Design Permission-Scoped Search

Put the leak first, because permissions here are the system and not a filter you add at the end. Atlassian sells software to companies whose whole reason for using it is keeping the right work in front of the right people. Think of a security-team Confluence space, an unannounced-acquisition Jira project, or an HR issue with salary in a custom field. One of the five values is "Don't #@!% the customer," profanity included and entirely deliberate, and leaking one tenant's private issue into the wrong person's search results is exactly the failure that value names. Interviewers on this prompt are known to ladder the difficulty on purpose. They start you at "search 10M issues fast." Then come the constraints: "now make it multi-tenant," "now permissions depend on the issue's fields and change hourly," "now a user was just deprovisioned, how fast do their results go dark." Opening on authorization instead of the index tells them you already know where the round is heading.