An enterprise HR platform deploys Claude as a compensation analysis assistant for HR managers. The assistant has access to employee salary data and can answer questions like 'What is the average salary for Senior Engineers?' A security audit finds that an employee with HR manager role can ask 'What is John Smith's exact salary?' and receive the answer. The platform's intended design is to allow aggregate analytics but not individual employee salary disclosure. The system prompt currently does not address this distinction. What is the correct production safety implementation?

Defense-in-depth for PII disclosure requires both explicit system prompt constraints AND output-level verification. The system prompt must explicitly define what is and isn't permitted — Claude's default behavior doesn't know the platform's intended access controls. The minimum group size constraint (e.g., 'only report aggregates for groups of 5 or more employees') prevents statistical inference attacks where averaging a group of 2 effectively discloses both salaries. The post-response classifier catches edge cases where the system prompt instruction is circumvented through indirect queries. Option A (remove salary data) prevents the analytics use case that is explicitly intended. Option C (relying on Claude's defaults) is insufficient — Claude's privacy principles are general-purpose and don't know the platform's specific data governance policies. Option D (role-based routing) is a valid additional control but doesn't address the underlying problem: the current HR manager role can already query individual salaries, and routing logic alone doesn't implement the aggregate-only policy.