permissions

A RAG pipeline is the obvious first sketch. A strong answer starts with permissions instead, because one leaked salary document ends the product.

Define what unread means, preserve edits and permissions, and make every action item traceable. The design must tell users when the summary covers only part of their inbox.

An incident question where the root cause is almost never 'the model made a mistake'. The interviewer wants containment first, honest communication, and a fix to the permission design that made deletion possible.

Security teams are usually right about agents, and the PM who treats them as an obstacle loses. Principal answers turn the CISO's concerns into requirements, then design a rollout the security team can sign.

A canceled chat stream leaves work running in three services. Define the user promise, reconcile actions already sent and test the race at the execution boundary.

Slack allowed permission-checked search and banned bulk export, indexing and training by outside apps. Decide what access serves customers, what protects them and what keeps your own AI features competitive.

The security question every agent PM must answer well. Anyone can send your user an email, which means anyone can put instructions in front of the model. The strong answer stops trying to make the model resist and limits what a fooled model can do.

Untrusted pages, private data and the ability to act or send are each manageable alone and dangerous together. Set a rule for combinations, then decide where a person must confirm.

Companies that shipped MCP servers exposed reads widely and held back money-moving actions. Start with a few consolidated read tools, test descriptions against real tasks, and gate anything irreversible.