2026-04-13

Defense In Depth For Agentic APIs

A practical layering model for pre-execution controls, semantic vetoes, and tamper-evident receipts.

agentsapi-securityaudit

Layer 1: Input Hardening

Normalize and decode user-controlled payloads before any semantic decisioning. This reduces obfuscation wins.

NFKC normalization, control character stripping, and bounded decode depth are strong baseline controls.

Aletheia separates Scout, Nitpicker, and Judge concerns. Any one layer can deny execution.

Separating detection from enforcement limits single-point bypasses and improves explainability.

Decisions should emit signed receipts bound to policy version, manifest hash, and request identity.

Replay-resistant tokens and hash-chained audit records create stronger forensic guarantees under incident pressure.