Does "Impossible, Not Tedious" Kill Defense-in-Depth? Layered Friction, Agent-Relativity, and the Frequency Paradox#

The questions#

Three #oq/now items from the friction-vs-barrier cluster, answered as one synthesis:

1. Defense-in-depth traditionally stacks friction controls on the theory that enough of them sum to a barrier. Does the Impossible, Not Tedious (Design Test) invalidate layered friction, or just demote it below capability-removal?
2. Some controls are friction for humans but barriers for agents (or vice versa). Is the test agent-relative, and how do you evaluate it for mixed human/agent threat models?
3. Least Agency adds a frequency dimension ("how often"), but the same framework says rate limits are friction, not barriers. How is frequency-limiting both a least-agency control and a friction-only one?

Answer 1: Demote, not invalidate — and the mechanism is correlated failure#

Friction layers never sum to a barrier, because their failures are not independent under an adaptive attacker. Classical defense-in-depth arithmetic assumes each layer fails independently, so stacking multiplies the attacker's pass-probability toward zero. Against an adaptive optimizer that assumption is false: the attacker optimizes against the joint deployed system, so the layers fail together. The measured instance is AutoDojo — its black-box loop specializes an injection "against the defense without ever identifying it," because the live defense (whatever stack is deployed) is implicitly part of every fitness evaluation. One optimization loop attacks the whole stack as a single surface; adding another layer of the same kind (another content detector, another filter) just changes the environment the loop optimizes against. Its authors state the structural reason: any content-level defense faces an attacker who "always moves last."

The empirical record backs each half:

• Homogeneous friction stacks collapse jointly. Nasr et al. drove twelve published in-band defenses above 90% attack success — spotlighting and sandwiching above 95% — near-inverting their static scores (Out-of-Band Prompt-Injection Defense). A filter reporting 0% static ASR leaks 28% (64% on action-open tasks) under a cheap, six-iteration, black-box attack (Task-Specification Effects in Prompt Injection (AutoDojo)). Twelve tediums did not make an impossible.
• The adaptive floor of a pure-friction stack is set by the model, not the layer count. AutoDojo barely moves ASR on capable models undefended (Claude-Haiku-4.5 0.3%→1.8%) while recovering double digits against filters on weak models — "the floor is a property of the model, not the layered filter defense" (Agentic Prompt Injection, stacked-residual open question). Stacking more friction cannot buy a floor the underlying model doesn't already have.
• Layering is validated when at least one layer removes a capability. The classes differ in kind: deterministic action gates held under the same adaptive attacks that broke the filters (Progent 8.2%→7.7% across five models; 25.8%→4.2%→2.6% in the independent Narisetty reproduction) (Out-of-Band Prompt-Injection Defense). And the deployed exemplar is heterogeneous layering on top of a strong base: Anthropic's production architecture is explicitly "two independent layers" — probes reading tool results on the way in, a classifier blocking dangerous tool calls on the way out, "so an attack has to defeat both independently to succeed" — reaching 0/129 browser scenarios with auto mode (Agentic Prompt Injection, Opus 5 section). Independence there is a design property (different mechanisms, different channels, one deterministic), not an assumption.

So the test's verdict on defense-in-depth is a refinement, not a repeal: friction is demoted from load-bearing to residual-reduction. Friction layers still cut the opportunistic, non-adaptive attack mass cheaply (spotlighting remains "a real defense-in-depth layer against non-adaptive attacks" — Agentic Prompt Injection), and they buy detection time (Zero Trust for AI Agents Phase 5: rate limits "buy time"). What they can no longer do is substitute for a barrier: a containment plan whose last line is friction "will fail" (Impossible, Not Tedious (Design Test), Phase 3). The design rule that falls out: every attack path must terminate in at least one capability-removing control; friction belongs in front of the barrier, never instead of it. Layered friction behind a deterministic gate lowers cost and noise; layered friction alone is a single correlated layer wearing N badges.

