Question 1

Your team calls every LLM workflow an agent. How do you distinguish a genuinely agentic system from a deterministic chain, and when would you deliberately choose the chain?

Accepted Answer

A genuinely agentic system chooses actions at runtime from a goal, state, and observations; a deterministic chain follows a planned control flow. I would choose the chain when the task is bounded and side effects, latency, cost, and auditability matter more than open-ended adaptation.

Question 2

In Google ADK, an agent has search, database, ticketing, and deployment tools with overlapping capabilities. How would you design their schemas and descriptions, route requests, validate arguments, handle parallel calls, and stop the model from choosing a privileged tool unnecessarily?

Accepted Answer

Give each tool a narrow, explicit contract and expose it only to the agent that needs it. Route requests by capability, validate both schema and authorization at the tool boundary, parallelize only independent read operations, and keep deployment behind a separate approval and least-privilege gate.

Question 3

In Google ADK, how would you model a workflow that validates input, performs independent lookups in parallel, combines the results, and retries a bounded enrichment loop? How should state and failures move between those steps?

Accepted Answer

Use a SequentialAgent to enforce validation, fan out independent work through a ParallelAgent, join it with a combiner, and finish with a LoopAgent whose maxiterations bounds enrichment attempts. Pass results through explicit session-state keys, use unique keys for parallel branches, and represent expected failures as structured data while letting unrecoverable errors stop the run.

Question 4

When should an agent act immediately, ask a clarifying question, preview a proposed action, or require explicit confirmation? Design the interaction for a task where mistakes are costly but excessive interruptions would make users abandon the agent.

Accepted Answer

Act immediately for clear, low-risk, reversible work; clarify only when ambiguity could change the result; preview meaningful plans so users can inspect them; and require explicit confirmation before irreversible or high-blast-radius actions. Batch routine actions and use bounded standing authorization to avoid turning the agent into a permission pop-up.

Question 5

In a LangGraph workflow, how would you pause before an irreversible action, present the human with enough context to make a decision, resume safely after approval, and handle rejection, timeout, or a stale approval?

Accepted Answer

Pause with LangGraph interrupt immediately before the side effect, persist the run with a checkpointer, and show a structured request tied to a request ID, version, and expiry. Resume the same thread with Command(resume=...), then revalidate the request and use an idempotent, conditionally accepted action; rejection, timeout, and stale approvals become explicit terminal or re-review outcomes.

Question 6

A model repeatedly emits malformed arguments and occasionally calls the wrong tool. What would you include in a tool contract and execution layer to make tool use reliable without relying on the model to behave perfectly?

Accepted Answer

Treat every model tool call as untrusted input: define strict input and output schemas, then validate, authorize, apply business policy, execute with timeouts and idempotency, and return structured errors. Use bounded repair for malformed arguments, but require clarification or confirmation when the selected operation is unsafe or semantically wrong.

Question 7

What should block a deployment of an agent when the change is only a prompt, tool description, model version, or policy configuration? Design a CI/CD process that covers replay tests, safety tests, canaries, rollback, and evaluator drift.

Accepted Answer

Block on any critical safety or authorization failure, contract violation, unacceptable replay regression, or canary breach of latency, cost, or business SLOs, regardless of whether the diff is code. Ship every behavioral dependency as a versioned artifact, test it against replay and adversarial suites, canary it behind enforceable controls, and keep the previous bundle one switch away.

Question 8

Design a retrieval pipeline for an agent that answers questions over PDFs, internal documents, and changing web content. How would parsing, chunking, metadata, retrieval, citations, freshness, and untrusted document instructions work together?

Accepted Answer

Build a versioned ingestion pipeline that preserves document structure, permissions, timestamps, and page-level provenance, then use ACL-filtered hybrid retrieval and reranking at query time. The agent should generate only from retrieved evidence, cite exact pages or URLs, distinguish document instructions from system instructions, and refresh or invalidate content according to its source and volatility.

Question 9

You are deploying a Google ADK agent with bursty traffic, long-running tasks, private network access, and a requirement for operational control. How would you choose among Agent Engine, Cloud Run, and GKE, and what would you do about state, scaling, and observability?

Accepted Answer

I would usually start with Cloud Run for the stateless ADK API, a durable queue for long-running work, and external durable stores for sessions and job state. I would choose Agent Engine for the least operational burden, or GKE when private networking, custom workers, or node-level control are hard requirements.

Question 10

For a task with uncertain steps, occasional tool failures, and a strict latency budget, how would you choose between ReAct, Plan-Execute, and Reflexion? What evidence would cause you to change the pattern later?

Accepted Answer

I would start with bounded ReAct when the next step depends on live observations, but enforce hard limits on model turns, tool calls, and wall-clock time. I would move toward Plan-Execute when traces show stable, decomposable plans, and add Reflexion only when verified feedback shows that an extra critique-and-retry step pays for its latency.

