An architect is designing the safety architecture for a consumer-facing AI assistant. The architect must ensure that safety measures are robust even if individual layers fail. Which layered safety stack design is most comprehensive?

D is correct because defense-in-depth for AI safety requires independent layers that each provide coverage the others may miss: pre-processing classifiers can detect request types that trigger safety concerns (jailbreak attempts, harmful categories) before they reach Claude; Claude's constitutional training handles nuanced judgment on ambiguous content; post-processing classifiers provide a final gate for content that may have slipped through; human review provides escalation for uncertain cases. Each layer compensates for the failure modes of the others. A is wrong because relying solely on Claude's built-in safety training creates a single point of failure — safety training is not perfect, and adversarial inputs can bypass it; defense requires independent layers. C is wrong because output-only filtering misses the opportunity to prevent harmful inputs from being processed at all, wastes compute on generating content that will be blocked, and misses input-level signals (the structure of an attack prompt). B is wrong because keyword blocklists are trivially bypassed through synonyms, spelling variations, and context — they provide weak coverage and high false positives; they can supplement but cannot substitute for behavioral layers.