Earn the customer’s trust.
Discover, design, debug, prototype, and defend a phased modernization proposal for a growing SaaS company.
The customer brief
Northstar Desk is a fictional multi-tenant SaaS business. It serves 800 business accounts in North America and Europe. A regional origin hosts a PHP/JavaScript application and a relational database. Public help articles and assets sit beside authenticated account APIs. A small platform team supports the system. The CTO wants better European performance and an AI assistant; the CFO wants evidence that modernization improves economics without disrupting renewals. The security lead requires tenant isolation and a controlled contractor-access path.
Download the offline cache-isolation fixture
node cache-contract.mjsThe fixture proves the test catches a shared-cache bug, then validates the tenant-scoped model. Extend it with permission revocation and source-version cases.
Baseline and constraints
- Illustrative peak traffic: 600 requests/second; public assets are 70% of requests, authenticated APIs 25%, expensive reports 5%.
- European API p95 is 2.8 seconds versus 0.8 seconds in North America; database spans dominate authenticated requests.
- Current combined infrastructure and operations cost assumption: $18,000/month. Estimated avoidable incident labor: 60 hours/month at a planning rate of $100/hour; do not assume all of it is recoverable.
- Pilot allowance: six weeks, two engineers, one reversible public-content slice. Keep existing relational data as the source of truth.
- Proposed recurring increment for modeling only: $3,000/month; one-time migration effort assumption: $24,000. These are exercise inputs, not vendor prices.
- Initial AI use case: answer support questions from approved tenant documents, with citations and human escalation. No cross-tenant context or final-answer cache sharing.
- The team cannot migrate every application and database simultaneously. Residency and contract requirements still need discovery.
Discover the real decision · 15 min
You are meeting the CTO, security lead and CFO. Open with the purpose of the session and agree on the decision the pilot should enable.
- Ask six questions covering business trigger, affected journeys, data sensitivity, operational ownership, decision process and success criteria.
- Separate measured facts from customer assumptions. Clarify whether performance affects conversion, support burden or renewal risk.
- Produce a success statement with a baseline, target, measurement method, owner and time window. Do not promise that edge compute eliminates distant database latency.
Whiteboard a phased architecture · 20 min
Propose a minimum useful change and an alternative. Explain the request path, trust boundaries, data ownership and rollback.
- Separate public cacheable assets from personalized APIs. Include DNS, edge security, origin TLS and controlled origin reachability.
- Decide where Workers adds value and where the existing application remains. Compare D1, KV, R2, Durable Objects and existing relational storage by actual access needs.
- Describe contractor access using identity policy and private connectivity without replacing application authorization.
- Design tenant-authorized retrieval and model routing for AI; include observability, fallback and a representative evaluation set.
Debug the incident inject · 15 min
At minute 35 the interviewer reports that new cache rules made account pages faster, but one synthetic user saw another user’s account summary. An edge HIT is present; origin logs contain no second request.
- State the potential confidentiality impact and immediate containment. Preserve sanitized evidence.
- Identify a discriminating test using synthetic tenants, cache bypass and origin comparison.
- Explain root cause versus trigger, purge requirements, validation and prevention. Avoid testing with real customer secrets.
Build a bounded validation plan · 15 min
Describe a prototype a small team can actually build, and write a test contract before implementation.
- Define a local fixture with public and private responses and a two-tenant test. Specify cache-hit and authorization assertions.
- Create a measurement table for p95/p99 latency, origin request reduction, error rate and tenant isolation. Include warm and cold conditions.
- Define a queue-consumer idempotency test if introducing async reports; test timeout and duplicate delivery.
- List pilot stop conditions, rollback mechanism, acceptance owner and evidence artifacts.
Defend the business case · 15 min
Present a three-minute recommendation to the CTO and CFO. Use a range and explain which assumptions the pilot can validate.
- Model 25%, 50% and 75% recovery of the $6,000/month incident-labor baseline. Subtract the $3,000 monthly increment before computing payback.
- Explain that reduced staff effort is capacity freed, not automatically cash removed from payroll. Do not count the same benefit twice.
- Discuss renewal and continuity benefits without inventing revenue attribution. Include migration risk and operating cost.
- Recommend a go/no-go decision based on pilot evidence rather than the appeal of a full rewrite.
Close as a team member · 10 min
Finish with ownership and a concise personal example.
- Deliver a two-minute introduction and one verified Problem → Constraints → Actions → Tradeoffs → Outcome story.
- State the specialist help you would request and how you would share context with the AE and support team.
- Summarize decisions, unknowns, named owners, dates and the next customer checkpoint.
Panel rubric
Self-score each competency from 1 to 4: 1 = unsupported or unsafe; 2 = plausible with gaps; 3 = evidence-backed and coherent; 4 = clear, testable, customer-aware with explicit tradeoffs. A study target is at least 3 everywhere, but this is not a hiring prediction.
- Architect: coherent request/data paths, identity boundaries and alternatives; no blanket migration prescription.
- Debug: containment, correlation, falsifiable test, root cause, verification and prevention.
- Discover: connects symptoms to impact and establishes decision ownership and constraints.
- Build: defines a small prototype, observable pass/fail criteria and rollback.
- Communicate: adapts detail to technical and executive listeners and marks uncertainty.
- Commercialize: correctly models net benefit, payback and sensitivity without fabricated savings.
- Collaborate: shares ownership, uses specialists, documents decisions and follows through.
Worked approach and debrief
A defensible first phase caches only verified public content and applies scoped security controls while keeping personalized APIs uncached and preserving the relational source of truth. Measure whether the public-content slice reduces origin work; the database-dominated API latency needs its own profiling and placement decision. Do not sell an edge rewrite as a universal cure. A later AI pilot must authorize documents before retrieval and protect any cache-hit path, with tenant-isolation and revocation tests alongside answer quality.
For the incident inject, disable the unsafe cache override, purge affected representations and follow the incident process. Replay two synthetic identities to prove separation. Inspect the configured key and cache eligibility: a shared answer with no second origin request strongly implicates the cache boundary, but validate before declaring the cause. Preserve the distinction between the change that triggered the issue and the missing isolation invariant that allowed it.
At 25% recovery, the assumed labor benefit is $1,500/month and net recurring benefit is negative $1,500; there is no positive payback. At 50%, $3,000 benefit equals the increment, so there is no finite payback from labor alone. At 75%, net benefit is $1,500/month, giving a simple 16-month payback on $24,000. This excludes time value, taxation, adoption risk and other benefits; describe it as a planning model. Capacity freed is not necessarily cash saved. A good recommendation can be “run the bounded pilot” or “defer until evidence improves,” not always “buy more.”
Close by assigning an owner for latency measurement, isolation tests, contract requirements and financial assumptions. A CE earns trust by making the next decision easier and by surfacing a condition that would change the recommendation.