Which architecture best limits damage if a jailbreak or prompt injection succeeds?

Which architecture best limits damage if a jailbreak or prompt injection succeeds?

1. Layer input and output controls with least-privilege tools, application authorization, approval gates, and monitoring
2. Rely on one system-prompt sentence that tells the model never to disobey
3. Give the model broad credentials so it can recover from any blocked action