Senior interview questionAsked at Google · interview write-up
Design a scalable service where an AI agent plans work and calls approved tools without ever bypassing deterministic controls. Cover prompt injection, approvals, budgets and loop termination.
Model answer
The model proposes; deterministic code decides. Every tool call passes a policy layer the model can't change: a tool allowlist, argument schemas, the user's own permissions, and rate and spend limits. Irreversible or high-value actions need human approval, bound to the exact arguments shown.
Scroll sideways to see the whole diagram
A model can be trained to rank instructions by where they come from, so a tool output loses to the system prompt.
Text version
- A model can be trained to rank instructions by where they come from, so a tool output loses to the system prompt.
- The prompt can name what is off-limits and mark untrusted text as data. Both rely on the model complying.
- System-level defences don't depend on the model: a tool it doesn't have can't be misused, and a send that needs approval can be declined.
- Layers reduce risk; none removes it. Plan for an attack that gets through.
Levels from AI Engineering, Ch. 5, "Defenses Against Prompt Attacks"; measures from OWASP LLM01:2025.
Tool outputs are untrusted: they can't grant permissions, and sensitive data can't reach outbound tools. Loops end at step, token and time budgets, or on repeated actions. Scale with stateless workers over a durable task queue, logging every step for audit and replay.
Practise the rest
8 Tools & constraints questions, 492 in all, each with a model answer. Free.
More from Google interview questions.
More Tools & constraints interview questions
- In tool calling, who executes the tool, and what does the model need in order to use the result?
- The model keeps calling search_orders for refund questions that another tool handles. What do you change first?
- Explain one step of constrained sampling. What does it guarantee, and what doesn't it?
- Your agent has a delete_records tool. What has to happen between the model emitting a call and the delete running?
- Should you turn on grammar-constrained decoding for every structured output? What would you watch?
- Implement a client that spreads LLM calls across several providers, respecting their rate limits and failing over when one is down.