Interview prompt
Problem context
Skills being evaluated
Use the sequence below to surface constraints, choose boundaries, test failure behavior, and defend trade-offs. Concrete numbers are interview assumptions, not claims about a real production system.
Clarify the decision
- Identify the capability boundary, every reader and writer, invariants, reporting latency, and acceptable coexistence duration. Declare the intended final authority before creating synchronization.
Establish scale assumptions
- Inventory table access from query logs and code, classify critical paths, and estimate backfill and CDC lag. Hidden monthly jobs are migration scope even if product traffic is small.
Functional and non-functional requirements
- One authoritative writer at every phase, old and new reads remain correct, synchronization is observable and repairable, and direct legacy access declines to zero.
High-level architecture
- Put a routing facade at the behavior boundary, introduce a canonical write path, publish changes through outbox or CDC, and build a new owned store. Use shadow reads and comparison before cohort routing.
Data model and flow
- Backfill from a consistent position, stream later changes, and track per-entity versions. Legacy writes either pass through an adapter or remain authoritative until their specific cohort moves.
Consistency and transaction boundaries
- Avoid bidirectional dual writes; transfer authority by operation or tenant with fencing. Reports consume a documented projection rather than retaining direct ownership of transactional tables.
Failure modes and recovery
- If the new path fails, route only cohorts whose old path remains compatible; after authority transfer, rollback may require reverse synchronization. Reconciliation detects missed or transformed changes.
Security and privacy
- The facade enforces equivalent authorization and tenant policy, and CDC does not leak sensitive columns to consumers. Remove broad database credentials as readers migrate.
Observability and SLOs
- Track direct table access, cohort routing, shadow divergence, CDC lag, legacy writes, reconciliation, and bridge age. A migration dashboard names owners for every remaining dependency.
Capacity and cost
- Temporary stores and dual reads are migration cost with an expiry. Budget them explicitly and stop adding features to the legacy data contract.
Alternatives and trade-offs
- A shared database bridge accelerates behavior extraction but preserves coupling; CDC decouples reads but adds lag. Use them as controlled transitional mechanisms with deletion gates.
Evolution and migration
- Discover access, centralize writes, backfill and shadow, move low-risk reads, transfer write cohorts, migrate reports, revoke credentials, then remove old tables and adapters.
What Staff and Principal candidates should emphasize
- Staff candidates always state who owns writes now and next. They make bridge removal an engineering deliverable and handle rollback after authority changes honestly.
Decision trade-offs
Transition writes
Option A
Application dual-writes to both stores
Option B
Single authority plus outbox or CDC projection
Recommendation:Keep one write authority and derive the other store; bidirectional application writes create an ambiguous conflict system.
Migration unit
Option A
Move the entire customer table at once
Option B
Move capability, operation, or tenant cohorts
Recommendation:Choose a unit with enforceable routing and invariants so progress is incremental and rollback scope is bounded.
Follow-up interview questions
- 01How do you find unknown direct database readers?
- 02When does write authority move?
- 03How does rollback differ after write cutover?
- 04How do reports migrate without blocking the product path?
Common weak answers and mistakes
- 01Calling shared-table access temporary without an inventory or revocation plan.
- 02Allowing both systems to accept writes and relying on timestamps.
- 03Moving application code while leaving data ownership unchanged.
- 04Removing the legacy path before shadow divergence and rollback are understood.
Interviewer evaluation rubric
Adds a facade but leaves dual ownership, hidden readers, synchronization, and bridge removal undefined.
Uses access inventory, single authority, backfill plus CDC, shadow reads, cohorts, and credential removal.
Adds fencing, report projections, post-cutover rollback, reconciliation, security parity, and explicit exit gates.
Aligns business capability, team ownership, and data authority through a migration that steadily reduces rather than relocates coupling.