The third layer of the McDonald’s AI trilogy is architectural. Where the information layer addresses how executives form their understanding of AI, and the operational layer addresses how organizations run AI capabilities at scale, the architectural layer addresses the specific technical patterns that shape what AI systems can and cannot do safely.
The single most dangerous architectural assumption embedded in most enterprise AI deployments in 2026 is this: the system prompt functions as a security boundary.
It does not.
Prompt injection is currently listed as the number one risk in the OWASP Top 10 for LLM Applications. This is not an obscure academic concern. It is the leading practical vulnerability affecting deployed AI systems.
What the system prompt actually is
In most current enterprise AI deployments, the developers write a system prompt that establishes the AI’s role, constraints, and behavior. For example: “You are a customer service agent for Company X. Do not discuss competitors. Do not commit to refunds above $50. Do not disclose internal pricing.”
The intuition of most executives approving these deployments is that the system prompt functions like traditional application code — it defines rules that the AI will follow.
This intuition is wrong. The system prompt is not code. It is text. Text that the AI has been trained to weight heavily but that any user with access to the AI’s input channel can override, override, or manipulate.
The four-layer architecture
Any AI deployment operating at enterprise scale requires four distinct layers of security architecture. Most current deployments have one or two.
Layer one: the system prompt. Establishes intended behavior. Provides no security guarantees. Should be treated as a persuasive suggestion to the model, not as an enforced constraint.
Layer two: input validation and sanitization. Before user input reaches the model, it should be validated for prompt injection patterns, jailbreak attempts, and category-inappropriate content.
Layer three: output validation and constrained action. Before the model’s output produces any action — sending an email, executing a transaction, calling an API — the output should be validated against explicit business rules enforced in application code, not in the prompt.
Layer four: monitoring, logging, and incident response. Every AI interaction should be logged, monitored for anomalous patterns, and triggered against automated escalation when specific risk patterns emerge.
Most enterprise AI deployments have layer one and partial versions of layers two and four. Layer three — the constrained action layer that would actually prevent the AI from doing something it shouldn’t — is often missing entirely.
Three practical questions
One: for each of your AI deployments, which of the four layers is actually implemented? Layer one is easy — everyone has a system prompt. Layers two, three, and four require substantial engineering work. If they are missing, the deployment is a prompt-injection incident waiting to happen.
Two: what specific actions can your AI deployments take autonomously? Send emails. Execute transactions. Change database records. Call external APIs. For each such action, ask whether the constraint on that action is enforced in layer three (application code) or only in layer one (system prompt). If the constraint is only in the prompt, it is not a constraint.
Three: when — not if — a prompt injection successfully manipulates one of your AI deployments, what is the maximum damage the compromised system can produce? The answer to this question is your actual risk exposure, not the risk exposure your vendor described in the sales pitch.
The closing thought
The three layers of the McDonald’s AI trilogy — information, operational, architectural — need to be addressed independently because they require different responses from different functions.
The information layer requires source discipline from executive teams.
The operational layer requires accountability structures and resource allocation from operational leadership.
The architectural layer requires specific engineering discipline from technical leadership, informed by an accurate understanding of what LLMs are and are not.
Organizations that address only one or two of these layers will experience predictable failures at the neglected layer. Organizations that address all three will produce AI deployments that scale durably and safely.
Most organizations, in my direct observation, are addressing zero or one layer with meaningful rigor. The failures over the next three years will be, in most cases, entirely predictable.
The world has changed. The leaders who notice will be the ones the next decade is built around.
