You review an async service method that calls a database and external API but does not accept a CancellationToken. What feedback would you give?

public async Task<CustomerSummary> BuildSummaryAsync(Guid customerId, CancellationToken ct)
{
    var customer = await _db.Customers.SingleAsync(x => x.Id == customerId, ct);
    var risk = await _riskClient.GetRiskAsync(customer.Id, ct);
    return CustomerSummary.From(customer, risk);
}

The token travels through the service boundary into the actual I/O calls.

• Where should the token originate in ASP.NET Core?
• When would you not honor cancellation immediately?
• How do provider timeouts differ from cancellation?
• What is wrong with passing CancellationToken.None everywhere?

Look for code-review communication plus production reasoning. Senior candidates talk about propagation, dependencies, and commit boundaries.

This checks whether the candidate can improve code quality through review and explain why the change matters operationally.