Title: Discussion 4 — What Does "Done" Look Like for a Defense-in-Depth Stack?
Course: AIINFRA 302: AI Security, Guardrails & Governance > Section: Week 04 — Prompt Injection Defenses and Input Validation

💬 Discussion 4 — What Does "Done" Look Like for a Defense-in-Depth Stack? (20 pts)

OWASP is explicit that prompt injection cannot be fully solved by input filtering alone — no fool-proof prevention is known to exist. That raises an uncomfortable but essential engineering question: if you can never reach 100%, when do you stop adding layers and ship? In a post of at least 200 words, address:

- Given everything you learned this week (spotlighting, instruction hierarchy, LLM Guard/Rebuff-style scanning, tool restriction, human approval, Dual LLM/CaMeL-style architectural isolation), what combination of layers would you consider "enough" for a customer-facing support chatbot that can look up account data but cannot take financial actions?
- What residual risk should a team formally accept, in writing, before launch — and who should be signing off on that acceptance (engineering lead, security team, legal, product)?
- How would you monitor for the failure cases that slip through, after launch?

Respond to at least two classmates. Push back respectfully if you think their proposed stack is either overbuilt for the risk level or leaves an obvious gap unaddressed — this is a topic where reasonable engineers can disagree on where the line sits, and the discussion is most valuable when you engage with why someone drew it where they did.