Product design question

Lovable wants apps and agents to act programmatically on behalf of users across API, CLI, SDK, and MCP surfaces. How would you define the first product model for non-human identities, such as service accounts, agent identities, scopes, consent, auditability, and revocation, so that permissions remain understandable and controllable for builders and admins?

Practice this question out loud. An AI interviewer asks it, follows up like a real interviewer would, and scores your answer. Type or speak.

What this question tests

Tests product design for non-human identity: keeping permissions legible to builders and admins as agents act autonomously.

Confirm scope: service accounts and agent identities acting across API, CLI, SDK, and MCP, distinct from human identity.
Define core primitives: an identity object with its own credentials, a scope limited to specific actions, and an explicit human owner.
Design consent: an agent identity is created only through explicit human action, scopes chosen from a constrained list, not free-form.
Design auditability: every action logs the identity, the scope used, and who provisioned it, queryable in one place.
Design revocation: one action revokes all credentials and running sessions immediately, no lingering cached tokens.
Default to narrow, expiring scopes requiring renewal rather than broad standing permissions, so admins can reason about risk.

Proposes concrete primitives, an agent identity with a scoped token, an owner field, and a default expiry, not an abstract description.
Designs for legibility with a small closed set of scopes rather than arbitrary permission strings.
Treats revocation and auditability as first-class since agent risk compounds with autonomous action.

Designing permissions as flexible as human RBAC without losing legibility for a less-trusted actor type.
No revocation or expiry, leaving standing risk from stale agent credentials.

Chapters of the AI PM course that teach what this question tests.