What is Defence in Depth (Agent)?
A security strategy that layers multiple independent controls — policy enforcement, argument validation, rate limiting, audit logging, and fail-closed design — so that no single point of failure compromises the security of an AI agent system.
WHY IT MATTERS
Defence in depth is a military concept applied to information security: if the outer wall is breached, the inner walls still hold. For AI agents, this is not just good practice — it is essential, because no single control is sufficient.
Consider the layers. System prompts instruct the agent on intended behaviour, but they can be overridden by prompt injection. Tool-level access control restricts which tools are available, but does not validate arguments. Argument validation checks parameters, but does not prevent abuse through volume. Rate limiting constrains volume, but does not detect sophisticated attacks. Audit logging provides visibility, but does not prevent anything. Each control addresses a different failure mode.
The strength of defence in depth is that an attacker must defeat every layer, not just one. A prompt injection that bypasses the system prompt still faces tool-level policies in Intercept. Even if the attacker finds a permitted tool, argument validation blocks dangerous parameters. Even if arguments pass validation, rate limiting constrains the volume of damage. Even if all active controls are bypassed, the audit trail captures everything for post-incident response.
The weakness of relying on any single control is catastrophic failure. Organisations that rely solely on system prompts have no defence against prompt injection. Those that rely solely on network segmentation have no defence against compromised internal agents. Layering is the only resilient approach.
HOW POLICYLAYER USES THIS
Intercept provides multiple layers of defence in a single enforcement point. Tool-level allowlists and denylists control which tools are accessible. Argument conditions validate parameters against constraints. Rate limiting prevents abuse through volume. Fail-closed design ensures that infrastructure failures do not create security gaps. Structured audit logging captures every decision for accountability. These layers are defined declaratively in YAML policies, making the entire defence-in-depth posture reviewable, version-controlled, and reproducible.