2 min lesson
Pick the right trigger for the job
Give a practical answer to this: "In a Python screen you're asked to write a script that adds new hires to an Okta group from an HRIS export. What design choices signal a production engineer rather than someone who's only clicked through admin consoles?"
Step 1 of 2
Pick the right trigger for the jobreconcile loop vs. webhook vs. cron
Compares desired vs. actual state and converges the difference.
Self-healing: fixes drift even when an event was missed.
Your default for membership, access and provisioning sync.
Fires the instant the HRIS marks someone a leaver.
Lowest latency for offboarding - seconds, not the next cron tick.
Pair with a reconcile loop as a backstop for dropped events.
Cron / scheduled function for periodic sweeps.
Good for access reviews, drift reports, certificate checks.
Simple and predictable, but adds latency equal to its interval.
The strong pattern for joiner/mover/leaver is a webhook for immediacy plus a reconcile loop on a schedule as the safety net. Webhooks get dropped; a converge loop catches whatever the event missed.
The single fastest way to fail a security-adjacent IT screen is to paste an API token into the script. Even in a 60-minute exercise, read it from an environment variable and say out loud where it'd live in production - a secrets manager (1Password/Doppler/Vault/AWS Secrets Manager), injected at runtime, rotated and scoped to least privilege. The interviewer is watching for whether security is reflexive for you or an afterthought.
When handed the problem, narrate before you type: "I'll make this idempotent with a read-diff-apply loop, add a dry-run flag so we can review the change before it's live and handle paging and 429s in one client helper." Then build the dry-run path first and run it. Showing the diff before mutating anything is exactly the change-safety instinct that separates an IT engineer from someone clicking through an admin console.