An internal API accepts a customer ID and returns that customer's data. It authenticates the calling service with mTLS. What is the flaw?

What the interviewer is testing

Whether you recognise the confused deputy, which is the authorisation flaw that most often survives a security review because every component behaves correctly.

The flaw

It authenticates the caller but does not authorise the request. mTLS proves which service is calling; it says nothing about whether the end user on whose behalf the call is made is entitled to that customer's data.

So any service that can reach this endpoint can request any customer. The batch job, the admin tool, the reporting service and — critically — any compromised service on the network can enumerate the entire customer base.

The API is a deputy using its own authority to perform an action it was asked to perform, without checking whether the requester was entitled to it.

The fix

Carry the end user's authority through the call chain and evaluate authorisation at the resource, against that identity — not at the gateway on the assumption that everything inside is trusted.

Mechanisms: propagate the user's token, or use token exchange so each hop receives a token scoped to the next service specifically, carrying both the user's identity and the fact that the calling service is acting for them. Exchange gives audience restriction, so a stolen token is useful against one service only, and a visible delegation chain for audit.

For genuine service-to-service work with no user — a batch job, a reconciliation process — the service acts on its own behalf, and its permissions must be scoped to exactly what its function requires rather than to a superset spanning every user.

The general principle

Authentication at the edge, authorisation at the resource. Any system that authorises only at the perimeter fails the moment a component can be reached by another path, and there is always another path eventually.

What a strong answer adds

Noting that this is the same pattern as an AI agent with tools: a model induced by untrusted content to call a tool that executes with the application's credentials is a confused deputy, and the fix is identical — tools execute with the end user's authority.

Common weak answers

Adding an allowlist of calling services, which does not scope by user. Relying on network segmentation, which is not authorisation.