Product design question

Policy and Legal surface a new multi-step misuse pattern in an agentic workflow a week before a planned deployment, and the customer contract prohibits storing raw prompts. How would you turn that threat model into product requirements, a human-review workflow, and clear enforcement actions?

Practice this question out loud. An AI interviewer asks it, follows up like a real interviewer would, and scores your answer. Type or speak.

What this question tests

Ability to translate a legal and safety constraint into concrete product requirements under a tight deadline.

Clarify the exact misuse pattern Policy and Legal found and which agentic workflow steps enable it.
Confirm what the no-raw-prompt-storage clause actually restricts, versus what logs or metadata are still allowed.
Turn the threat model into requirements: what inputs or actions to block, rate-limit, or require a human check on.
Design a human-review workflow that can run without storing raw prompts, for example reviewing redacted or hashed summaries.
Define enforcement actions for violations, such as session suspension or automatic escalation.
Confirm the scoped plan with Policy and Legal before the deployment date, and flag if the timeline is not achievable.

Distinguishes between blocking the misuse pattern outright and adding friction plus review, since blocking may break legitimate use.
Proposes a concrete review mechanism compatible with the no-storage constraint, like ephemeral review windows or redacted logging.
States plainly if a week is not enough time and proposes a narrower launch scope instead of a rushed full launch.
Defines measurable enforcement, such as automatic flags per session, not just a policy statement.

Treating this as purely a legal problem and not translating it into product and engineering requirements.
Assuming logging metadata is fine without confirming it does not count as raw prompt storage.

Chapters of the AI PM course that teach what this question tests.