Tools extend an LLM with side effects and grounded data: HTTP APIs, DB queries, code execution, browsers. Interviews focus on schema design, validation, permissions, and idempotency — not on framework brand names.

• Validate args server-side; never execute on model trust alone
• Allowlist tools per user role; separate read tools from write tools
• Make writes idempotent with client-generated keys
• Return concise, structured errors the model can recover from

LLM proposes tool_call(name, args)
        ↓
 AuthZ + schema validate
        ↓
 Execute with timeouts / budgets
        ↓
 Sanitize result → append to messages
        ↓
 LLM continues or final answer

Agent loops alternate reasoning with tool use: plan, act, observe, repeat until a stop condition. Strong answers bound the loop with step budgets, timeouts, and explicit termination criteria.

1. Cap max steps and wall-clock time per request
2. Detect loops: same tool + same args → break and escalate
3. Prefer deterministic planners for regulated workflows
4. Log every thought/action/observation for debugging (redact secrets)

start → plan
   ↑        ↓
observe ← act (tool)
   │
   ├─ done? → final answer
   ├─ steps > N? → safe abort
   └─ else continue

Memory is how agents persist state beyond the context window: scratchpads, conversation summaries, episodic logs, and long-term user/profile stores. Mixing memory types without TTL and consent is a common interview failure.

• Write memory deliberately — not every token of every tool dump
• Prefer structured memory (key-value, entities) over raw blob dumps
• Support user-visible edit/delete for personal data (compliance)
• Retrieve memory with the same ACL discipline as document RAG

User turn
  → Retrieve relevant memories
  → Build prompt (working + retrieved)
  → Act / answer
  → Decide writes (facts? prefs? none?)
  → Compact scratchpad

Multi-agent systems split roles — researcher, coder, critic, executor — coordinated by a supervisor or graph. Use them when specialization and review beat a single overloaded prompt; avoid them as default architecture theater.

• Give each agent a narrow tool allowlist
• Define typed messages between agents — not free-form chat forever
• One agent owns user-facing communication to avoid conflicting answers
• Budget tokens per agent; multi-agent multiplies spend silently

User → Supervisor
           │
     ┌─────┼─────┐
     ▼     ▼     ▼
  Research Code  Critic
     │     │     │
     └─────┴─────┘
           │
      Merge / approve
           │
        Response

Agents fail loudly and expensively: infinite loops, wrong tool calls, cascading bad observations, and unsafe side effects. Interview depth is naming failure modes and the controls that contain them.

1. Separate planning from privileged execution
2. Require confirmation for irreversible tools (delete, pay, email-all)
3. Circuit-break on error rate or spend per session
4. Provide a deterministic fallback path for critical user journeys

Tool safety is authorization, sandboxing, and abuse resistance. Treat every tool as a privileged API gateway in front of your systems — because that is what it is.

• Never pass raw user strings into shell without escaping — prefer structured APIs
• Default deny: new tools are off until reviewed
• Dual control for high-risk actions in enterprise settings
• Redact secrets from tool outputs before they re-enter the prompt

User identity
     ↓
Session policy (role, tenant)
     ↓
Tool allowlist
     ↓
Arg validator / policy engine
     ↓
Execution sandbox
     ↓
Audit + metrics