THE SAFETY ARCHITECTURE

LAYERED, DEFENSE-IN-DEPTH SAFETY Defense in depth means several independent safeguards stacked together, so that the failure of one does not lead to disaster. The word independent is critical. If two safeguards both depend on the same weak assumption, they fail together, which is no better than one. A good stack uses different kinds of protection, based on different mechanisms, so an attacker or an accident would need to beat all of them at once. Another way to say this is that you should avoid a single point of failure, which is any one part whose breaking brings down the entire protection. Picture slices of Swiss cheese stacked together. Each slice has holes, but the holes are in different places, so it is hard for anything to pass straight through all slices. The typical layers in an agent harness, from softest to hardest, are the following. Layer one: prompt-level guardrails, which are instructions. Layer two: schema-level tool gating, which controls which tools exist for the model at all. Layer three: runtime approval, where a human or policy engine approves actions as they occur. Layer four: tool-level validation, where each tool checks its own inputs. Layer five: lifecycle hooks, which are custom checks that run at defined moments. Beyond these, later chapters add sandboxing (Chapter 40), network limits, and monitoring.