AI agent platforms let LLMs execute code, call APIs, and access tools — which makes them a security nightmare if left unguarded. This talk covers how I built a defense-in-depth security stack for OpenClaw, an open-source AI agent gateway running on OpenShift. I'll walk through the 10 layers — from NeMo Guardrails input/output filtering and TrustyAI PII detection, to AdminNetworkPolicy egress control, OVN EgressFirewall DNS allowlisting, per-session agent sandboxing with OpenShell, and MLflow-based observability — all deployed without cluster-admin access. Expect real tradeoffs: wildcard DNS rules that silently fail, OTLP ports blocked by your own policies, guardrails that return the wrong response format, and why documenting dead ends became one of the project's most valuable outputs.