Clean Architecture makes a lot of sense for keeping the 'reasoning' layer separate from the actual tool execution. One thing I’m seeing a lot lately in the orchestration space is that people forget to treat the LLM as an untrusted external dependency, similar to a database or a third-party API.

Even with a clean setup, if your 'Domain' logic doesn't have a strict security boundary for tool-sinks, the agent can end up being manipulated into bypassing the intended architecture entirely. Are people building specific 'Security Interceptor' layers for their AI projects, or just relying on the built-in filters provided by frameworks like Semantic Kernel/Agent Framework?