THE SAFETY ARCHITECTURE

LEARNING GOALS By the end of this chapter you will be able to explain defense in depth, describe prompt-level guardrails, explain schema-level tool gating and dual-agent separation, understand runtime approval systems with persistent permissions, and describe tool-level validation and user-defined lifecycle hooks. WHY NO SINGLE SAFEGUARD IS ENOUGH Imagine protecting a bank. The bank does not rely on a single front door lock. It has a locked door, cameras, an alarm, a guard, a vault with its own lock, and procedures that require two people to open the vault. If a thief defeats one protection, others still stand in the way. Safety for AI agents works the same way. Language models are not perfectly predictable. A model may sometimes ignore an instruction, misread a situation, or be tricked by clever wording. So a safe system cannot depend on the model always behaving well.