Good security architecture doesn’t ask whether to build controls like PII masking, rate limiting, and audit logging. It asks where. The right answer is both layers: platform-native first, with engineering teams adding controls on top. That’s defense-in-depth.
Building without a foundation means engineering teams aren’t making security decisions. Instead, they’re filling gaps, reactively, on every new agent deployment and every new channel. But when a solid foundation exists, these teams are able to build intentional controls on top of something that holds.
That’s where the architectural question becomes a roadmap question. When platform-native controls exist, engineering leaders can see what their team is actually building and assess what adds genuine protection, and what’s just reconstructing infrastructure the platform should already own. That determines whether engineering teams are building toward the next capability or just keeping the lights on.