Interview question
How would you separate read tools from action tools for an agent?
Classifies tools by consequence and applies distinct permissions, validation, confirmation, idempotency, and audit controls.
TL;DR
Read tools retrieve scoped information and should be side-effect free, while action tools create, change, send, delete, or trigger something. I give them different permissions and execution paths. Action tools require stricter argument validation, fresh authorization, idempotency, audit records, and sometimes explicit confirmation.
Tool risk, least privilege, side-effect safety, and consequence-aware execution.
Core answer first, then checkpoints toward a stronger answer.
Start here. This is the direct spoken answer to practice first.
Reading data and changing the world should not share the same execution policy.
Read tools retrieve scoped information and should be side-effect free, while action tools create, change, send, delete, or trigger something. I give them different permissions and execution paths. Action tools require stricter argument validation, fresh authorization, idempotency, audit records, and sometimes explicit confirmation.
Optional upgrade with examples, trade-offs, and sharper phrasing.
I classify actions by reversibility, financial or legal impact, external visibility, and scope. Drafting an email is different from sending it; quoting a refund is different from issuing one. Tools expose those stages separately so the agent cannot smuggle a high-risk action through a broad operation. Read tools still enforce tenant isolation and resist data exfiltration because read-only does not mean harmless.
Use these to catch weak phrasing, shallow reasoning, and risky claims.
Optional deeper angle for production judgment and nuance.
The effective policy is computed from trusted user identity, resource state, tenant rules, requested action, and current risk—not from the model's explanation. Approval captures a clear action preview and expires if material arguments or state change before execution. Side-effect receipts support reconciliation after ambiguous timeouts. The agent never receives a reusable broad credential; a narrow executor obtains short-lived authority for the specific validated operation.
Quick interviewer prompts inside this drill.
Treat these as the next interviewer turn. Answer one out loud, then save the gap in your practice notes.
Move to the linked follow-up, next path step, prerequisite, or deeper variant.
Move forward in the planned practice sequence.
Aporeon is shaped by Aleksandar Tomovski, a software developer with experience on both sides of technical interviews. Content is reviewed for accuracy, natural spoken delivery, useful depth, and honest trade-offs.
Help improve the interview library.
Say thanks with a standalone, one-time $5 contribution. No account required.