1 min lesson
Design prompt (whiteboard)
Recall the main items in "Design prompt (whiteboard)", then connect each one to the work.
Step 1 of 3
The second technical screen is a scenario round: design a system end-to-end with the trade-offs spoken. For this role the canonical prompt is the joiner/mover/leaver pipeline - automate onboarding and offboarding across the IdP, HRIS and downstream SaaS so access is instant, correct and audited.
Time-box it to 30 minutes and start by clarifying, not drawing. The interviewer is grading whether you find the source of truth, reason about drift and name failure modes before you commit to an architecture.
Learn more
Full explanation
The Data Flow, End to End
Interactive diagram. Step through it with the Next and Previous controls below, or Tab to a region to read its detail.
Source of truth → IdP → SaaS + device: the HRIS triggers the IdP, SCIM and MDM actuate the change, and a scheduled diff closes any drift.
The single highest-value idea to volunteer here is that the pipeline is a reconciliation loop, not a one-shot script. Events drift, webhooks get missed, an admin grants access by hand. A design that only reacts to events will silently rot; a design that periodically re-derives truth and corrects drift stays correct.
“Before I draw anything I'd confirm Workday is authoritative and ask how fast offboarding has to be - that decides event-driven versus batch. Then I'd frame the whole thing as a reconciliation loop, not a one-shot: webhooks for same-minute speed and a scheduled diff that re-derives truth from the HRIS for correctness.”
Learn more
Advanced table
Hit every axis the rubric grades
Hit every axis the rubric gradesSay these unprompted
- Axis
- Source of truth
- What a strong answer says
- HRIS authoritative; IdP is the control plane; manual grants are exceptions that reconciliation will flag.
- Axis
- Idempotency
- What a strong answer says
- Every provision/deprovision is safe to re-run; reconciliation converges to the same state regardless of how many times it runs.
- Axis
- Drift + reconciliation
- What a strong answer says
- Scheduled diff of expected vs actual across IdP and SaaS; out-of-band grants are detected and remediated or alerted.
- Axis
- Secrets
- What a strong answer says
- API tokens in a secret manager, scoped and rotated; no standing admin creds in the pipeline; least privilege per integration.
- Axis
- Audit
- What a strong answer says
- Every JML action logged with actor, target, reason and timestamp - this is the SOC 2 access-review evidence, generated for free.
- Axis
- Failure modes
- What a strong answer says
- Webhook dropped → reconciliation catches it; SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. endpoint down → retry with backoff + dead-letter queue; partial failure → idempotent retry, not double-grant.
- Axis
- Scale
- What a strong answer says
- Group-based access so adding an app is one mapping, not N user edits; the design holds as headcount and M&A integrations grow.
| Axis | What a strong answer says |
|---|---|
| Source of truth | HRIS authoritative; IdP is the control plane; manual grants are exceptions that reconciliation will flag. |
| Idempotency | Every provision/deprovision is safe to re-run; reconciliation converges to the same state regardless of how many times it runs. |
| Drift + reconciliation | Scheduled diff of expected vs actual across IdP and SaaS; out-of-band grants are detected and remediated or alerted. |
| Secrets | API tokens in a secret manager, scoped and rotated; no standing admin creds in the pipeline; least privilege per integration. |
| Audit | Every JML action logged with actor, target, reason and timestamp - this is the SOC 2 access-review evidence, generated for free. |
| Failure modes | Webhook dropped → reconciliation catches it; SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. endpoint down → retry with backoff + dead-letter queue; partial failure → idempotent retry, not double-grant. |
| Scale | Group-based access so adding an app is one mapping, not N user edits; the design holds as headcount and M&A integrations grow. |
Naming a failure mode before the interviewer asks is the difference between a 3 and a 5.
If you draw the JML pipeline, expect the follow-up: now design zero-trust access combining identity, device posture and network. Same clarify-first habit. Every access decision is evaluated per request on three signals - verified identity (Okta + MFA/passkey), device trust (MDM-managed, compliant, posture-checked) and context (network, location, risk) - through an identity-aware proxy, with no implicit trust from being on the corporate network. Defense-in-depth, not a perimeter.
Self-score against the rubric the moment you finish: requirements coverage, correctness, security, scalability and trade-off clarity, each 1–5. Saying “I'd rate my drift story a 4 - I named reconciliation but didn't fully specify the dead-letter handling” shows the kind of self-awareness this flat, senior team is hiring for.
QWhy is a purely event-driven JML pipeline (act only on HRIS webhooks) insufficient and what do you add to make it robust?