Search the practice set
275 questions, 991 terms and 600 topics in 30 areas.
60 results for “AI Risk Tiering”
Use Case Risk Classification
Assigning an AI application to a risk tier based on the consequence of it being wrong, which then determines the obligations that apply.
AI Gateway
A shared proxy in front of model providers that centralises routing, keys, quotas, caching, logging and safety policy.
Feature Criticality Tiering
Classifying product functionality by whether it must work, should work, or can be dropped, so degradation decisions are made in advance by the business.
Fourth Party Risk
The dependencies of your dependencies, which you did not choose, may not know about, and remain accountable for.
Licence Metric Risk
The exposure created when a software licence is priced on a unit that cloud architecture changes unpredictably, such as cores, sockets or instances.
Log Retention Tiering
Storing log data at different resolutions, costs and access latencies according to how old it is and how likely it is to be queried.
Migration Risk Register
A maintained record of what could go wrong in a migration, with likelihood, impact, owner and mitigation, reviewed as the programme progresses.
Quantified Risk Estimate
Expressing a risk as a probability distribution over financial loss rather than as a colour, which makes risks comparable and mitigations arguable on cost.
Re-Identification Risk
The probability that pseudonymised data can be linked back to individuals, which is what keeps such data within the scope of data protection law.
Risk Tolerance Statement
The board-level declaration of how much of each risk type the organisation will accept, which is what tells an architect which risks may be accepted without escalation.
Storage Tiering
Moving data between access tiers as it cools, so rarely-read data is not paying hot-storage prices.
Assurance Map
A single view of which risks are covered by which assurance activity, exposing both the gaps nobody is looking at and the duplication several parties are paying for.
Attack Surface
The complete set of points where an untrusted actor can interact with a system — and the quantity that reduction genuinely reduces risk.
Business Case Structure
The argument format that gets technical investment funded — problem, options, quantified benefit, cost, risk and a recommendation.
Canary Release
Routing a small fraction of traffic to a new version, watching its metrics, and expanding or rolling back based on what they show.
Capability Heat Map
A capability map coloured by a chosen dimension — maturity, cost, risk, or strategic importance — to make patterns visible to non-technical stakeholders.
Commitment Coverage
The proportion of steady-state usage covered by discounted commitments, balanced against the risk of committing to capacity that is no longer needed.
Context Window
The maximum number of tokens a model can attend to in one request, holding the system prompt, history, retrieved context, tools and the answer.
The business wants to deploy a model that ranks loan applications, with a credit officer making the final decision. What must the architecture provide, and what will you insist on before go-live?
Classify first, because it determines everything else This decides access to credit for individuals. Under any consequence based classification it is high risk:
A deployed model performed well in validation and its business metric has declined over four months. Nothing has been deployed. What do you investigate?
The model did not change; its world did Three distinct causes, and they need different responses: Data drift. The input distribution has moved — a new customer
A vendor SaaS product embeds a model that scores customers, and its output drives an automated decision in your process. Your model governance framework covers models you build. What do you do?
The obligation does not transfer with the outsourcing You are accountable for the decision. That the scoring is performed by a vendor changes who operates the m
A CDC pipeline feeding your warehouse falls three hours behind during a source system's batch job, and the source's transaction log retention is 24 hours. What is the risk and what do you change?
The immediate risk Lag consumes the retention window. At three hours behind against a 24 hour retention, you have 21 hours of margin. If the consumer stops enti
An AI feature launched two months ago now costs more per month than the rest of the platform. What do you investigate?
Get cost per request, decomposed Token cost splits into input and output, and they price differently. Break the bill down by feature, by user, and by input vers
An executive says "we need an AI strategy" and asks you to come back in two weeks. How do you handle the ambiguity?
Do not go away and produce a strategy document A document answering a question nobody has articulated will be received politely and shelved. The brief is ambigu
An internal AI assistant gives confidently wrong answers. The team wants to upgrade to a better model. What do you check first?
Establish whether the model ever saw the right content Log the retrieved chunks alongside each answer, then take the wrong answers and check: was the correct so
You are asked to give an internal AI agent access to the customer database, the ticketing system and outbound email so it can resolve support tickets. What is your response?
