No single filter is sufficient. Defense in depth assumes that one control may fail and another must still contain the impact.
Least Privilege and Zero Ambient Authority
Give each request the minimum capability needed for the current step and the shortest useful lifetime. Do not place broad credentials in prompts or give every tool access to every resource. Bind delegated credentials to user identity, tenant, action, resource, and expiration.
Reliability Controls
Control
Purpose
Timeout
Stops a call that is not completing
Retry with backoff
Handles transient failure without creating a retry storm
Circuit breaker
Stops repeated calls to an unhealthy dependency
Idempotency key
Prevents duplicate side effects during retries
Checkpoint
Allows long-running work to resume safely
Fallback / degradation
Preserves a reduced but safe service when a model or tool is unavailable
Escalate Consequence, Not Confusion
Human approval is most useful before irreversible or high-impact actions. Show the proposed diff, evidence, scope, and consequence so the reviewer can make a real decision. Do not use a generic approval button to hide an underspecified design.
Key Takeaways
Guardrails span input, context, output, and action boundaries.
Least privilege limits the blast radius of model mistakes and attacks.
Timeouts, idempotency, checkpoints, circuit breakers, and fallbacks make failure bounded and recoverable.
A payment tool times out after submitting a charge. What is most important before retrying?
Which action most clearly deserves human approval?