Defense-in-Depth Control Plane
Strong security architecture assumes individual controls can fail. Identity, network, workload, data and detection layers should reduce blast radius together and produce evidence for investigation.
No single control should carry the whole security model.
Detection is a first-class architectural layer.
Identity and workload policy should reduce lateral movement.