How the interviewer opens it
“Design the system that limits how many screens a Netflix account can stream on at the same time. It should work across devices and regions.”
The prompt is vague on purpose. The first few minutes are yours: narrow it to the core features and agree on the numbers before you draw anything.
What to clarify first
- Plans and counting
- Scale
- Traffic mix
- Lease and disconnect behavior
- Latency
- Consistency versus availability
- Playback enforcement
- Durability and regional failure
- Behavior at the limit and on stop
- Scope boundary
The answers stay with the interviewer. In a SysRound round, Alex answers them as an interviewer would.
Scope of a strong answer
Core requirements
- Allow or reject a playback start against the account's plan limit
- Renew active sessions and reclaim capacity after stops, crashes, or disconnections
- Enforce the account-wide limit across devices and regions
- Connect session authorization to playback so a rejected or expired session cannot keep fetching playable video
Usually out of scope
- Video storage, encoding, and CDN design
- Building DRM or device authentication
- Offline downloads
- Household detection and account-sharing policy
- Billing
What interviewers probe
- Atomic admission and retry-safe session transitions
- An account may have only one free slot while several regions submit starts. Network retries and delayed heartbeats can create extra sessions or resurrect sessions unless every transition has a precise atomic rule.
- Lease expiry versus actual playback
- A correct counter is not enough: a device may retain usable media credentials after the service thinks its slot is free. Fast slot reuse, crash recovery, and bounded playback enforcement must agree on the same authorization lifetime.
- Global ownership and safe regional failover
- Independent regional counts can each be correct locally while exceeding the account-wide limit. Failover is especially dangerous because a new owner may not know which credentials the old owner already issued.
Common mistakes
- Designing a login-device registry instead of counting active playback instances.
- Using an eventually consistent global counter for a strict account-wide limit.
- Freeing a slot while old playback credentials are still valid.
- Allowing delayed heartbeats to resurrect stopped or expired sessions.
- Sizing for starts per second and overlooking millions of renewal writes per second.
- Describing regional failover without accounting for lost leases, old writers, or credentials already issued.
The bar by level
- Senior (L5/E5)
- Owns the full session lifecycle: retry-safe transitions, no resurrection, token lifetime tied to leases, safe stop behavior, and write-throughput sizing. Chooses a single authoritative path per account and explicitly trades availability for correctness during partitions.
- Staff (L6+/E6+)
- Defines the exact enforceable invariant and its boundary with buffering and device trust. Works through ownership transfer with stale replicas, old-owner fencing, clock uncertainty, and outstanding credentials. Distinguishes the simplest safe home-region design from more available alternatives, including their operational costs and required product compromises.