Principle
Layer safeguards so one miss is not the last chance
One safeguard is also one point of failure.
When it fits
- A single missed check, wrong assumption or failed control can directly create a high-cost consequence.
When to avoid it
- More controls can add delay, complexity and new failure modes. Use layered protection where consequence and residual risk justify it.
Why it matters
For consequential paths, consider more than one protective layer: prevent the invalid action, detect deviation, contain its spread and recover if it escapes. Prefer layers that fail differently rather than repeating the same data, assumption or operator action. A second checkbox fed by the same wrong source is not much of a second defense.
An example
A bulk data change can use input validation, a small canary batch, post-write reconciliation and a tested rollback path instead of trusting one pre-run review.
Check your result
A single plausible control failure does not automatically become the final harmful state, and shared failure modes are named.
Keep this limit in mind
- More controls can add delay, complexity and new failure modes. Use layered protection where consequence and residual risk justify it.
Connected ideas
Useful withRecheck the safeguard after the workflow changes
Evidence and sources
CMS describes defense-in-depth as multiple coordinated security countermeasures and layers of protection rather than reliance on one control.
This is security architecture guidance. Applying layered protection to general operational errors is an editorial analogy that still requires domain-specific design.
TRA Guiding Principles · Defense-in-Depth