Answer 2: The test is adversary-cost-relative, not agent-absolute#

The test looks binary ("impossible or tedious?") but its second arm is priced in a specific currency: the attacker's per-attempt cost and patience. That is exactly the quantity AI-Accelerated Offense says agentic attackers change — near-zero per-attempt cost, unlimited patience — and why "this would take too long to be worth it" stopped holding. So yes, the test is relative, but the relativity is to the adversary's cost curve, not to whether the adversary is a human or an agent per se:

• "Impossible" is actor-invariant. Cryptographic hardness, network paths that don't exist, credentials the model never held (Agent Identity Management System (AIMS): "a secret the model never had can't be exfiltrated") bind every attacker equally. This is why capability-removal is the safe answer under threat-model uncertainty — it doesn't need the attacker priced.
• "Tedious" is priced per adversary class. A rate limit or re-encoding filter meaningfully deters a human doing manual attempts; against an agentic attacker grinding retries at API cost it is a rounding error. The converse exists too: the wiki's cleanest case of a control that is friction for the human but nothing against the agent is the per-action confirmation dialog — under ADI "the agent's reasoning reinforces the attacker's forged story," so the dialog burns human attention (approval fatigue) while providing no barrier on the attack path. It is friction pointed at the wrong party.
• Effectiveness is also conditioned on the attacker's position, not just cost. aiAuthZ's per-message identity gate is decisive when the attacker is a different principal than the active user (9/9 spoofing cases blocked) and reverts to ordinary value-policy friction when the injection fires under the owner's own authority. Same control, barrier in one threat position, friction in another.

Evaluation rule for mixed human/agent threat models: run the test per (control, adversary-class) pair, and score each attack path by the cheapest adversary class able to attempt it — the stack's strength is the minimum over classes, because the attacker chooses the class. A control counts as a barrier only if it is a barrier against every class that can reach the path it guards. Controls that are friction against the agentic class but load-bearing against humans (dialogs, MFA prompts, review gates) should be re-scored under the assumption that an agentic attacker, not a human, is on the other side — which is the framework's "assume it will fail" posture stated as procedure. The unmeasured residual (why this stays partially open): no source yet measures a mixed-threat deployment; the rule is principled synthesis from single-class evidence.

Answer 3: The frequency paradox dissolves on mechanism — rate vs. authorization-bound cardinality#

The apparent contradiction — Least Agency names "how often" a control dimension while the same framework calls rate limits friction — dissolves once "frequency-limiting" is split into two mechanisms that share a word:

• A rate (throttle) is friction. N-per-minute, resettable, delay-based: it narrows the window without closing it. An unlimited-patience attacker waits out any rate; per the framework, rate limits "buy time but do not stop a determined agentic attacker" (Impossible, Not Tedious (Design Test), Phase 5).
• A cardinality bound tied to an authorization event is capability removal. The framework's own surviving-control list already contains a frequency limit that passes the test: expiring/short-lived tokens — "the window closes, not just narrows." The same structure recurs across the strongest evaluated systems: AIMS transaction tokens downscope a broad token to a single non-reusable transaction (frequency = 1, cryptographically enforced); aiAuthZ binds each call to a single-use nonce and a timestamp window on a verified human message; ScopeGate's money ceiling and idempotency stage are deterministic per-call caps that fail closed (0/48 static, 0/29 adaptive bypasses). In each, the (N+1)th action is not slower — it is unauthorized until a fresh out-of-band event mints new authority.

The discriminating criteria, extractable from where each mechanism sits in the evaluated systems: frequency-limiting is a barrier when (a) the counter/ledger lives outside the agent's trust domain (off-host, or cryptographically embedded in the credential itself), (b) exhaustion denies rather than delays (fail-closed), and (c) the reset path is an independent authorization event (a verified human message, a fresh token issuance), not the passage of time. It is friction when the limit is a resettable clock the attacker can simply outwait, or an in-band advisory the model itself enforces. So least agency's frequency dimension and the friction verdict on rate limits are both correct — about different mechanisms. The design guidance: implement "how often" as authorization cardinality (single-use, expiring, per-transaction) rather than rate, and it graduates from tedious to impossible.

One consolidated takeaway#

All three answers are the same shape. The impossible/tedious line is not a taxonomy of control names (rate limit, MFA, filter, dialog) but of control mechanisms relative to an adversary: whether the attack's next attempt is denied by construction or merely made more expensive — and "more expensive" is now evaluated against an attacker whose attempts are nearly free. Defense-in-depth survives as friction-in-front-of-a-barrier; the test is applied per adversary class taking the minimum; and frequency controls pass exactly when they are re-implemented as authorization cardinality. What the cluster still lacks empirically: a measured mixed human/agent threat-model evaluation, and an adaptive attack on a heterogeneous stack (friction + deterministic gate attacked jointly — AutoDojo's §6 "reshape the payload to resemble the user's plausible intent" route, still untested).