Defense in Depth for AI Systems

Overview

Defense in depth applies multiple security layers so that if one fails, others still protect the system. For AI applications, this means validating at every boundary: edge, gateway, input, authorization, data, LLM, output, and observability.

Core Principle: No single security control should be the only thing protecting sensitive operations.

The 8-Layer Security Architecture

┌─────────────────────────────────────────────────────────────────────────┐
│  Layer 0: EDGE           │  WAF, Rate Limiting, DDoS, Bot Detection    │
├─────────────────────────────────────────────────────────────────────────┤
│  Layer 1: GATEWAY        │  JWT Verify, Extract Claims, Build Context  │
├─────────────────────────────────────────────────────────────────────────┤
│  Layer 2: INPUT          │  Schema Validation, PII Detection, Injection│
│                          │  + Tavily Prompt Injection Firewall (opt.)  │
├─────────────────────────────────────────────────────────────────────────┤
│  Layer 3: AUTHORIZATION  │  RBAC/ABAC, Tenant Check, Resource Access   │
├─────────────────────────────────────────────────────────────────────────┤
│  Layer 4: DATA ACCESS    │  Parameterized Queries, Tenant Filter       │
├─────────────────────────────────────────────────────────────────────────┤
│  Layer 5: LLM            │  Prompt Building (no IDs), Context Separation│
├─────────────────────────────────────────────────────────────────────────┤
│  Layer 6: OUTPUT         │  Schema Validation, Guardrails, Hallucination│
├─────────────────────────────────────────────────────────────────────────┤
│  Layer 7: STORAGE        │  Attribution, Audit Trail, Encryption       │
├─────────────────────────────────────────────────────────────────────────┤
│  Layer 8: OBSERVABILITY  │  Logging (sanitized), Tracing, Metrics      │
└─────────────────────────────────────────────────────────────────────────┘

Layer Details

Layer 0: Edge Protection

Purpose: Stop attacks before they reach your application.

• WAF rules for OWASP Top 10
• Rate limiting per user/IP
• DDoS protection
• Bot detection
• Geo-blocking if required

Layer 1: Gateway / Authentication

Purpose: Verify identity and build request context.

@dataclass(frozen=True)
class RequestContext:
    """Immutable context that flows through the system"""
    # Identity
    user_id: UUID
    tenant_id: UUID
    session_id: str
    permissions: frozenset[str]

    # Tracing
    request_id: str
    trace_id: str

    # Metadata
    timestamp: datetime
    client_ip: str

Layer 2: Input Validation

Purpose: Reject bad input early.

• Schema validation: Pydantic/Zod for structure
• Content validation: PII detection, malware scan
• Injection defense: SQL, XSS, prompt injection patterns
• External scanning (optional): Tavily prompt injection firewall for web-sourced content — pre-filters RAG inputs before they reach the LLM layer

Layer 3: Authorization

Purpose: Verify permission for the specific action and resource.

async def authorize(ctx: RequestContext, action: str, resource: Resource) -> bool:
    # 1. Check permission exists
    if action not in ctx.permissions:
        raise Forbidden("Missing permission")

    # 2. Check tenant ownership
    if resource.tenant_id != ctx.tenant_id:
        raise Forbidden("Cross-tenant access denied")

    # 3. Check resource-level access
    if not await check_resource_access(ctx.user_id, resource):
        raise Forbidden("No access to resource")

    return True

Layer 4: Data Access

Purpose: Ensure all queries are tenant-scoped.

class TenantScopedRepository:
    def __init__(self, ctx: RequestContext):
        self.ctx = ctx
        self._base_filter = {"tenant_id": ctx.tenant_id}

    async def find(self, query: dict) -> list[Model]:
        # ALWAYS merge tenant filter
        safe_query = {**self._base_filter, **query}
        return await self.db.find(safe_query)

Layer 5: LLM Orchestration

Purpose: Build prompts with content only, no identifiers.

• Identifiers flow AROUND the LLM, not THROUGH it
• Prompts contain only content text
• No user_id, tenant_id, document_id in prompt text
• See llm-safety-patterns skill for details

Layer 6: Output Validation

Purpose: Validate LLM output before use.

• Schema validation (JSON structure)
• Content guardrails (toxicity, PII generation)
• Hallucination detection (grounding check)
• Code injection prevention

Layer 7: Attribution & Storage

Purpose: Reattach context and store with proper attribution.

• Attribution is deterministic, not LLM-generated
• Context from Layer 1 is attached to results
• Source references from Layer 4 are attached
• Audit trail recorded

Layer 8: Observability

Purpose: Monitor without leaking sensitive data.

• Structured logging with sanitization
• Distributed tracing (Langfuse)
• Metrics (latency, errors, costs)
• Alerts for anomalies

Implementation Checklist

Before deploying any AI feature, verify:

• Layer 0: Rate limiting configured
• Layer 1: JWT validation active, RequestContext created
• Layer 2: Pydantic models validate all input
• Layer 3: Authorization check on every endpoint
• Layer 4: All queries include tenant_id filter
• Layer 5: No IDs in LLM prompts (run audit)
• Layer 6: Output schema validation active
• Layer 7: Attribution uses context, not LLM output
• Layer 8: Logging sanitized, tracing enabled

Industry Sources

Pattern	Source	Application
Defense in Depth	NIST	Multiple validation layers
Zero Trust	Google BeyondCorp	Every request verified
Least Privilege	AWS IAM	Minimal permissions
Complete Mediation	Saltzer & Schroeder	Every access checked

Integration with OrchestKit

This skill integrates with:

• llm-safety-patterns - Layer 5 details
• security-checklist - OWASP validations
• observability-monitoring - Layer 8 details

---

Related Skills

• owasp-top-10 - OWASP Top 10 vulnerabilities that Layer 0-2 defend against
• auth-patterns - Detailed authentication/authorization for Layers 1 and 3
• input-validation - Input validation and sanitization patterns for Layer 2
• security-scanning - Automated security scanning for ongoing defense validation

Key Decisions

Decision	Choice	Rationale
Context object	Immutable dataclass	Prevents accidental mutation, ensures consistent identity flow
Tenant isolation	Query-level filtering	Defense in depth - application layer + database constraints
LLM prompt security	No identifiers in prompts	IDs flow around LLM, not through it - prevents prompt injection leaks
Audit logging	Sanitized structured logs	Compliance requirements while preventing PII exposure

---

Version: 1.0.0 (December 2025)

Capability Details

8-layer-architecture

Keywords: defense in depth, security layers, validation layers, multi-layer Solves:

• How do I secure my AI application end-to-end?
• What validation layers do I need?
• How do I implement defense in depth?

request-context

Keywords: request context, immutable context, context object, user context Solves:

• How do I pass user identity through the system?
• How do I create an immutable request context?
• What should be in the request context?

tenant-isolation

Keywords: multi-tenant, tenant isolation, tenant filter, cross-tenant Solves:

• How do I ensure tenant isolation?
• How do I prevent cross-tenant data access?
• How do I filter queries by tenant?

audit-logging

Keywords: audit log, audit trail, logging, compliance Solves:

• What should I log for compliance?
• How do I create audit trails?
• How do I log without leaking PII?