A company is deploying Claude for customer service agents. Red-teaming reveals that users can sometimes prompt Claude to reveal its system prompt by framing requests as debugging exercises. The system prompt contains proprietary business routing logic. What is the correct architectural response?

System prompt confidentiality cannot be technically guaranteed through instructions alone — Claude can be prompted to reveal or paraphrase its system prompt through various social engineering techniques, even with explicit 'do not reveal' instructions. The correct architectural response is: (1) design system prompts to never contain genuinely sensitive secrets (API keys, PII, proprietary algorithms), (2) treat the system prompt as potentially visible to sophisticated users, (3) implement monitoring to detect extraction attempts. Option A (instruction alone) is insufficient — this is exactly the vulnerability identified in red-teaming; the instruction can be overcome through prompt injection. Option C is incorrect — the Anthropic API does not support system prompt encryption; prompts are processed as plaintext by the model. Option D is incorrect — instruction-following for system prompt confidentiality is not reliably improved by model tier; this is a fundamental property of how LLMs process context.