The system prompt is (and cannot be) the only guardrail against things like that, because any system prompt is little more than a good suggestion.