Design an AI ticket investigation agent
PremiumLLM systemHard
- AI agents
- Root cause analysis
- Least privilege
Quick answer
This LLM system interview question asks you to design an AI ticket investigation agent. Aim for a design that uses language models to serve users well, then explain retrieval, prompting, serving, evaluation and trade-offs. Interviewers want to see how you control quality, cost and latency, and how you evaluate the results.
The problem
An AI ticket investigation agent triages each new engineering ticket, investigates it with read-only logs, metrics and change history, finds similar past incidents, and posts an evidence-backed root cause for the on-call engineer. The hard part: huge tool outputs, untrusted input, personal data in logs, and proving it really saves time.
A large tech company runs about 10,000 internal services. Engineers, support staff and automated alerts file tickets into one ticketing system: "checkout API returning 500s in eu-west since 14:05" or "p99 latency on feed ranking doubled". The first 30 to 60 minutes of most tickets go on the same chores: find the owner, open dashboards, search logs, check what changed, and ask whether this happened before. It has been reported at Meta in senior AI and infrastructure interviews.
A single log query can return far more text than any model can read, ticket text and log lines are untrusted input, the agent touches production data that contains personal information, a confident wrong answer misleads engineers, and you must prove the agent actually shortens resolution time.
What must an AI ticket investigation agent do?
- Root-cause report: Post a report on the ticket with the suspected root cause, a confidence level, evidence with a link to every query it ran, hypotheses it ruled out, and suggested next steps.
- Investigation tools: Query logs with service and time filters, metrics and dashboards, deploy and config change history, feature-flag history, code search and runbooks, all read-only.
How well must it do it?
- Safety: Zero write actions by the agent; every tool call is read-only, logged and attributable to one investigation.
- Latency: Triage within 30 s p95; first findings on SEV1/SEV2 tickets within 5 minutes p90; full report within 15 minutes p90.
What scale should you design for?
Use these numbers in your estimates.
The scale numbers unlock with this questionUnlock
Key concepts
- AI agents
- Root cause analysis
- Least privilege
- Tool use
- Prompt injection
- RAG
How you’ll practise
- Problem framing
- Data and retrieval
- Prompting and orchestration
- Evaluation and safety
- Serving, cost and latency
- Wrap-up
Lala, personalized to you, gives a hint when you ask and reviews your design when you are ready.
What do interviewers look for?
In any LLM system design round.
- Defines the user task and what a good answer is
- Explains how relevant context reaches the model
- Plans evaluation before and after launch
- Controls cost and latency with caching and routing
- Covers safety, privacy and abuse
- Handles failures and fallbacks gracefully
Questions people ask about this interview question
- Which design type is this question?
- It is an LLM system question. You design an AI ticket investigation agent and explain your choices the way you would in an interview.
- Is this question asked at entry level?
- It is marked Hard. It suits engineers preparing for senior interviews, where you are expected to drive the discussion and go deep on trade-offs.
- What should I cover first?
- Start with the user task, what a good answer looks like and how it will be measured. Agree on scope with the interviewer before you design anything.
- Can I practise it for free?
- It is a premium question. Sign up and unlock it once for 10 credits; it then stays unlocked. When you finish, Lala, your personalized AI mentor, can review your design for 30 credits.
Related questions
Updated · Written by the SevyDevy team