Layered Security Architecture
Secure AI deployments use multiple independent controls. A content filter cannot replace authorization, and an approval dialog cannot correct an agent that can retrieve the wrong data.
Control Layers
| Layer | Controls | Main question |
|---|---|---|
| Identity | SSO, roles, teams, lifecycle, conditional access | Who is the user or service? |
| Sharing and authorization | Private/shared entities, team access, use/edit permissions | What can the identity see or manage? |
| Agent | Prompt, model, memory, skills, tools, interface | What is the agent designed to do? |
| Data | Collections, source permissions, classification, retention | Which knowledge can influence the answer? |
| Tool | Connections, provider scopes, function policy, validation | Which systems can the agent affect? |
| Approval | Risk-based confirmation and approver context | Which actions need a person? |
| Model | Approved providers, deployments, regions, evaluations | Where and how is inference performed? |
| Safety | Prompt Shield, content safety, quality tests | Which harmful or unreliable behavior is reduced? |
| Operations | Logs, monitoring, limits, response, recovery | Can the organization detect and contain failure? |
Design Principle
Enforce the important decision at more than one layer. For example, a production email agent can use a team-scoped service account, expose only read and draft functions by default, require confirmation for send, and log the final provider result. If one control is misconfigured, another still limits impact.
Review Order
When troubleshooting unexpected access or action, review the layers in this order:
- identity and team membership,
- entity sharing and permissions,
- agent data and tool assignments,
- connection and function policy,
- approval and execution history,
- external provider permissions and logs.
For infrastructure layers, continue with Reference Architecture and Network Security.