Lesson 0007 · the capstone — repeatable
These cover the technical interview's most likely 80%. Do each from memory, then check yourself against the lesson:
| # | Prompt (60–90s each) | Check against |
|---|---|---|
| 1 | "Walk me through deploying Case AI on AWS." | Lesson 0001 |
| 2 | "What happens between typing portal.caseai.com and seeing the page?" | Lesson 0002 |
| 3 | "How do you isolate our clients' data — and prove who accessed it?" | Lesson 0003 |
| 4 | "How would you build contract Q&A that lawyers can trust?" | Lesson 0004 |
| 5 | "How would you build our evaluation framework?" | Lesson 0006 — highest-value one |
Answer each in 2–4 sentences before checking the source:
| Question | Your ammunition |
|---|---|
| "Lambda or containers for our API — why?" | Workload shapes: streaming, steady traffic, DB pools, 15-min cap (L0002 §3) |
| "How do services authenticate to AWS resources?" | Task roles → temporary credentials; guard vs safe if KMS comes up (L0002 §4, Q&A #7–8) |
| "Silo or pool for tenants?" | Bridge: pooled Aurora + RLS, per-tenant KMS keys, per-tenant S3 prefixes, silo tier on demand (L0003 §3) |
| "How do you stop the AI leaking one client's data to another?" | Retrieval is a tenant-isolation surface — RLS on chunks; tool calls tenant-scoped; injection-aware (L0004 §2.4, L0005 §4) |
| "How do you handle provider outages?" | Normalized adapter layer, routing, retries/backoff, circuit breaker, fallback chain, degraded-mode labeling (L0005 §1–2) |
| "How do you deal with hallucination?" | Answer-only-from-chunks + programmatic citation verification + not-in-the-docs traps in the golden set + HITL before release (L0004 §2.5, L0006 §4) |
| "What does human-in-the-loop mean concretely?" | A state machine, not a popup: draft → review → approved/edited → released; edits become eval labels; approvals audited (L0005 §5) |
| "OWASP — which risks worry you most here?" | A01 access control (= tenant isolation), A05 injection incl. prompt injection, A03 supply chain — plus the LLM Top 10 name-drop (L0003 §4) |
| "What would SOC 2 readiness require from engineering?" | The auditor-question table: SSO+least privilege, CloudTrail + app audit table, PR-only changes, encryption, alerting (cheat sheet) |
Rehearse your own opener until it's effortless: "I'm a product-minded full-stack engineer who has built real end-to-end products — Buddy Ride, a cross-border ride-sharing platform I co-founded (Next.js, React Native, real-time trip flows, auth, serverless backend), and fintech work at Fractal on a regulated loan platform. I'm strongest at turning domain workflows into working software — which is exactly what legal tech is: lawyers' processes becoming structured product workflows with AI in the loop." Then let the technical answers above prove the AI/AWS half.
Gaps to own honestly if asked: hands-on AWS is new — but you speak the architecture fluently and your serverless production experience (Cloudflare) transfers directly. Interviewers forgive gaps that are named confidently and bridged with fundamentals.
From your own research — ask these; they're genuinely good:
| Term | Say | Never |
|---|---|---|
| SOC 2 | "sock two" | "SOP 2" |
| OWASP | "oh-wasp" | spelling it out |
| IAM | "I-A-M" (letters) | "iam" as one word |
| pgvector | "P-G vector" | — |
| RAG / RLS / HITL | "rag"; "R-L-S"; "H-I-T-L" or "human in the loop" | — |
| Fargate / Aurora / Textract | FAR-gate / aw-ROR-a / TEXT-tract | — |