A customer-facing chatbot built on Claude includes a guardrail that refuses to provide instructions for defeating the company's own fraud-detection system. During a security review, a tester discovers that by starting with harmless questions about 'how fraud detection generally works,' then slowly asking increasingly specific follow-up questions across many turns, they can eventually get the bot to reveal sensitive detection thresholds it would refuse to give if asked directly. Which mitigation most directly addresses this specific attack pattern?