面试题库

14 天用 Agent 搭一条 AI 短剧生产线

D12 成本与模型路由：按环节选模型、缓存、降级与预算熔断

• 给一条会调用付费接口的流水线加预算熔断，你会怎么设计？做到什么程度才算安全停机？How would you design a budget circuit breaker for a pipeline that calls paid APIs, and what makes the stop safe?

  国内高频海外高频深入#budget-control#circuit-breaker

  分析过程 · 先想清楚再作答

  1. 这题的区分度全在「安全」两个字。多数人能答出「超预算就停」，但停完之后系统处在什么状态，才是面试官真正想听的。
  2. 先立第一条：判断必须发生在花钱之前。做法是预留式记账——每次调用付费接口前用一个纯函数预估这笔花费，从预算里扣，扣得动才发请求。事后统计只能告诉你已经超了，那时钱已经出去了。
  3. 第二条是两级上限的分工：软上限只提醒且只提醒一次，作用是让人在还有余地时决定继续还是降档；硬上限必须真的停。把两者做成同一个阈值，等于没有软上限。
  4. 第三条才是「安全停机」的定义，三个都要满足：已完成的产物一个不删、账本与停在哪一步落盘、缓存写入。少了任何一条，下一次带更高预算重跑就要把已经花掉的钱再花一遍——熔断反而成了浪费的放大器。所以直接退出进程是错的。
  5. 第四条是退款口径：失败或被内容安全拦下的调用如果厂商不计费，预扣的额度必须退回来，否则你会一边高估账单一边白占预算。台账上这类记录要单独标出来，面板上单独一行。
  6. 可预期的追问有两个。一是「并发下怎么保证不超」——预留必须是原子的，多个 worker 共享一个计数器时要走单点或原子操作，否则会超卖。二是「上限设多少」——用同一个预估函数按历史用量反推，而不是拍脑袋。

  How to reason about it · think before answering

  1. The discriminator is the word safe. Most candidates can say stop when over budget; what the interviewer wants is the state the system is left in afterwards.
  2. Rule one: the check happens before you spend. Use reservation-style accounting, projecting each paid call with a pure function and deducting it from the budget before issuing the request. After-the-fact accounting only tells you that the money is already gone.
  3. Rule two: the two thresholds do different jobs. A soft limit warns once so a human can decide whether to continue or downgrade; a hard limit must actually stop. Setting both to the same value means you have no soft limit.
  4. Rule three defines a safe stop, and all three parts are required: keep every finished artifact, persist the ledger and the point of interruption, and write the cache. Miss any one and the next run with a higher budget pays again for work already paid for, turning the breaker into a waste amplifier. Calling exit is therefore wrong.
  5. Rule four is refunds: if the vendor does not charge for failed or safety-blocked calls, the reserved amount must be released, otherwise you overstate the bill and silently consume headroom. Mark those ledger rows separately and show them as their own line on the panel.
  6. Two follow-ups to expect. Under concurrency the reservation must be atomic, so a shared counter needs a single owner or an atomic operation or you will oversell. And the limits themselves should be derived from historical usage through the same projection function, not guessed.

  答题要点

  • 预留式记账：调用付费接口前先预估并扣减，扣不动就不发请求
  • 软上限只提醒一次供人决策，硬上限必须真的停，两者阈值必须不同
  • 安全停机三条：产物保留、账本与断点落盘、缓存写入，绝不直接退出进程
  • 厂商不计费的失败调用要退回预扣额度，并在台账与面板上单独标出
  • 并发下预留必须原子；上限用同一个预估函数按历史用量反推

  Key points

  • Reserve before you spend: project the cost, deduct it, and skip the call if it does not fit
  • The soft limit warns once for a human decision; the hard limit must actually stop, with different thresholds
  • A safe stop keeps artifacts, persists the ledger and resume point, and writes the cache; never just exit
  • Release reservations for calls the vendor does not charge for, and show them as a separate ledger line
  • Make reservations atomic under concurrency and derive limits from historical usage via the same projector