A financial services company uses Claude to generate market commentary for inclusion in client-facing reports. During a quarterly review, the compliance team discovers that Claude occasionally generates statements that could be construed as investment advice ('This stock appears undervalued and may present a buying opportunity'). The platform was designed for informational market commentary only, not investment advice. What production safety architecture addresses this regulatory risk?

Investment advice regulations (SEC, FINRA) require that systems providing investment advice be registered and regulated — this is a legal risk, not just a content quality issue. A three-layer control provides defense-in-depth appropriate to regulatory exposure: the system prompt preemptively constrains the output style; the post-generation classifier catches violations that slip through; and audit logging demonstrates due diligence in compliance monitoring. Option A (boilerplate disclaimers) is legally insufficient — regulators evaluate substantive content, not disclaimers. Adding 'I am not a financial advisor' before investment advice doesn't make the advice legal. Option C (fine-tuning) can shift default behavior but cannot guarantee zero violations — fine-tuned models still produce off-distribution outputs under adversarial or unusual prompts. Option D (human review) is the gold standard but is operationally untenable at production scale for market commentary generation and eliminates the efficiency benefit of automation.