2 min lesson
Pick the right trigger for the job
Give a practical answer to this. "In a Python screen you're asked to write a script that adds new hires to an Okta group from an HRIS export. What design choices signal a production engineer rather than someone who's only clicked through admin consoles?"
Step 1 of 2
Pick the right trigger for the jobreconcile loop vs. webhook vs. cron
Compares desired vs. actual state and converges the difference.
Self-healing: fixes drift even when an event was missed.
Your default for membership, access and provisioning sync.
Fires the instant the HRIS marks someone a leaver.
Lowest latency for offboarding: seconds instead of the next cron tick.
Pair with a reconcile loop as a backstop for dropped events.
Cron / scheduled function for periodic sweeps.
Good for access reviews, drift reports, certificate checks.
Simple and predictable, but adds latency equal to its interval.
The strong pattern for joiner/mover/leaver is a webhook for immediacy plus a reconcile loop on a schedule as the safety net. Webhooks get dropped; a converge loop catches whatever the event missed.
The fastest way to fail a security-adjacent IT exercise is to paste an API token into the script. Read it from an environment variable, then say out loud where it would live in production: a secrets manager such as 1Password, Doppler, Vault or AWS Secrets Manager, injected at runtime, rotated and scoped to least privilege. The interviewer is watching whether security is reflexive for you.
When handed the problem, narrate before you type: "I'll make this idempotent with a read-diff-apply loop, add a dry-run flag so we can review the change before it's live and handle paging and 429s in one client helper." Then build the dry-run path first and run it. Showing the diff before mutating anything is the change-safety instinct that separates an IT engineer from someone clicking through an admin console.