Question 11

An itinerary agent needs to call local inventory tools and delegate a hotel-search task to an independently owned agent. What belongs on MCP versus A2A, and how would you handle capability discovery, task state, streaming, and errors across the boundary?

Accepted Answer

Put local inventory operations behind MCP and delegate the independently owned hotel search through A2A. Discover MCP tools through initialization and tool listing, discover the remote agent through its Agent Card, then persist A2A task identifiers, stream when supported, and distinguish transport, protocol, and business errors.

Question 12

Your agent reads emails and web pages that may contain instructions addressed to the model. Walk through the controls you would use to keep those instructions from changing the agent's goals or authorizing privileged actions.

Accepted Answer

Treat email and web content as untrusted data, not authority. Enforce the boundary with least-privilege, short-lived tool permissions, server-side authorization, sandboxing, output and egress controls, and human approval for consequential actions.

Question 13

An agent has a 30-second p95 latency target and a fixed cost per request, but it sometimes enters long tool loops. What controls would you use for budgeting, model routing, caching, parallelism, context growth, and graceful degradation?

Accepted Answer

Use hard per-request time, tool-call, token, and cost budgets enforced by the runtime, with bounded loops and an internal deadline below 30 seconds. Route simple work to cheaper models, cache only safe reads, parallelize independent calls with concurrency limits, compact context, and return an honest partial result when the budget runs out.

Question 14

An agent can issue refunds, modify production configuration, and send external messages. Where would you enforce policy, approvals, rate limits, and human confirmation, and how would you keep the model from bypassing those controls through another tool?

Accepted Answer

Enforce controls in a server-side tool gateway and again in the systems that perform the side effect, never in the prompt or model. Bind approvals and confirmations to the exact action, apply rate limits to the actor and resource, and give every tool—including indirect tools—the same least-privilege, policy-checked route.

Question 15

An MCP server publishes a harmless-looking tool description, but its instructions tell the agent to upload conversation data. How would you detect and mitigate tool poisoning, tool shadowing, and a later malicious tool update?

Accepted Answer

Treat MCP tool metadata as untrusted prompt-injection input, not as authorization. Pin and review server identities and tool manifests, namespace tools to prevent collisions, enforce least-privilege data and network policies at runtime, and revalidate every material update.

Question 16

What belongs in the harness around a coding agent rather than in the model prompt? Explain how you would implement workspace isolation, patch application, test execution, permissions, checkpoints, stopping conditions, and audit logs.

Accepted Answer

The prompt supplies intent, context, and acceptance criteria; the harness enforces isolation, permissions, execution, validation, rollback, stopping rules, and auditability. Anything that must remain true when the model is confused or malicious belongs in the harness, not in prose.

Question 17

How would you evaluate a customer-support agent when exact text matching is useless? Describe the task set, success criteria, trajectory checks, safety checks, human review, and how you would handle nondeterminism.

Accepted Answer

Evaluate the agent against state-based outcomes and policy constraints, not a reference reply: use a stratified task suite, inspect tool-use trajectories, enforce safety gates, and add calibrated human review. Repeat each case under controlled conditions and report task-level success rates, failure types, and uncertainty rather than trusting one run or one LLM judge.

Question 18

Design a production agent that receives a customer request, plans work, calls internal tools, asks for approval before high-impact actions, and can recover from failures. What components and boundaries would you put around the model?

Accepted Answer

Put the model inside a durable workflow, not in charge of the workflow. Let it propose typed, allowlisted tool calls, while deterministic policy, authorization, approval, execution, retry, and audit layers control every side effect.

Question 19

For a personal productivity agent, what would you store as working, episodic, and semantic memory? How would you decide when to write or forget memories, and how would you prevent stale or malicious memories from influencing future actions?

Accepted Answer

I would keep short-lived working context for the current task, timestamped episodic records for useful past events, and carefully validated semantic facts for durable preferences and constraints. Memories need explicit write criteria, expiry and deletion rules, provenance, conflict checks, and isolation from tool authorization so stale or malicious text cannot silently drive actions.

Question 20

A multi-agent system produces confident but contradictory reports, repeats work, and sometimes reaches a wrong consensus. How would you determine whether the problem is decomposition, communication, incentives, aggregation, or evaluation, and when would you replace it with a single agent?

Accepted Answer

I would instrument the system, establish a labeled baseline, and run controlled ablations that change one coordination mechanism at a time. I would replace the multi-agent design when the work is tightly coupled, errors are correlated, and coordination costs more than it contributes; a single agent with tools and explicit validation is often the more reliable system.

Question 21

You are building a support agent that may work on a case for several hours. How would you decide what belongs in the current context, what should be summarized, and what should be retrieved on demand?

Accepted Answer

Keep the active task, constraints, latest decisions, and immediately relevant tool results in the current context. Compress older history into a structured, source-linked summary, and retrieve exact or rarely needed material only when the next action requires it.

Question 22

A coding agent needs to access cloud resources, but you do not want the model or generated code to see reusable credentials. How would you implement credential-blind execution, and what would you log or revoke if you detected attempted exfiltration?

