A service must send text to an external model but should not disclose customer account numbers. Which control is most direct?

1. Ask the external model to forget the numbers after answering.
2. Detect and mask the sensitive fields before the external request, then validate the output policy.
3. Increase retrieval top-k to hide each account number among more text.
4. Mask account numbers only in the browser after the external model has processed them.