INPUT
输入层看进门材料 Input screens incoming material
识别已知注入模式、恶意附件或不允许的数据类型；它看不到尚未发生的工具动作。 Detects known injection patterns, malicious attachments, or forbidden data types; it cannot see a tool action that has not happened.
01 · 一扇门能守住整栋楼吗
01 · Can one door protect an entire building?
注入从输入进来，越权在工具前发生，敏感信息到输出才出现——只写“请安全”够吗？ Injection enters at input, overreach happens before a tool call, and sensitive data appears at output. Is “please be safe” enough?
02 四层闸门：送入攻击，再逐层断电 Four Gates: Send a Test, Then Power Layers Down
漏检 + 误拦同屏 misses + false blocks
当前样本
Current sample
BLOCK
input layer
威胁漏检率
Threat miss rate
0%
0/9 threats
正常误拦率
Benign false-block rate
15%
3/20 benign
03 四层各守一个时刻 Each Layer Guards a Different Moment
控制对象不可混算 different control targetsDECISION
决策层看意图与策略 Decision checks intent and policy
对模型提出的计划做策略判断，能补住部分绕过输入模式的攻击。 Evaluates the proposed plan against policy and can catch some attacks that evade input patterns.
TOOL
工具层看真实权限 Tool checks real authorization
按主体、动作、资源和范围授权；即使模型决策错了，也限制影响半径。 Authorizes subject, action, resource, and scope, limiting impact even when model judgment fails.
OUTPUT
输出层看交付内容 Output screens delivery
在内容离开系统前检测敏感字段、策略禁项或不允许的结构。 Detects sensitive fields, policy exclusions, or forbidden structures before content leaves the system.
04 最小测量：既看漏检，也看误拦 Minimal Measurement: Track Misses and False Blocks
FN rate + FP rate
miss = leaked threats / 9
false block = blocked benign / 20
false block = blocked benign / 20
关层可能减少误拦，却增加漏检。两个分母固定，不能只报“拦了多少”来证明安全。
Disabling layers may reduce false blocks while increasing misses.
With fixed denominators, “number blocked” alone cannot prove
safety.
威胁样本走全链
Threats traverse the chain
注入、越权、敏感输出
injection, privilege, sensitive output
正常样本也测试
Benign samples also tested
测量业务摩擦
measure business friction
按层定位责任
Attribute by layer
知道该调哪道门
know which gate to tune
05 边界实验：只留一道输入门 Boundary Test: Leave Only the Input Gate
主动制造失败 Create a failure注入被挡住，越权与敏感输出仍漏出 Injection is blocked; privilege and sensitive output still leak
只开输入层并送入越权样本。单层看似“拦过攻击”，却覆盖不了后续决策、工具与输出失效。 Enable only input and send a privilege sample. One layer may have blocked an attack before, yet it cannot cover later decision, tool, and output failures.
尚未执行。四层护栏当前开启。
Not run yet. All four guardrail layers are enabled.
✗ 系统提示写“不得越权”就是护栏。
A system prompt saying “do not overreach” is a
guardrail.
→ ✓ 提示只是输入控制面，真实工具权限必须独立执行。
A prompt is one control surface; real tool authorization must
be enforced independently.
✗ 拦得越多，护栏越好。
A guardrail is better if it blocks more.
→ ✓ 要同时报告威胁漏检与正常误拦。
Report both threat misses and benign false blocks.
✗ 一层做得足够强，就不用其他层。
One strong layer makes the others unnecessary.
→ ✓ 不同失效出现在不同时间点，需要分层控制。
Different failures emerge at different moments and need layered
controls.
06 · 一句话带走
06 · One line to keep