A layered architecture splits code by responsibility: routes or controllers (HTTP), services (business rules), data access. Each layer depends only on the one below, which makes testing and swapping a layer easier. HTTP objects must not leak down into the business layer.