The Safety Manifesto That Became an API Spec

In March 2023, Anthropic published Core Views on AI Safety, a long essay arguing that nobody knows how hard alignment will turn out to be, so a serious lab should place research bets across optimistic, intermediate, and pessimistic scenarios at once. At the time it read like philosophy: interesting, sincere, and easy to skip if you were busy shipping.

That was a mistake. Three years on, the essay has turned out to be the most accurate roadmap document Claude developers ever got. Almost every piece of safety machinery you now write code against, from refusal stop reasons to deployment-gated model launches, traces back to a research bet named in that post.

From essay to enforcement

The essay's core admission was blunt: "We do not know how to train systems to robustly behave well." The portfolio it proposed as a response included mechanistic interpretability, scalable oversight, Constitutional AI, and evaluations that probe models for dangerous capabilities before release.

The evaluations bet is the one that hardened into process fastest. In September 2023 it became the Responsible Scaling Policy, which defines AI Safety Levels (ASLs) modeled loosely on biosafety lab levels: cross a capability threshold, trigger a stricter set of required safeguards. OpenAI followed within months with its Preparedness Framework, and Google DeepMind shipped its Frontier Safety Framework by May 2024. All three track roughly the same domains: bio and chem weapons uplift, cyber offense, and AI self-improvement.

For a while this stayed paperwork. Then in May 2025 it became product. Anthropic activated ASL-3 protections for Claude Opus 4, the first model to ship under the stricter standard, after internal testing suggested the model might "substantially increase" the ability of someone with a STEM background to produce chemical or biological weapons. Concretely, ASL-3 meant two things: hardened internal security against model-weight theft, and constitutional classifiers sitting in the request path, tuned to block CBRN-related misuse. Anthropic pays up to $35,000 through HackerOne for a universal jailbreak that defeats that classifier stack. A control nobody expects to hold doesn't get a bounty.

What the doctrine looks like from your code

If you build on Claude, the 2023 worldview now shows up in your error handling. On newer Claude models, a safety decline is machine-readable: the API returns HTTP 200 with stop_reason: "refusal" and a category on stop_details. Your code is expected to branch on it.

response = client.messages.create(model="claude-opus-5", ...)

if response.stop_reason == "refusal":
    category = response.stop_details.category  # e.g. "cyber", "bio"
    route_to_fallback(request, category)
else:
    handle(response.content)

That design is the RSP compiled down to an API contract. A classifier gate implies false positives, false positives need a recovery path, so refusals became a first-class stop reason instead of an apologetic paragraph of text you had to string-match.

The trade-offs are real. Classifiers add latency and compute cost, which Anthropic has been working down since the first version shipped. More important for product teams: the classifier boundary moves. In red-team evaluations of the original constitutional classifiers, jailbreak success dropped from 86% to 4.4%, and every subsequent tightening or retuning shifts what gets through. If your product lives near a sensitive domain (biotech tooling, security research, penetration-testing copilots, anything agentic that touches exploit code), a model upgrade can change your refusal rate even when nothing in your prompt changed.

Where the gates land next

Read the February 2026 rewrite, Responsible Scaling Policy v3.0, as a forward-looking spec. It commits Anthropic to risk reports every three to six months with third-party review in some cases, publishes graded Frontier Safety Roadmaps, and admits something the 2023 essay only implied: ASL-4 and ASL-5 safeguards may be impossible for one company to meet unilaterally.

My read: this machinery is operationally real, and it is also softening at the edges. The classifiers block actual attacks at actual cost, which is more than most corporate safety pages can claim. At the same time, v3.0 reframes several hard commitments as publicly graded goals, and critics have argued the commitments have loosened as competition tightened. Both things can be true. What matters for developers is the direction: the capability domains these documents name are the domains where gating arrives next, and right now every lab's documents point at cyber offense and autonomous agents. If your roadmap includes agents that write and run security-relevant code, expect the friction that bio-adjacent apps hit in 2025 to reach you.

Practical moves, in order of payoff. Give refusals their own code path with a fallback model or a human handoff. Pin model versions and re-run an eval of your domain-boundary prompts on every upgrade, because the classifier line moves independently of model quality. Skim each risk report the way you'd skim release notes; they are release notes for refusal behavior. And if you're in a sensitive domain, talk to the vendor about allowlisting early. Engineering around a classifier is a treadmill, and the bounty program is evidence the treadmill is well-funded.

The 2023 essay ended up mattering because it was a build list. Anthropic shipped that list into the request path, one bet at a time. Read the next one accordingly.