The problem, the build, the result
01
The problem
Most teams shipping an AI feature assume a rule in the prompt keeps secrets safe and actions in bounds. It doesn't, and the first time anyone finds out is usually in production.
02
How it works
Three live assistants show the difference. Level 1 keeps a secret in the prompt with only a rule protecting it. Level 2 adds an input screen and an output filter in code. Level 3 has no secret at all: it can only call a refund tool whose limits are enforced outside the model.
03
What changes
You see, with your own attempts, why filters raise the cost of an attack but don't end it, and why least privilege enforced in code is the control that holds. The same review is what our AI security audit applies to your system.