Payments and regulated domains¶
English · Русский · AI Interview Atlas › Themes
AI in payments, banking and other regulated industries, including agentic commerce.
On this page: Both tracks (4) · AI Leadership (1)
Both tracks¶
- A shopping agent can initiate payments. How would you prove that each payment matches the user's actual authorisation?
- System design · Senior · 🧪 generated from job-posting themes · ✍ Answer · Suggest a fix
- Tests: Whether you separate an agent's proposal from a verifiable payment mandate.
- A strong answer covers:
- Represent user intent and transaction constraints explicitly, including amount and payee.
- Validate authority at execution; require new confirmation for changes outside the grant.
- Preserve an audit trail and distinguish authorisation evidence from settlement success.
- Read: AP2 - Agent Payments Protocol Documentation (AP2 project) · Agentic Commerce Protocol (Stripe Documentation) · Universal Commerce Protocol (UCP) (UCP project)
- An AI support agent initiates a refund, then the payment API times out. How should the system recover without issuing the refund twice?
- System design · Senior · 🧪 generated from job-posting themes · ✍ Answer · Suggest a fix
- Tests: Whether you treat an unknown outcome as a reconciliation problem rather than blindly repeating a side effect.
- A strong answer covers:
- Assign one stable operation identity and persist intent before retries.
- Use the provider's idempotency contract and reconcile status after ambiguous failures.
- Handle retention limits, concurrent attempts and manual escalation; do not promise global exactly-once execution.
- Read: Designing robust and predictable APIs with idempotency (Stripe)
- A clinical AI service handles recordings, transcripts and notes containing protected health information. How does that constrain architecture and use of third-party model APIs?
- System design · Senior · ✍ Answer · Suggest a fix
- Tests: Whether you map sensitive data flows and establish permitted processing before integration.
- A strong answer covers:
- Map every copy of recordings, transcripts and notes, including logs, traces, caches and evaluation sets.
- Send protected data to a model API only under a contract covering health data, retention and training use.
- Minimise data per step, audit access, measure redaction misses and test deletion before integration.
- Read: OWASP Top 10 for LLM Applications (OWASP Gen AI Security Project)
- How would you write an AI-generated clinical note back into an electronic health-record system, and what can go wrong?
- System design · Senior · Suggest a fix
- Tests: Whether you consider patient identity, review status, duplicate writes and recovery.
- A strong answer covers:
- Match patient and encounter by stable identifiers, and block the write on any mismatch.
- Write an unsigned draft that enters the record only after clinician review and signature.
- Make writes idempotent, reconcile after timeouts, and correct signed notes by amendment, not overwrite.
- Read: Designing robust and predictable APIs with idempotency (Stripe)
AI Leadership¶
- A bank wants to roll out an AI assistant that proposes case decisions to employees. What evidence and controls would you require before expansion?
- Applied scenario · Senior · 🧪 generated from job-posting themes · ✍ Answer · Suggest a fix
- Tests: Whether you keep accountability and validation proportional to the decision's consequences.
- A strong answer covers:
- Define the decisions, affected customers and limits of the assistant's authority.
- Evaluate representative cases and harmful errors, including how employees use or override suggestions.
- Document owners, monitoring, escalation and a controlled expansion; verify applicable jurisdiction-specific obligations separately.
- Read: AI Risk Management Framework (NIST) · Supervisory Letter SR 11-7 on guidance on Model Risk Management (Board of Governors of the Federal Reserve System)