Defense-in-depth for LLM and agent systems: input filters, tool gates, output checks, and human escalation — because a polite system prompt is not a security boundary.