Katkat
Back

Design enterprise file recommendations under ACLs

DropboxData Scientist · Technical Screen
MediumData ScientistTechnical ScreenMachine Learning

Last updated

This problem tests the ability to design a multi-tenant recommendation system that enforces complex security constraints while maintaining low latency.

Problem Statement

You are designing a recommendation system for an enterprise file-sharing platform. The system suggests the 'next likely file' a user will open based on their history and global activity. The system must operate under strict multi-tenant isolation, meaning users from 'Company A' must never receive suggestions for files belonging to 'Company B', even if those files are globally popular or conceptually relevant.

Requirements

  1. Data Isolation: Ensure that the training data and inference context do not cross tenant boundaries.
  2. ACL Enforcement: The recommender must only suggest files the user has explicit permission to view. Permissions change frequently as users are added to/removed from folders.
  3. Latency: The system must return top-k recommendations in under 100ms.
  4. Scale: The system serves millions of users across thousands of companies.

Deliverables

  • Describe the high-level architecture for model training and inference.
  • Propose a strategy for enforcing Access Control Lists (ACLs) within the recommendation pipeline.
  • Explain how you handle cold-start issues for new files while maintaining tenant isolation.

Constraints

  • You cannot leak information across tenants through model gradients or shared embeddings.
  • Access control checks should be performed as close to the ranking stage as possible to minimize invalid suggestions.

Hints

Hint 1

Consider whether you should use a single global model with multi-tenant embeddings or separate models per tenant.

Hint 2

Think about using a two-stage retrieval-ranking architecture where the retrieval stage focuses on feasibility and the ranking stage focuses on relevance.

Hint 3

Evaluate the trade-offs between filtering ACLs before or after the ranking stage, considering the latency overhead of querying a distributed permission service.

Follow-up questions

  • How would you handle a scenario where a user is granted access to a new, highly relevant file that hasn't appeared in their history yet?
  • If the number of files grows to billions, how would you optimize the retrieval stage to remain within the 100ms latency limit?
  • How would you evaluate the model's performance while ensuring that 'relevance' metrics aren't artificially deflated by strict permission filters?