Assign write ownership in a multi-region active-active product

• Inventory operations by invariant rather than declaring the whole product strongly or eventually consistent. Ask which writes may conflict, which require read-your-writes, which identities must be globally unique, and whether degraded writes are preferable to rejection during partition.

• Assume three regions, 120k peak writes/second, 99.99% availability, and inter-region latency between 80 and 220 milliseconds as explicit interview inputs. Model tenant locality and the fraction of truly cross-region collaboration before paying coordination latency everywhere.

• Serve local reads and most writes, maintain residency, expose deterministic conflict behavior, and meet an agreed regional RPO and RTO. Global invariants must remain true even if that means a narrower unavailable surface during partition.

• Use tenant home regions for regulated data, entity-affinity routing for collaborative objects, and multi-leader replication only for operations with a defined merge algebra. Keep a small globally coordinated service for scarce invariants such as unique namespace claims.

• Attach entity version, origin region, logical time, actor, and operation ID to replicated mutations. Consumers apply mutations idempotently; a reconciliation stream detects divergent versions and routes non-mergeable cases to a compensating workflow.

• Choose semantics per operation: CRDT-style merge for commutative sets and counters, last-writer-wins only where lost updates are acceptable, and quorum or single-owner writes for hard invariants. Session tokens provide read-your-writes when users move between regions.

• During partition, keep owner-region writes and mergeable local operations available, but reject global uniqueness claims that cannot reach quorum. Regional evacuation requires fencing the old writer before promotion to prevent two legitimate primaries.

• Residency policy participates in routing and replication authorization, not just storage location. Encrypt inter-region logs, restrict repair tooling by tenant and purpose, and record every conflict override as an auditable administrative action.

• Track replication lag by tenant and stream, conflict rates by operation, rejected invariant writes, session-staleness violations, and evacuation time. Set separate SLOs for local availability and cross-region convergence.

• Budget for duplicate storage, inter-region egress, repair compute, and standby capacity during evacuation. Keep traffic local by default and replicate the minimum data needed for product semantics rather than every table to every region.

• Universal multi-leader storage maximizes write locality but forces every domain to solve conflicts. Home-region ownership is simpler and often sufficient; reserve global coordination for the small invariant surface that justifies its latency.

• Start with tenant home regions and async read replicas, instrument cross-region access, then enable active-active only for operations with tested merge rules. Backfill origin and version metadata before changing write routing, and rehearse fencing in production-like game days.

• The senior signal is refusing a single consistency slogan. A Staff candidate maps business invariants to distinct coordination costs and can explain exactly what the user sees during a partition, failover, conflict, and repair.

Interviewer evaluation rubric