Defense in Depth for Agentic AI

A request crosses independent layers from TLS at the edge to OpenTelemetry

Defense in Depth for Agentic AI A request crosses independent layers from TLS at the edge to OpenTelemetry Customer · untrusted request · Architecture component · L0 Customer untrusted request L0 TLS Edge · mTLS terminate · Architecture component · L1 TLS Edge mTLS terminate L1 WAF + Auth · identity + rate limit · Architecture component · L2 WAF + Auth identity + rate limit L2 Input Guard · prompt-injection filter · Architecture component · L3 Input Guard prompt-injection filter L3 Policy Gate · tool allowlist · Architecture component · L4 Policy Gate tool allowlist L4 Agent Runtime · sandboxed · Architecture component · L5 Agent Runtime sandboxed L5 Output Guard · DLP + PII scan · Architecture component · L6 Output Guard DLP + PII scan L6 OpenTelemetry · traces + audit · Architecture component · L7 OpenTelemetry traces + audit L7 HTTPS verified TLS authn'd scoped tools raw output redacted + logged Legend External Security Backend Cloud

Layered Ingress

  • • TLS, WAF/auth, and input screening are separate stages
  • • Each stage can fail closed on its own
  • • No adjacent pair shares one point of failure

Guarded Core

  • • Policy gate scopes tools before the agent runs
  • • The agent executes sandboxed, never trusted
  • • Output guard applies DLP and PII scanning after

Shared Evidence

  • • All layers emit to OpenTelemetry
  • • Audit trail spans the full crossing
  • • Eleven layers total; the hot path shows the core eight

Architecture diagram • Built with Archify • Create yours ↗ • Hover to trace • R route • Click to focus • +/− zoom • M radar • [/] views • P play story • T theme • E export