Security & Privacy
Defend against injection, data exposure, and excessive agency.
Contain prompt injection, prove that a context selector cannot leak data, and threat-model an agent that can reach private systems.
3 questions
Questions
Easy
1.5 h
Explain why a retrieved document cannot grant itself authority, and name the controls in trusted code that still hold when the model follows an injected instruction.
Medium
3 h
Implement a context selector that enforces tenant, group, and deletion rules before ranking, then design tests proving that forbidden records and internal notes never reach the model-bound payload.
Hard
4 h
Threat-model a multi-tenant assistant that reads private documents, keeps conversation summaries, and sends approved notifications, naming where each control is enforced and what risk remains.
What you will be able to do
- Identify direct and indirect prompt injection and where untrusted content enters
- Map the assets and trust boundaries of a private-document assistant
- Distinguish authentication from authorization, and derive both from trusted context
- Explain data minimization and why redaction is only one layer
- Describe why model instructions cannot replace access checks or executor policy
- Implement a context selector that takes access from trusted identity and enforces tenant, group, and deletion rules before ranking
- Project only the fields a task needs, so internal notes never reach the model
- Test the serialized model-bound payload, including retries, fallbacks, and external rerankers, not only the selector's return value
- Design revocation, cache, and injection fixtures with different principals and known marker provenance
Hands-on exercises
Interview rounds that use this topic
Topic boundaries
This topic covers technical attack and exposure controls. Responsible AI & Governance covers oversight, impact, and release accountability.
Related on CodeSnatch
System Design
Separates who the caller is from what they may do, and covers multi-tenant isolation that every question here relies on.
Practice problem
Practice the ordered tenant, deletion, revision, and department checks that decide what retrieval may pass to a model.
AI Engineering
Builds the executor side of the boundary: model-proposed arguments checked, tenant taken from trusted context.
System Design
Maps the OWASP Top 10, SSRF, secrets handling, least privilege, and incident response to concrete controls.
System Design
Covers data classification, retention, and erasure across backups, logs, and caches for the privacy half of this topic.
Code snippet
Shows how to render untrusted text safely as HTML and when an allowlist sanitizer is the better tool.
AI Engineering
Applies the same trust boundary to coding assistants, where files and tool results also carry instructions.
Community article
Compares role, attribute, and relationship models for writing the access rules a retriever or executor enforces.
Community snippet
A redacting logger that keeps tokens and private fields out of the logs an AI feature writes on every request.