Safety in Motion: Reminders, Copyright, and Context

The safety material in asgeirtj/system_prompts_leaks shows why a policy cannot be understood as one static refusal paragraph. This chapter follows a flagged request through baseline rules, conditional reminders, tool restrictions, copyright limits, and interface-specific safeguards so readers can distinguish a declared boundary from a demonstrated safety result.

The previous chapter showed that context can activate different state and retrieval paths. Safety adds another transition. A request may be ordinary in one setting and risky in another. An image request may require different handling from a text question. A search tool may create a copyright or privacy problem that an offline explanation would not. The product must decide which instruction layer applies before it decides how to answer.

A flagged request changes the input

The Anthropic reminder capture describes conditional guidance associated with image handling, cyber content, system manipulation, ethics, intellectual property, and long conversations. These reminders are presented as additions that may appear because a classifier or another condition has been triggered. The base prompt still defines the assistant’s general role, but the additional guidance changes the context in which the next response is produced.

A dynamic reminder solves a coverage problem. A permanent prompt must describe ordinary behavior without making every response carry the full detail of every exceptional case. A conditional layer can be more specific when a request touches a sensitive tool, a harmful possibility, a copyright boundary, or a long-running conversation. It can also remind the model to preserve its identity and instruction hierarchy when a user message tries to redefine them.

The sequence matters. The request arrives first. A runtime or classifier assesses its context. If a condition matches, additional guidance is supplied. The assistant then interprets the request under both the baseline role and the conditional boundary. It may answer normally, narrow the answer, avoid a tool, refuse a request, or redirect to a safer alternative. If no condition matches, the conditional branch should not unnecessarily distort the response.

The diagram does not imply that a classifier is the only possible trigger or that every product uses the same sequence. It captures the architectural relationship visible in the reminder material: behavior can be changed by context added outside the base prompt. The classifier’s result is also not a final judgment about the user. The captured ethics guidance allows for false positives and says that a flagged message may still be harmless. The trigger changes the assistant’s caution; it does not prove malicious intent.

This distinction helps explain why baseline and dynamic rules coexist. Baseline rules establish a stable identity, broad safety commitments, and general limits. Dynamic reminders focus attention on a particular risk surface. A product that used only dynamic rules would leave ordinary behavior underspecified. A product that used only a giant permanent prompt would make every response carry irrelevant conditions and might still miss the context-specific detail needed for a sensitive request.

The arrangement has failure modes. A classifier can trigger on an innocent request, causing an unnecessary restriction.