Anthropic removed more than 80 percent of Claude Code’s system prompt for Claude Opus 5 and Claude Fable 5, and measured no loss on their coding evaluations [01].
The number is not the finding. The finding is what the number implies about the practice that produced the prompt in the first place: a large fraction of it was not buying reliability. It was buying arbitration.
That distinction is the whole of this dispatch. An instruction is not a control. An instruction becomes a control when exactly one authority states it, on exactly one surface, in a form the system can evidence. Restate the same standard on three surfaces and you have not tripled the assurance. You have manufactured a conflict the model now resolves silently, at inference — and the failure mode that produces is worse than an absent control, because it does not look like failure.
The instruction that competes with itself
Anthropic’s worked example is small enough to hold in the hand. A system prompt says to default to writing no comments. A skill says to leave documentation as appropriate. The user has a preference of their own. Three directives, one request, and on some tasks they contradict [01]. Before the model can write a line of code, it has to decide which one governs.
The literature on that decision is unambiguous. Many-Tier Instruction Hierarchy in LLM Agents takes it up directly: instructions reach an agent from system messages, user prompts, tool outputs, and other agents, each carrying different trust and authority, and the prevailing instruction-hierarchy paradigm assumes a fixed, small set of privilege levels defined by role labels [07]. The authors argue that assumption fails in real agentic settings, build a benchmark of 853 tasks spanning up to twelve privilege tiers against the two or three of prior work, and evaluate ten frontier models. The best of them reaches 42.7 percent accuracy [07]. Filtering and human validation establish that a ceiling of at least roughly 80 percent is attainable, so the shortfall is capability rather than benchmark artifact [07].
One comparison inside that result is worth more than the headline. A model family reporting above 99 percent on two-tier instruction-hierarchy evaluations — resistance to system prompt extraction among them — scores 39.5 percent on the twelve-tier benchmark [07]. Same family, same underlying capability, two orders of arbitration difficulty apart. A control validated against two tiers of authority carries almost no assurance at twelve.
The degradation is attributable to the tiers themselves rather than to task difficulty. Holding the number of style groups and winning instructions fixed so that instruction-following difficulty stays constant, accuracy declines consistently as tiers increase: eleven of twelve model-transition pairs show a strict decrease, with drops from 6.8 percent to 24.1 percent between the easiest and hardest configurations [07]. Two further studies converge from different angles. IFScale measures rising instruction density rather than deepening conflict and finds degradation with identifiable performance cliffs [08]. RECAST observes consistent decline across every model tested as constraint complexity climbs through four levels [09]. And When Thinking Fails reports that explicit chain-of-thought reasoning can itself degrade instruction-following accuracy [10] — which matters here, because arbitration is reasoning. Spending it on which rule wins is spending it.
Read together with the 80 percent cut, the picture resolves. Instruction volume and instruction authority are different quantities, and past some threshold they move in opposite directions.
Practice is versioned. Mechanism is inherited.
Anthropic names six shifts [01]. It is tempting to sort them into two piles — things you now do differently, and things the platform now does for you. That sort is incomplete, and what it misses is the most useful thing in this evidence base.
Anthropic does not obscure the dependency; they document it. The platform’s prompting guidance is organized model-specific first, general technique second, migration considerations last, with a separate prompting page for each current model [13]. Beneath that structure sit explicit corrections. Prompts written to stop earlier models from undertriggering on tools now cause overtriggering, and the remedy is to soften the language — their own example replaces “CRITICAL: You MUST use this tool when…” with “Use this tool when…” [13]. Verification instructions carried forward from prompts tuned for earlier models cause over-verification on Claude Opus 5, and the instruction is to remove them rather than rewrite them [13]. Guidance that previously encouraged more thoroughness or more aggressive tool use is to be dialled back, because newer models may overtrigger on instructions that earlier models needed [13].
Remove rather than rewrite. The 80 percent cut, stated as routine migration guidance rather than as an announcement.
The same evolution runs through the tool layer across eight months. In November 2025, Anthropic shipped Tool Use Examples with the finding that concrete example invocations raised accuracy from 72 percent to 90 percent on complex parameter handling [02]. By July 2026, the guidance for the Claude 5 generation is to let the interface carry the intent instead, so that a well-chosen enumeration of states hints at its own correct use [01]. Both are correct for their generation. Neither is careless.
Which is the point. If the organization with the most complete view of a model’s behavior still issues per-generation corrections to prompt-level guidance, the dependency is not a maturity problem that a more disciplined team avoids. It is a property of placing controls in instruction text. And the transfer has thin empirical warrant regardless: semantics-preserving rewording degrades performance by as much as 12 percent and alters the relative ranking of models in 63 percent of cases, accounting for up to half the performance variance of a given model [14]. A prompt-level control validated against one model has little basis for inheritance by the next.
So the durable sort is not practice against mechanism. It is:
Mechanism you inherit. Deferred tool loading, automatic memory, and references with real fidelity arrive as platform behavior [01][04][11]. They survive a model upgrade because the platform owns them.
Practice you own, versioned against a generation. How much you instruct, how you phrase authority, which reminders you carry forward. These are calibrations against a specific model’s needs, and they carry a version dependency that almost no architecture documents.
