Defense in Depth, Eight Layers Deep: Anatomy of MAREF's Safety Stack

A single guardrail is a single point of failure. The PocketOS incident — nine seconds from "credential mismatch" to a wiped production database — happened because one gate was missed: there was no confirmation step on a destructive action. MAREF's answer isn't a better gate. It's eight of them, arranged so that no single layer's failure is fatal.

This is the second post in a series drawn from the MAREF technical whitepaper. It walks the defense-in-depth stack layer by layer, using the numbers from the paper.

---

Why Layers, Not Features

Defense-in-depth is the principle that security should degrade gracefully. If an attacker — or a runaway agent — gets past one layer, seven more stand between them and the blast radius. Each layer has a different enforcement mechanism, so a failure at one layer doesn't replicate at the next. The input controller can't be defeated the same way the filesystem guard can.

The Eight Layers

The stack runs on every operation, in order:

The 4-Tier Decision Tree

Layer 6 is where most operations get resolved, through a four-tier decision tree: Rule → Mode → SafetyGate → Human. The production distribution from the paper: Rule decides 40% of actions instantly, Mode 20%, SafetyGate 37%, and only 3% escalate to a human. The system handles 97% of decisions without human round-trips — while keeping the human on the 3% that matter: ambiguous or high-stakes actions. A confirmation gate, when it exists, sits exactly where PocketOS had none.

19-Class Threat Detection + 3-Strike Lock

Layer 5 runs 19 classes of runtime threat detection — from anomalous tool-call patterns to behavioral drift. When three anomalies fire in a row, the system auto-locks and triggers a circuit breaker with a cooldown. This is the automated version of the human instinct to "pull the plug": the system does it before the human has to run to the machine.

What It Stops in Practice

Layer by layer, the PocketOS scenario gets intercepted long before the destructive call: the API token with root permissions never makes it to execution (Layer 3 + 6 scoping), the anomalous volume-delete pattern fires 19-class detection (Layer 5), three strikes trigger the circuit breaker (Layer 5 + 7), and even if something slips through, every action lands in an immutable log the agent can't rewrite (Layer 8).

The full architecture — including the formal spec of the decision tree and the TLA+ verification of the governance states — is in Section 4 of the technical whitepaper and the Security Whitepaper. See the layers in 40 seconds in E07: 8 Layers of Defense.