Telling the model to behave does not work. Probabilistic systems do not yield deterministic security outcomes, no matter how carefully the system prompt is written.