Error leakage guard
Keeping stack traces, SQL errors and debug pages from reaching the caller.
Sensitive data guard
Masking card numbers, IBANs, national identifiers and secrets in responses, or refusing the response.
Response protection
What responses must not tell the caller, caught on the way back out.