← Salesforce Interview Insights

Salesforce·Software Engineer·Technical Phone Screen·Senior

Senior
May 2026

Summary

Went through a solutions architect screen at Salesforce and got hit with a classic access control question. Pretty short exchange but it made me think harder than I expected.

Questions Asked (1)

Q1

How would you design a system to restrict certain users from accessing a website or service?

System DesignTechnical Trade-offsAPI & Integrations
Author's notes

I went straight to role-based access control and IP allowlisting, which felt fine, but I didn't think to bring up attribute-based policies or OAuth scopes until after the call.

Create a free account to read the full note

AI HintsAI Generated

Suggested Approach

Start by clarifying requirements: what 'restrict' means (block, rate-limit, or degrade), at what granularity (user, IP, role), and for how long. Then propose a layered defense combining edge controls (WAF, CDN, API gateway) with application-level authorization (RBAC/ABAC) and monitoring, discussing trade-offs like latency, false positives, and scalability.

Pro tip: Emphasize that blocking is a last resort; a mature engineer prefers graceful degradation (e.g., read-only mode, CAPTCHA) and always includes observability and a rollback plan to avoid locking out legitimate users.

1. Clarify Requirements and Constraints

Ask questions to define what 'restrict' means (block, throttle, or degrade), the scope (specific users, IPs, roles), duration (temporary vs permanent), and non-functional needs like latency, scale, and compliance.

2. Design Layered Enforcement Points

Propose controls at multiple layers: edge (WAF, CDN, DDoS protection), API gateway (rate limiting, IP allow/deny), and application (RBAC/ABAC, feature flags). Explain why defense-in-depth reduces single points of failure.

3. Define Policy and Identity Management

Describe how policies are defined and stored (e.g., in a central policy service or database) and how user identity is verified (OAuth, JWT, session). Mention dynamic policies based on attributes like role, location, or behavior.

4. Implement Monitoring, Feedback, and Rollback

Include logging, metrics, and alerting to detect false positives or attacks. Design a feedback loop to adjust rules and a rollback mechanism to quickly restore access if legitimate users are blocked.

5. Discuss Trade-offs and Alternatives

Compare approaches (e.g., block vs. rate-limit vs. challenge) in terms of user experience, security, and operational cost. Highlight when to use each and how to scale the solution.

Key Points to Mention

  • Authentication vs. authorization: restricting access requires knowing who the user is (authn) and what they can do (authz).
  • Rate limiting and throttling: techniques like token bucket or leaky bucket to prevent abuse without outright blocking.
  • RBAC/ABAC: role-based or attribute-based access control for fine-grained permissions.
  • Edge vs. origin enforcement: using CDN/WAF for scalability and DDoS mitigation, but being aware of bypass risks.
  • Observability: logging, metrics, and tracing to monitor blocked requests and detect anomalies.
  • Graceful degradation: offering CAPTCHA, read-only mode, or temporary suspension instead of hard blocks to balance security and user experience.

AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.