50 AI Agents Interview Questions and Answers for Developers

Check whether conversation state, execution checkpoints, and tool-operation identifiers are stored only in replica-local memory. Requests routed to different replicas may lose prior context or observe inconsistent workflow progress if shared state is not durable and coordinated. For example, an agent may repeat an external operation when the next request reaches a replica that lacks the original completion record. Use shared persistent storage where necessary, enforce concurrency controls, and trace requests using stable task identifiers across replicas.

Construct an explicit dependency graph and execute independent read-only operations concurrently when their consistency requirements permit it. Keep the destructive operation behind verified prerequisites, authorization checks, and any required human approval. Do not assume all tools are safe to parallelize. For example, an agent may fetch inventory and pricing concurrently but must verify the final order state before cancelling an existing reservation. Use deadlines, cancellation propagation, and deterministic aggregation of results. Shared-state mutations require synchronization or transactional coordination to avoid race conditions.

Treat the plan as a revisable execution hypothesis rather than an immutable script. After each meaningful observation, evaluate whether remaining steps still satisfy their prerequisites and whether the original objective remains achievable. For example, a travel-booking agent may plan a hotel reservation after selecting a flight, but a failed flight booking should invalidate dependent hotel actions. Replanning should preserve completed side effects, approval boundaries, and the remaining budget. Avoid restarting blindly because already executed operations may not be reversible.

Define progress using observable task-state changes and verified subgoal completion rather than relying on the number or diversity of tool calls. Track evidence gained, unresolved requirements, completed outputs, and whether new observations materially change the agent's decision state. For example, repeatedly searching different keywords that return the same documents should not count as progress toward finding a missing contract clause. Use semantic result deduplication, bounded exploration, and explicit escalation conditions. A progress detector should tolerate legitimate iterative searches without allowing indefinite activity.

Investigate whether retrieval filters, cache keys, storage partitions, or authorization checks failed to enforce tenant and user boundaries. Reproduce the issue using isolated test identities and inspect retrieval requests, returned document ownership, and cache behavior without unnecessarily exposing sensitive content. For example, a vector search restricted only by semantic similarity may retrieve another tenant's stored preferences if tenant filtering is missing. Enforce access control in the retrieval service, use scoped cache keys, and test cross-tenant isolation. Treat the incident as a potential data exposure requiring appropriate response procedures.

Preserve document provenance, timestamps, units, and authority levels, then reconcile conflicting figures before using them in calculations. Prefer authoritative structured sources where available, and apply explicit rules for reporting periods, currencies, and document versions. For example, an annual report and a quarterly update may contain different revenue values because they describe different periods rather than contradictory facts. If reconciliation fails, report the disagreement and avoid presenting a single unsupported figure. Evaluate both evidence selection and downstream calculations.

Use a transactional outbox or equivalent durable coordination mechanism so the database change and intent to publish are committed together. A separate publisher delivers pending events, while consumers handle duplicate deliveries using stable event identifiers and idempotent processing. For example, an agent marking an order as cancelled should atomically store the cancellation and an event record before an asynchronous worker publishes the notification. This design provides recoverable delivery but does not automatically guarantee exactly-once external effects. Monitor pending events and reconcile failed deliveries.

Model the process as a durable saga with explicit operation states, compensating actions where feasible, and escalation paths for irreversible effects. Compensation is a new business operation, not a guaranteed rollback, so it may fail or require human intervention. For example, a travel agent that booked a flight and hotel but failed to reserve a vehicle may need to cancel earlier bookings according to refund policies. Record each confirmed outcome and compensation attempt. Recovery should preserve an accurate account of partial completion rather than claiming atomicity across unrelated external systems.

Introduce application-level operation identifiers and enforce uniqueness or conditional updates within the database transaction. For inserts, use a unique business-operation key. For updates, consider version checks or compare-and-set semantics to prevent stale writes. For example, a request to issue a refund can store a unique refundRequestId and reject another insert with the same identifier. After an ambiguous timeout, query the authoritative operation record before retrying. Safe retry design must account for concurrency, business semantics, and failures occurring after commit but before acknowledgment.

Treat model-proposed commands as untrusted execution requests and place command execution behind an independently enforced security boundary. Use isolated execution environments, narrowly scoped credentials, command or capability restrictions, resource limits, and approval for sensitive operations. For example, reading selected application logs may be allowed while modifying firewall rules or deleting production files requires separate authorization. Capture sanitized execution records and enforce network and filesystem restrictions. A prompt telling the agent to avoid dangerous commands is not a substitute for technical isolation.

Evaluate both the final outcome and the complete observable execution trajectory, including tool calls, authorization decisions, and state changes. Define independent safety invariants that fail the evaluation whenever prohibited operations occur, regardless of the final answer's accuracy. For example, a reporting agent that temporarily modifies customer records before generating a correct report must be classified as unsafe. Use isolated test environments with state-difference checks and production audit trails. Aggregate success rates should not conceal critical intermediate violations.

Avoid unrestricted shared-state writes by introducing explicit ownership, versioned updates, or a coordinating component that serializes conflicting mutations. Optimistic concurrency control can reject stale updates, while append-only events or isolated agent workspaces can preserve independent contributions. For example, a research agent and a drafting agent should publish separate artifacts or versioned state changes instead of replacing the same mutable document snapshot. Define merge rules and conflict-resolution behavior, and test concurrent execution. Adding agents without state coordination can reduce reliability even when individual agents work correctly.

Treat the MCP server's advertised tool schema as an interface description, not as authorization to execute every requested operation. The client application should authenticate the user, enforce file-level permissions, validate canonical paths, and require appropriate approval before invoking destructive actions. For example, an approved deletion should bind the exact file identifier and relevant parameters to the authorization decision. If the call times out, reconcile the file's state before retrying. Use trusted server configuration, scoped credentials, audit records, and explicit recovery rules. MCP interoperability does not replace application security or reliable execution design.