What the interviewer is testing Whether you recognise a specific and well documented security pattern, and whether you can propose a workable design instead of
You inherit an estate of roughly 400 applications, no reliable inventory, and a mandate to reduce cost and risk. What do you do in the first ninety days?
What the interviewer is testing Whether you can sequence work at portfolio scale, and whether you go for evidence before strategy. This is the enterprise archit
A 15-year-old monolith runs the core of the business. Leadership wants microservices. How do you approach it, and what would make you refuse?
What the interviewer is testing Whether you start from the business problem or from the target architecture, and whether you are willing to say no. First, estab
A business unit wants an assistant answering questions from 200,000 internal documents. They ask whether to fine-tune a model or use retrieval. How do you decide?
Retrieval, for this requirement, and the reasoning is not about quality Four properties decide it: Freshness. Documents change. Retrieval reflects a change as s
A client wants an assistant that answers questions from 50,000 internal documents which change weekly. RAG or fine-tuning? What actually determines the quality?
What the interviewer is testing Whether you understand what each technique actually does, and whether you know that RAG quality is a retrieval problem. Why RAG
A regulator asks for evidence that your exit plan from your primary cloud provider is credible. The plan is a twelve-page document. What will they find, and what should you do?
What they will find A document describing an intention. Supervisors have moved from accepting exit plans to asking what has been tested, precisely because most
A team proposes rewriting a critical system from scratch, arguing the existing one is unmaintainable. How do you evaluate this?
Test the diagnosis before the prescription "Unmaintainable" usually means one of several different things, and they have different remedies: Nobody understands
A twenty-year-old core system supports most of the business. It is on unsupported technology, three people understand it, and the last replacement attempt was abandoned after two years. Design the programme.
Learn from the abandoned attempt first The most important input is why the last one failed, and the reasons are usually structural rather than technical: a big
An LLM feature that worked last week now gives worse answers. Nothing was deployed. How do you find out what changed, and what should have been in place?
What the interviewer is testing Whether you treat an AI feature as a system with configuration and dependencies, or as a black box that mysteriously drifts. Wha
Choose storage for four workloads: a Postgres data directory, user-uploaded images, a shared build cache, and seven years of audit records.
Postgres data directory — block storage It needs low latency random reads and writes and a filesystem, and it attaches to one instance. That is precisely block
AI Risk Tiering
Classifying a use case by potential harm, and the obligations each tier triggers.
AI Cost Management
Token accounting, routing, caching and the context-window budget.
AI Gateways
Centralised routing, keys, quotas, caching, logging and safety policy.
AI Observability
Logging prompts, versions, retrieved context and cost per request.
AI-Era Architecture
General material on architecting systems that include models.
Assurance, Audit & Model Risk
General material on assurance, architectural governance and risk oversight.
Exit & Concentration Risk
Being able to leave a provider, and what the regulator asks when you cannot.
Migration Risk
Bounding blast radius, staging by cohort, and honest readiness reporting.
Model Risk Management
Inventory, validation, monitoring and challenge for models that make consequential decisions.
Risk Appetite
The stated tolerance that tells you which risks you are allowed to accept.
Risk Assessment Methods
Qualitative matrices, FAIR and scenario analysis, and the illusion of a precise score.
Third-Party Risk
Assessing, contracting and monitoring the vendors your architecture now depends on.
Agent Architectures
Loops, planning, memory and the boundaries an agent must not cross.
Architecture Compliance Checks
Automating conformance to standards so review effort goes to the genuinely novel.
Audit Evidence
Producing durable, tamper-evident proof as a by-product rather than as a project.
Bias & Fairness Controls
Measuring disparate outcomes, choosing a fairness definition, and living with the trade-off.
Certification Impact on Architecture
What SOC 2 and ISO 27001 actually require of a design, and what they do not.
Change Advisory vs Automated Gates
Replacing a weekly board with evidence a machine produces on every change.
Change Data Capture
Turning a database's replication log into a stream, and its coupling risk.
Chunking & Retrieval
Structure-aware splitting, hybrid search and why chunking dominates quality.
Communicating Threat Models
Making risk legible to people who will fund or accept it.
Continuous Controls Monitoring
Testing controls continuously instead of sampling them once a year.
Control Design vs Operation
A control that is well designed and never runs fails exactly like one that is absent.