Lesson 19 · Senior auth & authz

Mock senior auth/authz interview pack

A retrieval-first mock pack for turning the whole auth course into clear, interview-grade answers you can say under pressure.

Your win: run a realistic senior auth/authz mock interview on yourself, score your answers honestly, and turn weak spots into a concrete review plan.

In plain English Plain English: answer out loud before checking the answer points. Recognition is not recall.

Why this page matters more than it looks

By the time people reach a mock pack, they often think the learning phase is over. In reality, this is where the course becomes usable under pressure.

The strongest earlier auth lessons taught you to trace mechanisms clearly. This page asks whether you can still do that when there is no diagram in front of you, no code open, and no time to think for five minutes.

The format

This page works best if you treat it like a real interview. Answer first. Then check the points. Then answer again more cleanly.

Round 1 · Auth foundations — 5 questions
Round 2 · Repo authz model — 6 questions
Round 3 · Senior judgment and failure modes — 6 questions
Time target — 60–90 seconds per answer

The answer checklist A strong answer should usually include: (1) the model, (2) the main trade-off or risk, and (3) a repo-grounded consequence or example.

How to use this well

Do not chase perfect wording on the first try. Chase structure. If your answer has the model, the key risk, and the repo consequence, it will already sound far more senior than a vocabulary dump.

That is the real purpose of the answer points below. They are not there to be memorized line for line. They are there to teach your answers a stable shape.

Round 1 · Auth foundations

What is the difference between authentication and authorization?
What is inside the Manabie claim and why does it matter?
What does Shamir do in the token lifecycle?
How does JWT verification actually work here?
Why is token exchange useful?

Round 1 · Strong answer points

authN vs authZ. Authentication proves identity at the interceptor; authorization decides what that identity may do through layered checks.
Manabie claim. It carries repo-critical identity context like user ID, user group, roles, tenant/resource_path, and related values used downstream.
Shamir. It verifies external identity, looks up the internal user meaning, mints first-party JWTs, and hosts the JWKS.
Verification. It checks signature, issuer, audience, expiry, and key material via JWKS-backed verifiers, including refresh behavior.
Token exchange. It translates external identity into the repo’s own authority model rather than trusting outside claims blindly forever.

Round 2 · Repo authz model

What are the three authorization tiers in this repo?
What is the difference between nil and an absent rbacDecider entry?
Why are permissions and locations needed beyond roles?
How does access_path help express scope?
How does RLS enforce tenancy?
Why does the repo use defense in depth?

Round 2 · Strong answer points

Three tiers. Role gate, permission/location scope, and RLS at the DB layer.
nil vs absent. nil means any authenticated user with a role; absent key returns runtime PermissionDenied.
Permissions + locations. Roles are too coarse to express specific capabilities at specific parts of the org tree.
access_path. It encodes subtree scope efficiently with materialized-path matching.
RLS. Session variables stamped from JWT claims drive permission_check and related policies so rows are filtered by tenant and sometimes location-aware logic.
Defense in depth. Each layer catches a different class of mistake or abuse, so one bug does not become total exposure.

Round 3 · Senior judgment and failure modes

Why is “panic at startup” the wrong mental model for missing RBAC entries?
How would you debug “login works, but access still fails”?
Why does the verifier refetch JWKS once on failure?
What problem does FakeJwtContext solve?
Why is the confused-deputy problem relevant here?
How would you explain the whole auth design honestly in a senior interview?

Round 3 · Strong answer points

RBAC docs myth. Missing entries return runtime PermissionDenied; the service does not fail startup because no boot-time cross-check exists.
Debug path. Walk the chain: token verification, claims/context, role gate, permission/location resolution, service ownership checks, repo query shape, then RLS filtering.
JWKS refetch. It can recover safely from key rotation or stale key material instead of assuming every verification miss is malicious.
FakeJwtContext. It gives internal calls synthesized scoped identity rather than leaving downstream code with no trustworthy caller context.
Confused deputy. Internal services can accidentally exercise broader authority than intended unless delegated scope is pinned explicitly.
Senior explanation. Describe it as a layered trust and enforcement system: external identity translated into first-party claims, coarse-to-fine authz, and DB-enforced tenant boundaries with guardrails against drift.

Self-scoring rubric

Score	Meaning
0	I could not explain it without notes.
1	I gave fragments, but the answer was incomplete or fuzzy.
2	I explained the main idea, but missed the trade-off, risk, or repo consequence.
3	I gave a strong, clear answer with model + trade-off/risk + repo consequence.

Recovery map — where to go next Missed core authN? Revisit Lessons 1–4. Missed roles/permissions/locations? Revisit Lessons 5–8. Missed RLS and the chain? Revisit Lessons 9–12. Missed senior judgment? Revisit Lessons 13–18.

What success looks like here

Success is not “I remembered the exact wording from the answer points.” Success is “I can now answer clearly out loud, in my own words, without losing the model.”

That is why this page belongs at the end of the course. It turns recognition into retrieval and retrieval into interview readiness.

Q1. The main rule of this mock pack is…

Retrieval first is what turns recognition into interview recall.

What are the three ingredients of a strong senior auth/authz answer?

recall, then click to reveal

A clear security model, the important trade-off or risk, and a repo-grounded consequence or example.

If you want, I can now run this as a live mock senior auth/authz interview and grade you answer by answer. Ask me.

Sources. This pack synthesizes the whole course into retrieval practice.