Question 5Cloud, deployment and security
The agent reads emails and web pages. How do you stop text in them from taking control of it?
Prompt injection is the main security risk of agents that act. They want concrete defences.
“Strong background in on-premise, private cloud, and multi-cloud environments (AWS, Azure, GCP), including experience with containerization and orchestration (Docker, Kubernetes).”Forward Deployed Engineer (AI Applications) · Seekr
The answerFour steps
- 1
Keep instructions separate from the content the agent reads
Say it like this
“Email and web text go in as marked, untrusted data, separate from instructions, and the task comes only from the user.”
Why it scores
Separates instructions from data, and admits that alone won't hold.
- 2
Give the agent only the tools and permissions the task needs
Say it like this
“The agent can read the CRM and draft emails, but it can't send, export contacts or fetch arbitrary URLs, which is how data gets out.”
Why it scores
Removes the tools that leak data, like sending and fetching URLs.
- 3
Require a person to approve actions that send, pay or delete
Say it like this
“Sending, paying or deleting waits for a person to approve, with the exact action shown.”
Why it scores
Shows the exact action, so the approver can spot a hijack.
- 4
Check outputs and log every tool call for review
Say it like this
“Every tool call is logged, we flag outputs with links or data the user didn't ask for, and we test with 50 known injection emails before launch.”
Why it scores
Logs and attack tests make the defence something you can check.
StrongAll together
About a minute, out loud. The marked parts are the four steps; hover one to find it above.
Say the agent triages a sales inbox: it looks up accounts, drafts replies, updates the CRM. Email and web text go in as marked, untrusted data, separate from instructions, and the task comes only from the user.1 That helps, but a clever email can still get through, so I plan for it. The agent can read the CRM and draft emails, but it can't send, export contacts or fetch arbitrary URLs, which is how data gets out.2 Sending, paying or deleting waits for a person to approve, with the exact action shown.3 Every tool call is logged, we flag outputs with links or data the user didn't ask for, and we test with 50 known injection emails before launch.4
WeakThe answer that fails
Sounds fine. Common. Scores low.
“I'd add a strong system prompt telling the agent to ignore any instructions it finds in emails or web pages, and run a classifier that detects injection attempts.”
Interviewer's note
Both can be bypassed. Nothing limits the damage when they fail, and the agent keeps every tool.
PracticeTwo minutes, then they push back
Your turn
The agent reads emails and web pages. How do you stop text in them from taking control of it?
Answer like you're in the room: about two minutes, no notes. Say it out loud, even alone. It feels different from thinking it. Then check your answer against what interviewers score.