Architecture scenarioHard~15 minAI Security, Privacy & Governance / 9 of 20

Interview question

How would you prevent an AI workflow from exfiltrating data through tools?

Constrains source-to-sink combinations with least privilege, egress policy, argument checks, approval, and information-flow awareness.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

I identify sensitive sources and external sinks, then prevent the model from freely combining them. A workflow that reads private documents does not automatically receive arbitrary HTTP, email, upload, or link-generation tools. Each outbound action validates destination, data classification, user authority, and purpose, with a clear preview and approval when sensitive data could leave its boundary.

Full answer below

Practice focus

Data exfiltration, tool policy, egress control, information flow, and consequential action review.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Overview
A read tool plus an outbound tool can form an exfiltration path even when each tool appears safe in isolation.
I identify sensitive sources and external sinks, then prevent the model from freely combining them. A workflow that reads private documents does not automatically receive arbitrary HTTP, email, upload, or link-generation tools. Each outbound action validates destination, data classification, user authority, and purpose, with a clear preview and approval when sensitive data could leave its boundary.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
Tool policy considers sequences, not only individual calls. Data labels and provenance follow retrieved values into summaries and generated arguments, while egress allowlists restrict domains, recipients, object stores, and network routes. Output limits, rate limits, and content checks reduce bulk leakage. A request to encode, compress, split, or hide content does not bypass the same information-flow decision.
Finish
Advanced answer
Optional deeper angle for production judgment and nuance.
High-risk workflows separate the component that can read secrets from the component that can communicate externally, exchanging only a narrow verified artifact. Short-lived credentials and scoped tool catalogs reduce the impact of model compromise. Detection looks for unusual source-to-sink paths, repeated small transfers, encoded payloads, new destinations, and plan drift without logging the full sensitive data. Incident controls can revoke egress authority and preserve read-only operation while investigators reconcile completed actions.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Approving tools independently without reviewing their composition.
Allowing arbitrary URLs from generated arguments.
Assuming small payloads cannot leak meaningful data.

Red flagsCandidateRed flagsSignals that an interviewer may treat as risky.Open details

Details

One model step sees private context and unrestricted network access.
The model can create its own external destination.
Encoded output bypasses data-loss controls.

Follow-up prompts

Quick interviewer prompts inside this drill.

Follow-up questionsCandidateFollow-up questionsLikely next questions after the main answer.Open details

Details

Treat these as the next interviewer turn. Answer one out loud, then save the gap in your practice notes.

What is a source-to-sink policy?
How would you handle a legitimate external recipient?
Why can two low-risk tools create a high-risk path?

Continue the section

Next in AI Security, Privacy & Governance: Secure RAG ingestion

Step 10 of 20

How would you secure RAG ingestion against poisoned content?

Practice route

Read core answer Review checklist Follow-up prompts Track progress

Finished this drill?

Practice freely. Sign in only when you want to save completion, confidence, notes, or bookmarks.

New to Aporeon? Create account

Drill details

Human editorial direction

Aporeon is shaped by Aleksandar Tomovski, a software developer with experience on both sides of technical interviews. Content is reviewed for accuracy, natural spoken delivery, useful depth, and honest trade-offs.

About the creator Editorial standards

Was this drill useful?