1 min lesson
Design prompt (whiteboard)
Recall the main items in "Design prompt (whiteboard)", then connect each one to the work.
Step 1 of 3
A design round for this role will likely be a scenario: design a system end to end with the trade-offs spoken. A representative prompt is the joiner/mover/leaver pipeline, which automates onboarding and offboarding across the IdP, HRIS and downstream SaaS so access is instant, correct and audited.
Time-box it to 30 minutes and start by clarifying before you draw anything. A design interviewer is likely grading whether you find the source of truth, reason about drift and name failure modes before you commit to an architecture.
Learn more
Full explanation
The Data Flow, End to End
Interactive diagram. Step through it with the Next and Previous controls below, or Tab to a region to read its detail.
Source of truth → IdP → SaaS + device: the HRIS triggers the IdP, SCIM and MDM actuate the change, and a scheduled diff closes any drift.
The single highest-value idea to volunteer here is that the pipeline is a reconciliation loop, not a one-shot script. Events drift, webhooks get missed, an admin grants access by hand. A design that only reacts to events will silently rot; a design that periodically re-derives truth and corrects drift stays correct.
"Before I draw anything I'd confirm Workday is authoritative and ask how fast offboarding has to be, since that decides event-driven versus batch. Then I'd frame the whole thing as a reconciliation loop: webhooks for same-minute speed and a scheduled diff that re-derives truth from the HRIS for correctness."
Learn more
Advanced table
Hit every axis, unprompted
Hit every axis, unpromptedSay these before you're asked
- Axis
- Source of truth
- What a strong answer says
- HRIS authoritative; IdP is the control plane; manual grants are exceptions that reconciliation will flag.
- Axis
- Idempotency
- What a strong answer says
- Every provision/deprovision is safe to re-run; reconciliation converges to the same state regardless of how many times it runs.
- Axis
- Drift + reconciliation
- What a strong answer says
- Scheduled diff of expected vs actual across IdP and SaaS; out-of-band grants are detected and remediated or alerted.
- Axis
- Secrets
- What a strong answer says
- API tokens in a secret manager, scoped and rotated; no standing admin creds in the pipeline; least privilege per integration.
- Axis
- Audit
- What a strong answer says
- Every JML action logged with actor, target, reason and timestamp. That log is SOC 2 access-review evidence you get for free.
- Axis
- Failure modes
- What a strong answer says
- Webhook dropped → reconciliation catches it; SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. endpoint down → retry with backoff + dead-letter queue; partial failure → idempotent retry, not double-grant.
- Axis
- Scale
- What a strong answer says
- Group-based access so adding an app is one mapping rather than N user edits; the design holds as headcount and M&A integrations grow.
| Axis | What a strong answer says |
|---|---|
| Source of truth | HRIS authoritative; IdP is the control plane; manual grants are exceptions that reconciliation will flag. |
| Idempotency | Every provision/deprovision is safe to re-run; reconciliation converges to the same state regardless of how many times it runs. |
| Drift + reconciliation | Scheduled diff of expected vs actual across IdP and SaaS; out-of-band grants are detected and remediated or alerted. |
| Secrets | API tokens in a secret manager, scoped and rotated; no standing admin creds in the pipeline; least privilege per integration. |
| Audit | Every JML action logged with actor, target, reason and timestamp. That log is SOC 2 access-review evidence you get for free. |
| Failure modes | Webhook dropped → reconciliation catches it; SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. endpoint down → retry with backoff + dead-letter queue; partial failure → idempotent retry, not double-grant. |
| Scale | Group-based access so adding an app is one mapping rather than N user edits; the design holds as headcount and M&A integrations grow. |
Naming a failure mode before the interviewer asks is the difference between a 3 and a 5.
If you draw the JML pipeline, a likely follow-up is: now design zero-trust access combining identity, device posture and network. Same clarify-first habit. Every access decision is evaluated per request on three signals. Verified identity means Okta plus MFA or a passkey. Device trust means MDM-managed, compliant and posture-checked. Context means network, location and risk. All of it runs through an identity-aware proxy, with no implicit trust from being on the corporate network. That is defense in depth.
Self-score against the rubric the moment you finish: requirements coverage, correctness, security, scalability and trade-off clarity, each 1 to 5. Saying "I'd rate my drift story a 4: I named reconciliation but didn't fully specify the dead-letter handling" shows self-awareness an interviewer can work with.
QWhy is a JML pipeline that acts only on HRIS webhooks insufficient, and what do you add to make it robust?