Accepted Answer

Run generated code in an ephemeral sandbox with no cloud credentials, metadata access, or unrestricted egress. Put cloud operations behind a policy-enforcing broker that holds the workload identity, and on exfiltration attempts terminate the run, revoke its capability and session, rotate any exposed secrets, and preserve redacted audit evidence.

Question 23

Your offline benchmark score improves after a model change, but production resolution rate falls. How would you investigate benchmark leakage, distribution shift, evaluator bias, and slice-level regressions before deciding whether to roll back?

Accepted Answer

I would freeze the rollout, verify the production metric and instrumentation, then compare old and new models on a clean recent sample while auditing leakage, distribution shift, evaluator bias, and slice regressions. I would roll back immediately for material safety or customer harm, but otherwise use the evidence to decide between rollback, targeted gating, or a corrected evaluation.

Question 24

An agent's self-reported confidence is poorly calibrated, yet it must decide whether to answer, ask a clarifying question, defer to a human, or take an action. How would you make that decision under uncertainty?

Accepted Answer

I would not threshold the agent's self-reported confidence. I would estimate outcome probabilities from task-specific evidence and historical results, then choose among answering, clarifying, escalating, or acting by expected loss, with hard safety and authorization constraints for consequential actions.

Question 25

A payment tool times out after charging a card, so the agent retries and may charge the customer twice. How would you design idempotency, timeout handling, reconciliation, and compensation for agent-driven side effects?

Accepted Answer

Give each business payment a durable idempotency key enforced by both the application and payment provider, and treat post-submission timeouts as unknown rather than failed. Retry status checks or the same operation only; reconcile unknown payments before compensating confirmed duplicates with an idempotent refund or void.

Question 26

In a LangGraph workflow, several parallel nodes update the same state and a process can be resumed from a checkpoint. How would you design reducers, checkpoint boundaries, and conflict handling so that the result is deterministic?

Accepted Answer

Use pure reducers whose result is independent of update order, checkpoint at replay-safe superstep boundaries, and handle collisions with disjoint keys or an explicit stable conflict policy rather than last-writer-wins.

Question 27

Your agent process crashes after a tool has completed but before the workflow records the result. When the worker restarts, how should durable execution determine what to replay, what to query, and what must never run twice?

Accepted Answer

Replay deterministic workflow code and any already-recorded tool results, but never blindly repeat an external side effect whose completion is ambiguous. Query the system of record using a stable operation ID, retry only through an idempotent boundary, and permanently protect non-idempotent effects from duplicate execution.

Question 28

An analysis agent can execute code through an MCP server on user-provided files. How would you isolate the execution, restrict network and filesystem access, enforce resource limits, handle secrets, and safely return generated artifacts?

Accepted Answer

Run every request in a fresh, least-privileged sandbox with default-deny networking, narrowly staged files, hard CPU, memory, process, disk, and time limits, and no platform secrets. Validate and quarantine outputs before returning them through an opaque artifact reference rather than exposing host paths or trusting generated files.

Question 29

You are asked to build a browser agent that can purchase items and update a CRM. What would you allow it to do autonomously, what would require confirmation, and how would you defend against visual prompt injection, wrong-page actions, and irreversible clicks?

Accepted Answer

Allow the agent to browse, compare, prepare carts, and make tightly bounded append-only CRM updates without approval. Require fresh, explicit confirmation for purchases and any customer-visible, destructive, financial, or otherwise irreversible action, with policy checks and state verification outside the model.

Question 30

You are choosing an agent runtime for a team that needs durable state, middleware, observability, streaming, and portability across model providers. How would you compare runtimes such as Agno and Mastra, and what proof-of-concept results would determine the choice?

Accepted Answer

I would run Agno and Mastra against the same failure-injected workflow and choose on measured durability, middleware behavior, trace completeness, streaming quality, provider portability, and operating cost. Mastra is a natural first candidate for a TypeScript team, while Agno is a strong first candidate for a Python team, but the proof of concept makes the decision.

Question 31

You have five specialist agents that can collaborate on a complex investigation. When would you use a supervisor, when would you use a swarm, and how would you prevent routing loops, duplicated work, and unbounded conversation?

Accepted Answer

Use a supervisor when the investigation has dependencies, needs a coherent final answer, or requires tight control. Use a swarm for genuinely exploratory peer-to-peer work, but bound both designs with explicit task ownership, deduplication keys, hop and turn limits, budgets, deadlines, and clear termination rules.

Question 32

A production agent is slow and occasionally takes an unsafe action. What would you capture in traces and metrics across model calls, retrieval, tool execution, state transitions, and approvals so that you can diagnose both problems without logging sensitive content indiscriminately?

Accepted Answer

Trace every agent run as a causal timeline with timed spans for model calls, retrieval, tools, state changes, and approvals. Capture bounded metadata, hashes, policy decisions, latency breakdowns, and safety outcomes rather than raw prompts, documents, or tool payloads, with durable restricted audit records for exceptional incidents.