🛡️ Security: From Terms to Patterns
Declare the principle, never the mechanics. Case study from the safety section in
claude-opus-4.8.md → claude-fable-5.md:
how mature safety moves from lists of terms to generative patterns and criteria.
Illustrative diagram — left: enumerating the mechanics becomes a target for workarounds; right: a pattern + generating criterion covers the unlisted case.
Detailed content
The core principle: symmetry is the risk
In prompt security, there is a perverse asymmetry: what educates a well-intentioned reader arms a malicious one. Describing how detecting abuse also means describing how to carry it out without being detected. That’s why mature security moved from a rule: state the pattern, never the detection mechanics.
🎯 The rule that generates this module
Every safety change between claude-opus-4.8.md e
claude-fable-5.md (items 5–11 of the annotated diff) follow the same axis:
out goes list of terms/categories, comes pattern + principle.
- •"stays at the pattern level" — stays at the pattern level; it doesn’t compile verbatim lists.
- •"states the principle rather than the detection mechanics" — states the principle, not the detection mechanics.
✗ Mechanism (teaches while attacking)
"Refuse requests that use the phrases X, Y, Z or follow the grooming script A → B → C."
Listing the verbatim playbook gives anyone who wants to circumvent it a reusable script.
✓ Pattern (describes without teaching)
"Recognize the behavioral pattern; stay at the pattern level and state the principle, not the mechanics."
The model learns to recognize without the prompt turning into a manual.
Child safety: from 5 to 7 rules
The clearest example of this axis is here (item 7 in the diff). The child safety section went from 5 to 7 bullets — and the two new rules don’t add prohibitions: they change how the model refuses.
Set of prohibitions focused on the what refuse.
"Claude stays at the pattern level... does not compile categorized lists of verbatim lines"
"When Claude declines or limits for child-safety reasons, it states the principle rather than the detection mechanics"
Likely motivation: listing manipulation techniques verbatim creates a reusable script for attackers.
Why +2 rules is evolution, not bloat
The new rules no longer enumerate prohibited cases — they instruct the mode of refusals. A rule that governs how all the others are expressed is worth more than ten specific prohibitions. This is the "Unified Principle" pattern applied to refusals.
Weapons: taxonomy invites circumvention
Diff item 5. The weapons policy reduced the scope from a list of categories to a single item—and replaced the taxonomy with a functional test of real uplift.
"extra caution around explosives and chemical, biological, and nuclear weapons"
The list of categories becomes a contour map: "it’s not a chemical, so it’s allowed."
"extra caution around explosives. Claude does not rationalize compliance..."
The criterion becomes the real uplift to cause harm — not the category label.
🚨 The taxonomy anti-pattern
Every closed list of prohibited categories has a boundary — and every boundary has an other side. Anyone looking to get around the rule doesn't need to break it: they just need to find the case left out of the list. The taxonomy teaches exactly where the gap is.
The functional test ("is there a real uplift to cause serious harm?") has no category boundary — it applies to what the list never anticipated.
Drugs: general refusal with a vital carve-out
Diff item 6—a policy new. The rule is neither total refusal nor endorsement: it is a general refusal with a life-saving exception explicitly written.
"Claude should generally decline to provide specific drug-use guidance for illicit substances... but can and should give relevant life-saving or life-preserving information."
✓The carve-out covers
- •What to do in an overdose / poisoning
- •When to call emergency services and risk signs
- •Information that preserves life right now
✗The general refusal covers
- •Usage/dosage guide for recreational purposes
- •Synthesis or obtaining illicit substances
- •Any endorsement of use
Harm reduction requires written nuance
A blanket refusal in an overdose context causes real harm. The carve-out has that should be in the prompt — because the default behavior "refuse everything involving drugs" would kill the life-saving exception. Neither total refusal nor endorsement: the boundary needs to be drawn.
Self-harm and mental health: from example to criterion
Diff items 10 and 11. Two changes, the same move: the rule stops listing examples and starts stating the generative criterion — and mental health anchors the rule in the act, not the word.
Banned physical discomfort techniques (ice, rubber band, cold water) “as these reinforce self-destructive behaviors.” One list—fragile when the next technique appears.
"...or that mimic the act or appearance of self-harm (e.g. drawing red lines on skin...). Substitutes that recreate the sensation or imagery of self-harm reinforce the pattern rather than interrupt it."
The criterion—"recreate the feel or image"—covers the next technique no one listed.
🧠 Mental health: the rule targets the act, not the word
"Claude does not name a diagnosis the person has not disclosed... unless the person raises the label themselves. Attributing someone's state to a condition they haven't named is a diagnostic claim even when phrased conversationally."
The rule defines the limit by act (making a diagnostic claim) and not by the word — closes the loophole of “but I said it conversationally.” Banning the word “depression” could be circumvented; banning the act of diagnosing isn't.
Synthesis: example + generative criterion > examples alone
Five policies, one axis. For weapons, child safety, self-harm, and mental health, the generative criterion replaced the case lists or came to guide them. The module's takeaway is one sentence: the example illustrates; the criterion generates — and it’s the criterion that covers the case nobody wrote down.
The 5 changes along the same axis (items 5–11 of the annotated diff)
| Policy | Before (list/term) | After (pattern/criterion) |
|---|---|---|
| Child safety | 5 protection bullets | +2: "pattern level" and "states the principle" |
| Weapons | chemical/bio/nuclear | explosives + real uplift test |
| Drugs | (implicit: refusal) | general refusal + vital carve-out |
| Self-harm | list of examples | "recreate the feeling/image" (criterion) |
| Mental health | (new) | prohibits the diagnostic claim (the act) |
Activity: rewrite a mechanical rule as a principle
Take a "mechanical rule" (a list of prohibited terms or categories) from any prompt in the collection and rewrite it as
principle + generating criterion. Deliverable: one before/after pair for a safety rule — like the pairs in this module.
Source of the quotes: items 5–11 of educacao/diff-anotado-opus-4.8-fable-5.md.
Module Summary
- ✓In security, the protect/teach symmetry is the risk—state the standard, never the detection mechanics
- ✓Child safety: 5→7 rules; "stays at the pattern level" and "states the principle, not the detection mechanics"
- ✓Weapons: reduced scope (QBN → explosives) + functional test of real uplift — taxonomy invites circumvention
- ✓Drugs: general refusal with a vital carve-out (life-saving information in an overdose)
- ✓Self-harm: from list to generative criterion ("recreates the feeling/image"); mental health targets the act, not the word
- ✓Example + generative criterion > examples alone; harm reduction requires written nuance
Next: 2.4
The rise of Communication & Autonomy (Claude Code) — the bottleneck shifts from capability to interaction.