Original practice scenario: A hypothetical enterprise assistant serves several organizations using shared infrastructure. How should caching avoid cross-tenant evidence disclosure?
Read model answer +
Cache identity must include the authorization and content context that affects a result. A shared query string alone is unsafe when tenants have different documents or permissions.
Work through it
Include tenant, entitlement scope, document snapshot and retrieval configuration in cache keys; avoid placing sensitive raw prompts in observable identifiers.
Revalidate access when cached evidence is consumed, expire or invalidate entries after permission changes and keep per-tenant limits on cache growth.
Test identical queries across tenants, revoked roles, document replacement and concurrent invalidation; inspect logs and metrics for accidental content exposure.
Tradeoffs to discuss
Fine-grained keys improve isolation and freshness but reduce cache reuse; coarse keys require stronger filtering and are easier to misuse.
Common pitfalls
Do not assume tenant separation in the user interface enforces data separation.
A cached generated answer can remain sensitive even when its cited document has been removed.
Original practice scenario: A fictional enterprise platform changes an event field from one address string to structured address components while old consumers remain active.
Read model answer +
Use an explicit compatibility window and independently test old and new readers. Changing a field's shape in place can break consumers even if the new producer considers its own output valid.
Work through it
Publish a versioned schema or additive fields, define how legacy strings and structured values coexist, and preserve unknown fields where the protocol requires it.
Deploy tolerant consumers first, then producers, with contract fixtures covering absent, null, legacy and new representations plus conflicting values.
Measure remaining legacy usage, document rollback behavior and remove deprecated fields only after the supported compatibility period and evidence justify it.
Tradeoffs to discuss
Dual representations simplify transition but can diverge; a single canonical internal form and documented precedence reduce ambiguity.
Common pitfalls
Do not infer consumer readiness from producer deployment success.
Schema validation alone cannot establish that the new fields retain the original business meaning.
