Defence in depth

Assuming any single control will eventually fail and putting independent ones behind it. It applies well beyond security: a rate limit at the gateway and in the service, validation at the edge and in the schema, a review gate and a canary. The requirement people miss is independence — three checks that all read the same misconfigured flag are one control wearing three hats.