How to write system prompts that completely block automated red-teaming

This lesson's title promises something no one can honestly deliver. What's real and worth building is the next tier of hardening after Lesson 1's basics: moving critical decisions out of the prompt and into code, validating what the model actually outputs (not just what came in), and keeping an honest record of which attack categories you've verified against — rather than a system prompt that quietly claims to have solved prompt injection.

What advanced hardening actually looks like

1. Move hard limits into code, not prompt wording. "Never issue a refund over $50" in a system prompt is a suggestion the model might not follow under adversarial pressure. A tool call that's programmatically capped at $50 is a limit the model literally cannot exceed, regardless of what it's convinced to say.

2. Validate the output against your policy, not just the input against a blacklist. Check whether the response actually contains the system prompt, a policy-violating claim, or PII — that catches attacks whose input didn't match any known "jailbreak phrase" pattern.

3. Keep a defense coverage log. After each red-team pass (Lesson 3), record which specific attack categories were tested and which weren't — "we've verified against known jailbreak phrasings but haven't tested multi-turn escalation" is honest and useful; a blanket "our system is jailbreak-proof" is neither.

# The limit lives in code, not in prompt wording the model could be talked past
def issue_refund(order_id: str, amount: float) -> dict:
    MAX_AUTO_REFUND = 50.00

    if amount > MAX_AUTO_REFUND:
        # No prompt-level instruction can bypass this - it's a hard branch
        return {"status": "requires_human_approval", "amount": amount}

    process_refund(order_id, amount)
    return {"status": "refunded", "amount": amount}

The honest framing matters for a business reason too: a written claim that your system "completely blocks" jailbreaks is a liability if it's ever tested and fails publicly. "We red-team against these specific categories on this schedule, and enforce hard limits in code for anything high-stakes" is both more accurate and more defensible.