Layered controls can make powerful systems easier to trust and use.
Several ways to catch a mistake
A trained pilot matters, but aviation also relies on checklists, maintenance, monitoring, and coordination. Similarly, an AI application can combine trained behavior with independent checks and operational controls.
Choose the mechanism for the job
A fixed spending limit is often better enforced by deterministic code than by asking a model to remember it. A model can help interpret ambiguous language. A sandbox restricts what code can affect. These mechanisms solve different problems.
Test the connections
A strong component can still be undermined by a weak integration. Check what happens when a detector times out, an approval is stale, a tool returns unexpected content, or a logging system misses an event.
Assign a job to each layer
A useful design maps a risk to a control and an owner. Input checks can identify suspicious content; permissions constrain available actions; an isolated workspace limits exposure; output review checks what leaves the system. Monitoring helps investigate what happened. The design question is whether the chosen layers cover the actual failure paths.
More checks can create new failure points
A second model adds delay, another service dependency and another place that may handle sensitive data. If every checker uses the same incomplete context or assumptions, adding more may not address the original weakness. Our recommendation is to evaluate the combined workflow, including its failure handling, rather than count the number of safeguards.
Failure handling is part of the design
OWASP’s agent guidance treats tools, memory, permissions and monitoring as parts of the security problem. A practical implication is to test outages and handoffs as well as model outputs: what occurs when a check times out, a tool succeeds without returning a receipt, or an approval no longer matches the proposed action?
Source: OWASP · AI Agent Security Cheat SheetA situation to think through
An invoice assistant extracts bill details, checks them, prepares a payment and requests approval. The amount limit should be enforced by the payment service; the model should not be the only component remembering it. Logs should help resolve uncertainty without indiscriminately retaining every invoice forever.
Questions to take with you
- Map each consequential failure to a specific control.
- Identify what happens when that control is unavailable.
- Test the entire workflow, including retries, review and recovery.
For more reading
The sources behind this page, with a reason to open each one. Practical examples and recommendations are our editorial interpretation.
- AI Agent Security Cheat Sheet
Practical guidance on tool permissions, memory isolation, oversight and agent failure handling.
- LLM Prompt Injection Prevention Cheat Sheet
Threat examples and layered defenses for applications that process untrusted text.
- Generative AI Profile · NIST AI 600-1
A framework for identifying, measuring and managing generative AI risks across the system lifecycle.
Sources reviewed 13 September 2026. Product documentation can change. How we use evidence