Defense in Depth

Explains why filtering alone cannot separate instructions from data in natural language.

Tracks where content came from so later decisions can use origin as evidence.

Judge whether a provenance record is valid evidence in a controlled simulation.

Inspection produces probabilistic evidence, not authorization.

Detection findings are signals to act on, not proof of compromise or a permission decision.

Decides deterministically whether a resolved action may execute, independent of what the model proposed.

Governs whether specific data may move to a specific sink.

Decide whether specific data may move to a specific sink in a controlled simulation.

Validates structure; sink-specific encoding and permission remain separate.

Limits which identities, tools and capabilities exist at all.

Judge whether an authority envelope is minimized for its task in a controlled simulation.

Controls which network paths exist, separately from action authorization.

Decide whether a workload may reach a resolved destination in a controlled simulation.

Caps the blast radius of influenced execution without making output trusted.

Responds by evidence state, from suspicious content to confirmed impact.

Classify synthetic evidence as confirmed impact or not yet confirmed in a controlled simulation.

Tests find weaknesses; a passed test does not prove security.

Practice separating source, representation and trust in a controlled simulation.

One architecture example that separates control and data flow; a single paper, not a universal standard.