Option D is the strongest enforcement design because an unconditional content policy requires an application-level control between model generation and user delivery. Prompt instructions are valuable for steering Claude, but they are probabilistic controls and should not be treated as the sole enforcement mechanism when prohibited categories must never be exposed.
Anthropic’s guardrail guidance recommends layered safeguards including screening, validation, monitoring, and filtering rather than relying exclusively on prompts. Its prompt-leak guidance specifically recommends output screening and post-processing, including deterministic techniques such as keyword matching, regular expressions, or other text-processing mechanisms where appropriate.
A improves the probability of policy compliance but cannot guarantee that every generated response will satisfy an externally defined application policy. B explicitly abandons the requirement. C detects violations only after exposure, which is unsuitable when the content must not reach users.
A production architecture can combine system instructions, structured classification, policy engines, deterministic rules, and model-based moderation, but the decisive requirement is enforcement before output delivery. Relevant Claude Developer topics are guardrails, output filtering, content moderation, deterministic enforcement, defense in depth, safe application boundaries, and production Claude application design.
===============
