An enterprise HR platform deploys Claude as a compensation analysis assistant for HR managers. The assistant has access to employee salary data and can answer questions like 'What is the average salary for Senior Engineers?' A security audit finds that an employee with HR manager role can ask 'What is John Smith's exact salary?' and receive the answer. The platform's intended design is to allow aggregate analytics but not individual employee salary disclosure. The system prompt currently does not address this distinction. What is the correct production safety implementation?

Defense-in-depth for PII disclosure requires both explicit system prompt constraints and output-level verification. The system prompt must explicitly define what is and isn't permitted, because Claude's default behavior doesn't know the platform's intended access controls. The minimum group size constraint, such as reporting aggregates only for groups of five or more employees, prevents statistical inference attacks where averaging a group of two effectively discloses both salaries. The post-response classifier catches edge cases where the system prompt instruction is circumvented through indirect queries. Removing salary data from the retrieval context entirely prevents the analytics use case that is explicitly intended. Relying on Claude's built-in privacy principles is insufficient, because those principles are general-purpose and don't know the platform's specific data governance policies. The role-based access approach that grants only executive-level HR permission to query individual salaries and routes those queries through an elevated-permission API key is a valid additional control, but it doesn't address the underlying problem: the current HR manager role can already query individual salaries, and routing logic alone doesn't implement the aggregate-only policy.