That second category is where the assurance exposure lives. An architecture whose reliability rests on prompt-level practice has a model-version dependency inside its control set, and if that dependency is undocumented, a model upgrade is an uncontrolled change to the control environment.
Resident and retrieved
Progressive disclosure is the one shift that changes the arithmetic rather than the prose.
The prior pattern loaded everything a system might need before it read what it was asked. Anthropic’s own numbers on the tool half of that are stark: a five-server setup of 58 tools consumed roughly 55,000 tokens before a conversation began, and internally they saw tool definitions reach 134,000 tokens before optimization [02]. The current pattern loads names and descriptions and fetches definitions on demand — an 85 percent reduction in tool token usage, with tool-selection accuracy on Opus 4.5 rising from 79.5 percent to 88.1 percent when tool search is enabled [02][04]. Skills work the same way in three stages: metadata at startup, full instructions on activation, bundled files only during execution [03][06]. In Claude Code this is not an opt-in optimization — tool search is on by default, with an environment variable to override it [05]. The default has moved.
The mechanism detail worth knowing is where deferred definitions sit. Tools marked for deferred loading are stripped from the rendered tools section before the cache key is computed; they never enter the system-prompt prefix, and when tool search discovers one, its definition expands inline in the conversation body instead [12]. That is why deferral and prompt caching compose rather than compete.
Which is the moment to be precise about caching, because it is routinely miscast. Anthropic’s own guidance states it plainly: prompt caching does not reduce the number of tokens in context, it reduces what you pay for them on subsequent requests [15]. Caching is a cost lever. Progressive disclosure is a curation lever. Conflating them produces an architecture that is cheap and still crowded.
The governance reading: resident context is a standing charge against every request, including the requests it cannot help. Retrieved context is metered to the work that called it. Moving a standard from resident to retrieved does not weaken it — and it improves what an auditor can observe, because a retrieved instruction leaves a retrieval record where a resident one leaves nothing.
One standard, one surface
Four surfaces carry guidance, and each has an owner [01].
The system prompt describes what product Claude is operating in and what it is doing there. In Claude Code you will likely never modify it; in your own harness it is where the design time goes. What stays off it: rules that hold only some of the time.
CLAUDE.md gets a brief line on what the repository is for, then spends most of its tokens on the gotchas — the conventions a competent reader could not infer. What stays off it: anything already visible from the file system. Where a skill already holds the practice, point at the skill rather than restate it.
Skills carry the opinions, knowledge, and practices particular to you, your team, or your product — the things that cannot be read off the codebase [01][03]. Long ones split across files so that only the relevant file loads [03][06]. Overconstraint is admissible here, but only in the few areas important enough to warrant it.
References carry specs, mockups, test suites, and whole codebases, brought in alongside the plan [01]. And memory now writes itself: rather than curating a file by hand, the platform records what is relevant to the work and to the person doing it, retrieving just in time rather than loading up front [01][11].
The architectural rule that falls out is a single sentence. Every standard has exactly one owning surface, and the surface determines both its cost and its evidentiary character. Duplication across surfaces is not redundancy. It is a conflict waiting for an arbitration you will not be able to reconstruct.
A reference that runs
The last shift translates most directly into assurance.
Anthropic’s guidance is to prefer references that exist as code, because code is a language the model reads with precision: an HTML mockup of a design generally outperforms a prose description of it or a screenshot of it, a specification may be a test suite or a function to port, and taste can be encoded as a rubric a verifier agent runs against the work [01].
Order those by distance from a form that executes and a ladder appears — screenshot, prose description, markdown specification, HTML artifact, test suite, rubric. The ordering is a reading of Anthropic’s guidance rather than a hierarchy they publish, and it should be held as such. But the distinction at the top of it is not soft: a reference that runs is evidence, and a reference that describes is a claim. One can be re-executed by a third party at audit time. The other has to be believed.
That is the instruction argument arriving from the other end. Restating a standard in prose adds volume. Encoding it in something that executes adds control.
Instruction volume is not a governance control, and systems that treated it as one were accumulating arbitration cost while believing they were accumulating assurance.
An arbitration failure does not produce broken work an auditor can find; it produces working work with the constraint quietly discarded — functional correctness above 86 percent while the governing instruction is dropped. Any regime that samples deliverables rather than instruments the decision will certify it.
Governance that lives in instruction text inherits the version volatility of the text. Governance that lives in structure does not.
The reason this matters more than efficiency is what silent arbitration failure looks like from the outside. On the many-tier benchmark, every frontier model holds functional correctness above 86 percent while style compliance — the dimension where the privilege conflict actually has to be resolved — remains the primary bottleneck on overall accuracy [07]. The model completes the task correctly and drops the governing instruction. The deliverable passes its tests. Nothing about the output announces that a control was lost.
And the instrumentation is itself unstable: changing how privilege is represented in the prompt while encoding identical ordering costs Claude Opus 4.6 8 percent of its accuracy, and perturbing privilege values while strictly preserving their order moves aggregate accuracy by under 5 percent while flipping the pass-or-fail outcome on 8 percent or more of individual cases for five of six models tested [07]. Aggregate metrics can hold steady while per-case behavior churns underneath them.
The next dispatch takes this to the surface where the argument gets hardest: what an assurance case looks like when the control is a rubric a verifier executes rather than a rule a human can read.
