The word “additionally” evading guardrails is comical.

You need structural separation. Separate agents for public vs private. Prompt or context washing is not enough.