A specialist is choosing between two ways to make sure the claims-status action only ever returns claims belonging to the account making the request: a filter on the action bound to the requesting account, or an instruction telling the model "only discuss claims for this owner." Which is the better choice, and why?
Select an answer to reveal the explanation.
Short Explanation
An instruction is asking the model to look away from data sitting right in front of it. A filter never puts that data in front of it in the first place. One of those is a real safeguard against a determined or confused user; the other is a polite request.
Full Explanation
A filter bound to the requesting account restricts which Claim records the action can even retrieve, so the restriction holds regardless of how cleverly a prompt is worded, which matters enormously for cross-account data like insurance claims. An instruction telling the model to discuss only the current owner's claims is a behavioural nudge applied after the action has already returned data; if the underlying query was not scoped, the model has seen records it should not disclose, and prompt-level instructions are not a reliable barrier against disclosure, especially under adversarial or unusual phrasing. Filters absolutely can reference the identity of the requesting context, commonly through a variable populated from the running session or record, which is what makes account-scoped filtering possible in the first place. The Einstein Trust Layer's job is masking sensitive values and detecting toxicity in prompts and responses, not enforcing which records an action query returns; treating it as a substitute for proper data scoping is a common and dangerous misunderstanding. Configuration effort is not the deciding factor here at all; correctness and security are, and for anything touching cross-account data the filter is the only sound choice.