The agent has real money authority and a write path into the system of record, which is the exact shape attackers want. The strong answer is layered enforcement outside the model, with the spend cap and the chain rule in code, not in the prompt.
Updated Sep 2026 · Grounded in real Forward Deployed Engineer interview loops and written to a senior-engineer editorial bar.
The agent has real money authority and a write path into the system of record, which is the exact shape attackers want. The strong answer is layered enforcement outside the model, with the spend cap and the chain rule in code, not in the prompt.
This is the question where 'instruct the agent to be careful' dies fastest, because the action is irreversible and costs money; the only passing answer puts the spend ceiling and the approval gate in the tool layer with the user's scoped credentials. Watch for the candidate who secures the user input and forgets that an inbound ticket body is untrusted content that reaches the same agent. The senior move is tiering by materiality and reversibility so automation survives, then proving the worst case is bounded to 'what this support rep could already do', which is the sentence a CISO signs off on.
No comments yet — be the first to share your approach.
