Place tenant data under conflicting residency and collaboration rules

• Classify content, identity, metadata, telemetry, and derived features separately; residency obligations rarely apply identically. Ask whether guest access allows remote processing, what support access is permitted, and which countries form approved zones.

• Assume tens of thousands of tenants, a small regulated subset, and cross-zone latency above 100 milliseconds. Measure guest collaboration and search patterns before building global copies to optimize rare access.

• Policy determines storage, processing, replication, backup, support, and deletion locations for every data class. The product must disclose degraded cross-zone features and produce evidence of placement and access.

• Assign each tenant a policy and home zone in a strongly controlled directory. Route writes and regulated processing to zonal data planes; expose cross-zone collaboration through scoped gateways that return authorized views without creating ungoverned replicas.

• Every record and event carries tenant, data classification, policy version, and allowed zones. Downstream consumers enforce a policy decision before persistence; denied derivations produce a visible capability status rather than a silent missing feature.

• The tenant home zone owns writes. Remote guests read through that authority or approved caches with bounded metadata; cross-tenant objects need an explicit ownership and copy contract instead of inheriting one collaborator’s policy accidentally.

• If policy lookup is unavailable, continue only with a cached signed policy within its validity window and fail closed on new exports. Regional failover must target an approved zone, which may mean lower availability for tightly constrained tenants.

• Use zonal encryption keys, workload identity, tenant-scoped access, and purpose-bound support elevation. Prevent sensitive payloads from leaking through logs, traces, queue dead letters, model prompts, or globally aggregated analytics.

• Continuously inventory where each data class exists, log policy decisions and access, alert on forbidden-zone writes, and test deletion propagation. Provide tenant-facing audit evidence without revealing internal topology.

• Residency reduces pooling and increases standby and operational cost. Price or constrain advanced locality requirements explicitly, and keep shared global services payload-blind where possible.

• Remote access to the home zone preserves policy but adds latency; approved replicated views improve experience but expand compliance scope. Choose per feature and make the trade visible in product commitments.

• Start with data inventory and policy tagging, block new unclassified sinks, then migrate regulated tenants by domain. Run policy in audit mode before enforcement and maintain a tenant-specific rollback that never moves data to a forbidden zone.

• Principal answers follow data beyond the primary database into backups, logs, support, and ML. They connect policy versions to runtime enforcement and admit when residency constraints reduce failover options or product functionality.

Interviewer evaluation rubric