Our billing bot has been casually sharing transaction histories with anyone who types in the right account number and im not sure who signed off on this

We launched a servicing bot that helps customers with billing questions. Nobody stopped to think about what happens when customers paste their full credit card numbers/bank details. Or when someone tries to use the bot to figure out another customer's transaction history. The bot is polite and helpful and sometimes shares way more than it should because nobody defined what excessive disclosure of balances and holdings looks like. Someone asked about recent transactions and the bot happily listed everything without verifying anything beyond the account number they typed in. The model doesnt know what it doesnt know, and the guardrails we have were built for toxicity and prompt injection, not for catching when a customer tricks the assistant into leaking their own financial data or someone else's. Is there a way to solve this without pulling the whole thing offline?