Defense in Depth

The five-layer model:

1. Input filtering. Strip obvious injection patterns. Use tools like LlamaGuard 3 or Azure AI Content Safety.
2. Privilege separation. Tools that touch sensitive data require human-in-the-loop confirmation, not just an LLM decision.
3. Output filtering. Scan responses for sensitive patterns (CC numbers, SSNs, internal hostnames) before sending.
4. Sandboxed tools. Code execution in Firecracker / e2b / Modal sandboxes — never on your prod box.
5. Audit logging. Every tool call gets logged, alarmed, and reviewed.