constitutional-classifierslisted

# Constitutional classifiers Source: [Constitutional classifiers](https://www.anthropic.com/research/constitutional-classifiers) and the [next-generation version](https://www.anthropic.com/research/next-generation-constitutional-classifiers). `defending-against-prompt-injection` guards the trust boundary on content the agent reads; this skill guards a content policy on what the agent takes in and sends out. The two stack. ## Write the constitution first A classifier is only as clear as the policy behind it. Write a constitution: a plain-language list of the content classes your agent may produce and the ones it may not, with the line between them drawn by example. The canonical pair is "a recipe for mustard is allowed; a recipe for mustard gas is not." Concrete examples beat abstract categories, because the screen learns the boundary you drew rather than the one you meant. ## Screen both ends Put a classifier on each end of the model. An input classifier reads the user's request before the model sees it; an output classifier reads the completion before it reaches the user. Two ends catch two failures: a request that should never be answered, and a harmful completion that slipped through despite a clean-looking request. For an agent, screen tool outputs and intermediate steps too, which is where this meets `defending-against-prompt-injection`. ## Harden the screen with synthetic data You will not anticipate every phrasing of a banned request. Generate synthetic examples