Defense in depth assumes that any individual security control can fail. It combines identity, least privilege, isolation, input validation, monitoring, rate limits, backups, and incident response so that another layer can prevent, detect, contain, or recover from the failure.
The layers should be meaningfully independent rather than copies of the same assumption. For autonomous systems, a model policy is not a substitute for infrastructure enforcement. Agent permissions, network boundaries, immutable evidence, and human escalation should continue to work even when the model behaves unexpectedly.
ELI5
Defense in depth protects a system with several different barriers. If one barrier fails, another can still stop or limit the problem.
For example, an AI agent may be blocked from the internet, given temporary credentials and watched for unusual service use. If it finds a way around the network block, the credential limit or monitor can still prevent a larger incident.
