicalization, authentication, authorization, timeouts, and bounded output sizes. The server should validate again even if the client already did so. Destructive, external, or financial operations need user confirmation bound to the exact arguments. Tools should be narrow and purpose-specific rather than exposing arbitrary shell commands, unrestricted SQL, or generic HTTP requests. Interview signal: Validate tool schema, identity, authorization, target, side effect, idempotency, and approval before execution.

I limit the agent’s action space, iteration count, budget, runtime, and accessible resources. Read and write capabilities are separated, and irreversible actions require a human checkpoint. The agent should explain the proposed action and target before execution, while the application verifies policy independently. I also add loop detection, idempotency keys, rate limits, cancellation, and audit events. The design goal is bounded assistance: the agent can complete useful steps without silently expanding its own authority. Interview signal: Use budgets, step limits, allowlists, sandboxing, confirmation, and a kill switch to constrain autonomous behavior.

Defense in depth means no single control is trusted to handle every failure. For an AI workflow, layers might include identity and tenant authorization, input limits, retrieval filtering, isolated tool execution, output validation, human approval, monitoring, and rapid credential revocation. If a prompt filter misses an attack, the tool policy should still block it; if output validation fails, the user should receive a safe error. Layered controls reduce blast radius when any probabilistic or implementation-level defense fails. Interview signal: Show defense in depth across identity, network, retrieval, model, tool, output, monitoring, and incident response layers.

I would first classify the output by consequence. For low-risk drafting, I can label uncertainty and let the user edit it. For factual or high-impact tasks, I would ground responses in approved sources, require citations or evidence, validate structured fields, and route ambiguous cases to review. The system should avoid presenting guesses as facts and should have a safe fallback when confidence or evidence is insufficient. Evaluation must measure both ordinary accuracy and harmful confident errors. Interview signal: Route unsupported or high-risk output to abstention, verification, or human review instead of silently polishing it.

I enforce document-level authorization before retrieval and filter by tenant, user, and data classification. Documents are treated as untrusted data, so embedded instructions cannot change application policy. I use trusted source metadata, bounded chunks, relevance checks, citation tracking, and output validation. Retrieval logs should record identifiers without unnecessarily storing sensitive text. I also test poisoned documents, conflicting sources, stale data, prompt injection, and requests for information the user is not allowed to access. Interview signal: Filter retrieval by identity and provenance, label content as untrusted, check citations, and test poisoning and leakage.

Risks include malicious or tampered model weights, unsafe adapters, poisoned training data, compromised packages, vulnerable serving runtimes, and unclear licensing or provenance. I would pin and verify dependencies, obtain models from trusted sources, record hashes and licenses, scan artifacts, isolate loading and execution, and test behavior before promotion. Model provenance should be part of release metadata. Updates need regression, safety, and performance evaluations because a new artifact can change both capability and risk. Interview signal: Track model, adapter, dependency, data, license, hash, and runtime provenance; test artifacts before promotion.

Secrets belong in a managed secret store or protected runtime configuration, never in prompts, repositories, model context, client-side code, or ordinary logs. Credentials should be scoped to one service and operation, rotated, monitored, and revoked quickly. I would prevent tools from reading arbitrary environment variables or filesystem paths. Logs and traces need redaction tests. If a model outputs a possible secret, the application should block or sanitize it and trigger an appropriate security signal. Interview signal: Keep secrets in managed stores with scoped credentials, rotation, redacted logs, and no model-visible environment access.

Output validation checks that a model response conforms to the application’s required type, schema, constraints, and safety rules before it is displayed or used. For example, an invoice extractor should validate dates, currencies, required fields, and confidence handling; an agent action should validate its target and allowed operation. Structured output helps but does not guarantee correctness. Invalid or suspicious responses should be rejected, repaired under strict limits, or sent to a human rather than executed blindly. Interview signal: Use schemas for shape, then apply semantic, authorization, range, and business-rule validation outside the model.

Rate limits reduce abuse, runaway costs, denial of service, credential testing, and accidental agent loops. I would apply limits at several dimensions: user, tenant, IP, API key, model, tool, tokens, concurrency, and spend. Expensive operations need stricter budgets than simple classification. Responses should distinguish temporary overload from permanent denial and provide safe retry guidance. Limits must be observable and tested under legitimate bursts so security controls do not unnecessarily block normal users. Interview signal: Rate-limit by identity, tenant, IP, tokens, concurrency, tool, and spend, while testing legitimate burst behavior.

I would log structured security events such as authentication failures, denied tool calls, policy violations, unusual retrieval volume, prompt-injection detections, large exports, repeated validation failures, and unexpected destinations. Metrics should include latency, token usage, error rates, refusal rates, and spend anomalies, with sensitive content minimized or redacted. Alerts need thresholds and context to avoid noise. I would preserve request correlation identifiers so an investigation can connect user intent, model output, tool decisions, and side effects. Interview signal: Monitor denied actions, injection signals, unusual retrieval, exports, validation failures, spend, and correlated traces.

The plan should define how to detect, triage, contain, investigate, recover, and learn from incidents. It should include contacts, severity levels, credential revocation, tool or model disablement, tenant isolation, evidence preservation, user communication, and a degraded safe mode. Runbooks should cover leaked data, malicious tool use, model compromise, runaway spend, and provider outage. After containment, I would identify the control failure, add regression tests, rotate affected secrets, and update the threat model. Interview signal: Prepare containment, credential revocation, tool disablement, evidence preservation, notification, recovery, and regression steps.

I make controls proportional to risk and explain them in user-facing language. Low-risk reads can be fast, while irreversible or sensitive actions show the exact target, effect, and approval request. I avoid vague blocks by giving a safe alternative or a clear recovery path. Progressive permission, sensible defaults, caching, and good error messages reduce friction. I measure completion, abandonment, false positives, and security outcomes together, because an unusable control will eventually be bypassed. Interview signal: Make approval proportional: show exact effect and evidence for risky writes while keeping low-risk reads usable.

Approval should happen after the system has validated the action and before the side effect. The reviewer should see the tool, target, arguments, expected consequence, relevant evidence, and any uncertainty. Approval must bind to that exact request, expire quickly, and not be reusable for different parameters. I would record who approved, when, and what executed. For high-volume low-risk tasks, policy-based approval can be appropriate, but exceptions and irreversible operations still need stronger review. Interview signal: Bind approval to exact arguments and expiry, record reviewer identity, and prevent replay against a different target.

I combine unit tests for policy functions, integration tests at tool and retrieval boundaries, adversarial evaluations, dependency scanning, and operational drills. Cases should include prompt injection, data exfiltration, cross-tenant access, malformed schemas, path traversal, SSRF, oversized inputs, tool loops, leaked credentials, and denied approvals. I measure false positives as well as blocked attacks. Tests should run against the actual model, prompts, runtime, and configuration used for release, because small changes can alter behavior. Interview signal: Combine unit, integration, adversarial, dependency, runtime, and incident-drill tests; measure false positives too.

I verify data classification, retention, provider terms, authentication, tenant authorization, secret handling, input and output limits, tool scopes, approval paths, logging redaction, rate limits, dependency and model provenance, abuse monitoring, and incident runbooks. Then I run representative quality and adversarial evaluations, test failure recovery, and confirm that disabling the model or a tool leaves a safe degraded experience. Finally, I document known limitations and assign owners for alerts, policy changes, and future reviews. Interview signal: Close with a launch checklist and named owners for alerts, policies, data retention, provider changes, and incident response.