A wealth-management firm deploys a Claude agent that answers advisors' questions about client portfolios. Its tools query the portfolio database through a single service account that can read every client's holdings. The system prompt says: "Only discuss clients assigned to the requesting advisor." A red-team exercise gets the agent to summarize another advisor's client. What is the most appropriate fix?

Answer: B — Have tools call the database with the requesting advisor's own scoped credentials so the backend enforces assignment

The boundary is an authorization rule, so it has to be enforced where data is accessed. Scoping tool calls to the advisor's own authority makes the backend refuse records the advisor can't see, whatever the model is persuaded to do. (a) is still prompt-only enforcement of a hard rule. (c) is a useful extra layer but it's detection after the data was already retrieved, and it can miss paraphrased details. (d) is a detective control that finds the breach a week later.