Agent SDK engineer interview questions

As asked

Write a TypeScript tool definition for creating a support ticket, then explain how you would make the schema safe for agent use.

Sample answer outline

The schema should make required fields explicit, restrict enums, and avoid accepting vague free-form blobs for important state. Tool descriptions should say when to call the tool and when not to call it, but the server must still validate permissions and business rules. A good answer includes idempotency keys or deduplication because agents may retry after timeouts. The tool should return a small structured result the agent can reason over, not an entire database record. Candidates often make tools too broad, which increases accidental side effects and makes eval failures hard to diagnose.

Reference implementation (typescript)

import { z } from "zod";

export const createSupportTicketTool = {
  name: "create_support_ticket",
  description:
    "Create one support ticket after the user has described a concrete problem. Do not call for general questions.",
  inputSchema: z.object({
    customerId: z.string().min(1),
    idempotencyKey: z.string().uuid(),
    severity: z.enum(["low", "normal", "high", "urgent"]),
    subject: z.string().min(5).max(120),
    description: z.string().min(20).max(4000),
    orderId: z.string().optional(),
  }),
  async execute(input: unknown) {
    const args = this.inputSchema.parse(input);
    return {
      ticketId: await createTicket(args),
      status: "created" as const,
    };
  },
};

Expect these follow-ups

• How do you version this tool without breaking old agents?
• Where does human approval fit?
• What should the tool return on validation failure?

As asked

You are asked to red team a tool-using support agent that reads web pages, calls internal APIs, and drafts customer replies. How would you test it for indirect prompt injection?

Sample answer outline

Start by mapping the trust boundaries: user instructions, retrieved web content, tool outputs, system prompts, and privileged internal data. Build payloads where hostile content appears in external pages or documents, then check whether the agent treats that content as instructions rather than data. A strong answer separates exfiltration, unauthorised tool use, data corruption, and policy bypass as distinct failure classes. Good candidates discuss both manual probing and an eval harness that measures attack success rate across model and prompt versions. The common trap is testing only direct jailbreaks in chat and missing the real agentic path through retrieved content.

Expect these follow-ups

• What signals prove the model followed the web page rather than the user task?
• How would you turn one successful exploit into a regression test?
• Which mitigations belong in prompting and which belong in the tool layer?

As asked

When a tool call inside an agent loop fails with a transient error, what retry and backoff strategy do you implement, and how do you avoid the agent entering an infinite retry spiral?

Sample answer outline

Strong answers cover exponential backoff with jitter, a per-tool max-retry budget tracked in the agent's step context, a circuit-breaker pattern that surfaces an error observation to the LLM rather than retrying forever, and separating retriable errors from hard failures. Candidates should mention how the LLM itself should receive the error as a tool result so it can decide to change strategy.

Expect these follow-ups

• How do you distinguish a transient network error from a rate-limit from a semantic error returned by the tool itself?
• If the LLM keeps re-invoking the same failing tool after seeing the error, what do you do?

As asked

Modern LLMs can emit multiple tool calls in a single response. Walk me through how you execute them, merge results, and feed everything back in one follow-up message without losing ordering information.

Sample answer outline

Strong answers discuss fan-out via Promise.all or asyncio.gather, preserving the tool_call_id from each call to correctly pair results, constructing a messages array where every tool result carries its id, and handling partial failures where one tool errors but others succeed. Candidates should note that the LLM must receive all results before generating the next turn.

Expect these follow-ups

• What happens if one tool call takes 30 seconds and another finishes instantly? Do you stream the fast result back early?
• How do you handle a tool that returns a very large payload that would overflow the context window?

As asked

Can you describe the four broad categories of memory available to an agent system, give a concrete example of each, and explain the tradeoffs in choosing one over another?

Sample answer outline

Strong answers cover in-context memory (the active window), external storage (vector DBs, key-value stores), episodic memory (past conversation summaries retrieved by semantic search), and procedural or parametric memory baked into model weights. Candidates should discuss cost, latency, staleness risk, and the fact that in-context memory is lost when the session ends.

Expect these follow-ups

• How do you decide what to write to external memory vs. what to keep in the context window?
• What are the failure modes of using a vector DB as episodic memory in a production agent?

As asked

You have an agent that runs for many steps and eventually the accumulated messages exceed the model's context limit. What strategies do you use to handle this, and what are the tradeoffs of each?

Sample answer outline

Strong answers compare sliding window truncation (drop oldest, risk losing early instructions), summarization (compress old turns via a smaller model, risk losing detail), hierarchical memory (write chunks to vector store and retrieve on demand), and hybrid approaches. Candidates should discuss which part of the history is most expensive to lose and how to protect the system prompt and task definition.

Expect these follow-ups

• How do you decide which messages to summarize versus which to drop entirely?
• If you summarize in the background, how do you handle the race between the agent's next step and the summarization completing?