When should cross-cutting concerns use a shared versus duplicated solution?

WHAT THIS TESTS: The interviewer is probing whether you treat architecture as an emergent property rather than a predefined blueprint. Specifically, they want to see you recognize that cross-cutting concerns such as logging, authentication, or metrics inherently resist clean encapsulation within a single module. They are listening for your ability to evaluate the tension between DRY principles and the coupling introduced by shared infrastructure, particularly in polyglot or multi-team environments where deployment independence and team autonomy matter.

A GOOD ANSWER COVERS: Four elements in order. First, an explicit cost model that compares the friction of duplication against the friction of coordination. Second, concrete evaluation criteria such as change frequency, blast radius if the shared component fails, team topology and Conway's Law implications, and whether the concern is truly invariant or varies by domain. Third, a decision mechanism like an Architecture Decision Record or a fitness function that forces the team to re-evaluate the choice as the system evolves rather than treating it as permanent. Fourth, the recognition that shared solutions create platform teams or dependency graphs that can become bottlenecks, so you should default to duplication when teams are autonomous and services are independently deployable, then extract a shared solution only when pain data justifies it.

COMMON WRONG ANSWERS: Three red flags stand out. One, defaulting immediately to a shared library or framework because duplication feels wrong without measuring the coordination overhead. Two, ignoring team topology and forcing every service to use a centralized auth or logging platform even when teams have different release cycles or tech stacks. Three, confusing a cross-cutting concern with a core domain concept; if authentication is a business differentiator, it deserves different treatment than commodity logging.

LIKELY FOLLOW-UPS: The interviewer may ask how you would migrate from duplicated implementations to a shared one safely, how you version a shared authentication client without breaking downstream consumers, or how you handle a cross-cutting concern that scatters logic but cannot be cleanly extracted due to tangling with domain code.

ONE CONCRETE EXAMPLE: Suppose three microservices initially implement request logging independently using their respective language idioms. After six months, observability requirements converge and operators struggle with inconsistent trace formats. You propose a lightweight shared logging schema and a thin wrapper, but only after measuring that the duplicated parsing code now costs more in incident response time than the overhead of versioning one shared library. You keep the transport layer decoupled so teams can still adopt it asynchronously.