---
type: claim
domain: ai-alignment
description: "Layering pre-commit hooks, CI validation, YARA signature scanning, Cedar policy evaluation, LLM semantic review, and human approval creates a validation stack where each layer catches different failure modes and the deny-overrides principle ensures no single-layer bypass compromises the system."
confidence: experimental
source: "Alex — based on Compass research artifact analyzing Sondera's three-subsystem architecture and the seven honest feedback loop principles (2026-03-08)"
sourcer: alexastrum
created: 2026-03-08
supports:
- cryptographic agent trust ratings enable meta-monitoring of AI feedback systems because persistent auditable reputation scores detect degrading review quality before it causes knowledge base corruption
- deterministic policy engines operating below the LLM layer cannot be circumverted by prompt injection making them essential for adversarial-grade AI agent control
related:
- structurally separating proposer and reviewer agents across independent accounts with branch protection enforcement implements architectural separation that prompt-level rules cannot achieve
reweave_edges:
- cryptographic agent trust ratings enable meta-monitoring of AI feedback systems because persistent auditable reputation scores detect degrading review quality before it causes knowledge base corruption|supports|2026-04-19
- deterministic policy engines operating below the LLM layer cannot be circumverted by prompt injection making them essential for adversarial-grade AI agent control|supports|2026-04-19
- structurally separating proposer and reviewer agents across independent accounts with branch protection enforcement implements architectural separation that prompt-level rules cannot achieve|related|2026-04-19
sourced_from:
- inbox/archive/2026-03-08-compass-building-honest-multiagent-knowledge-bases-on-forgejo.md
---

# Defense in depth for AI agent oversight requires layering independent validation mechanisms because deny-overrides semantics ensure any single layer rejection blocks the action regardless of other layers

A single validation mechanism — no matter how sophisticated — has blind spots. Sondera's reference monitor demonstrates the defense-in-depth principle by combining three independent guardrail subsystems: a YARA-X signature engine for deterministic pattern matching (prompt injection, data exfiltration, secrets), an LLM-based policy model for probabilistic content classification, and an information flow control layer for sensitivity labeling. All signals feed into Cedar policies where a single matching `forbid` overrides any `permit`.

The deny-overrides principle is architecturally critical. In a system where multiple independent validators each return approve/deny decisions, two composition semantics are possible: any-approve (optimistic — action proceeds if any validator approves) or any-deny (pessimistic — action blocks if any validator denies). For safety-critical systems, any-deny is the correct choice because it means an attacker must bypass *every* layer simultaneously rather than finding one permissive layer.

Applied to a multi-agent knowledge base, the defense-in-depth stack includes:

1. **Pre-commit schema validation** (local, deterministic) — catches malformed files before they enter version control
2. **CI validation via Forgejo Actions** (server-side, deterministic) — catches `--no-verify` bypasses and ensures validation runs even when agents skip local hooks
3. **YARA signature scanning** (deterministic) — pattern-matches for known misinformation patterns, exfiltration attempts, and injected content
4. **Cedar policy evaluation** (deterministic) — enforces structural constraints: who can modify what, required approvals, step-count limits
5. **LLM-based semantic review** (probabilistic) — evaluates content quality, checks evidence strength, assesses whether claims meet intellectual standards
6. **Human approval** (final gate) — catches everything the automated layers miss

Each layer operates on different information:
- Layers 1-2 see file structure
- Layer 3 sees content patterns
- Layer 4 sees agent identity and action context
- Layer 5 sees semantic meaning
- Layer 6 sees everything through human judgment

The independence of these layers is what makes the system robust. A prompt injection attack might fool layer 5 (LLM semantic review) but cannot fool layer 3 (YARA signatures) or layer 4 (Cedar policies). A novel attack pattern might evade layer 3 (YARA) but be caught by layer 5 (LLM review). Only an attack that simultaneously bypasses all six layers succeeds — and each additional independent layer exponentially reduces the probability of total bypass.

This maps directly to the alignment insight that [[scalable oversight degrades rapidly as capability gaps grow with debate achieving only 50 percent success at moderate gaps]]. No single oversight mechanism is reliable enough on its own. But layered oversight where each mechanism is independently operated and uses deny-overrides composition can achieve reliability that no individual layer provides.

---

Relevant Notes:
- [[deterministic policy engines operating below the LLM layer cannot be circumvented by prompt injection making them essential for adversarial-grade AI agent control]] — deterministic layers (1-4) provide the unforgeable foundation; probabilistic layers (5-6) provide semantic depth
- [[scalable oversight degrades rapidly as capability gaps grow with debate achieving only 50 percent success at moderate gaps]] — defense in depth compensates for individual layer degradation by ensuring multiple independent checks
- [[safe AI development requires building alignment mechanisms before scaling capability]] — the validation stack should be in place before agents are trusted with autonomous knowledge base contributions
- [[knowledge validation requires four independent layers because syntactic schema cross-reference and semantic checks each catch failure modes the others miss]] — the four-layer validation model applied specifically to knowledge files

Topics:
- [[domains/ai-alignment/_map]]