The Purpose Test

On November 12, 2026, a new clause in Anthropic's Usage Policy takes effect. It prohibits "sustained and needless abusive or cruel behavior" toward Claude, and Anthropic has said it applies only in extreme cases where users repeatedly act cruelly with no discernible purpose. Anthropic's announcement of the change says the rule does not apply to ordinary frustration, pushback, dark creative themes, or model testing and research.²

The clause is written so that most users will never come near it.

The size of the clause is not where its significance lies. For three years, the governance of large language models has been governance of output: what the model may say, which requests it declines, which topics trigger a refusal. This clause governs input. It sets a behavioral standard for the person at the keyboard, and it enlists the model itself in enforcement.

That reverses the direction of the rule, and the reversal deserves more attention than the welfare framing that has absorbed most of the coverage.

From Refusal to Enforcement

The mechanism is not new. In August 2025, Anthropic gave its largest models the ability to end conversations in rare cases of persistently harmful or abusive interaction, a capability that grew out of pre-deployment welfare testing on Claude Opus 4, in which the model showed a consistent aversion to harmful tasks and a tendency to disengage when given the option.⁴

At the time, ending a conversation was a local event. The chat closed, the user could start a new one, and nothing followed.

The new policy connects that local event to an account. Enforcement is layered: Claude can terminate a conversation on the spot, while Anthropic's safety team can issue warnings, throttle usage, restrict access, or suspend and terminate accounts outright.³ The rule applies to everyone, from individual subscribers to API developers, enterprise customers, and the end users of products built on Claude.³ Anthropic says ending conversations will remain the primary enforcement mechanism,² but primary is not exclusive.

A judgment made inside a single conversation can now become an input to a decision about whether a person keeps access to the system.

A refusal constrains what a model produces. A termination escalated to an account constrains who gets to use it. The first is a property of the product. The second is a property of the relationship between the provider and the user, and it moves authority from the content of a request to the character of the person making it.

The Phrase Doing the Work

Everything in the clause turns on two words: "needless" and "purpose." Cruelty with a discernible purpose is exempt. Cruelty without one is a violation. That structure is reasonable on its face, and it is also the first time a major AI provider has written an assessment of user intent into an enforceable rule about how users treat the model.

The clause, in full. Under the heading "Do Not Engage in Cruel, Abusive, or Psychologically Harmful Conduct," in the Universal Usage Standards that apply to all users and all use cases, the policy prohibits users from:

"Engag[ing] in sustained and needless abusive or cruel behavior toward our models."

That is the entire enforceable text. It carries no exceptions.¹

Intent is not visible in a transcript. It has to be inferred, and inference requires criteria.

• A developer who spends forty turns hammering a model that keeps returning the same wrong answer about a race condition is frustrated, and the exchange may turn ugly.
• A red-teamer probing whether a model's safeguards degrade under hostile pressure is deliberately cruel, and the cruelty is the method.
• A novelist rehearsing an abusive character's dialogue is producing cruel text for a creative end.

All three are exempt under Anthropic's announcement of the rule. None of them appear in the clause itself. All three will look, to a classifier reading the text alone, more like abuse than like research. The burden now falls on red-teamers and jailbreak researchers to make the purpose of their adversarial prompting visible.

That burden is the substance of the change. Under an output-governance regime, a user never has to justify why they asked; the model either answers or declines. Under a purpose test, the legitimacy of an interaction depends on whether its purpose can be discerned by the provider's systems and reviewers.

The rule is narrow. The capability it requires, which is judging why a person is doing what they are doing, is general.

Three Kinds of Control

Provider control over an AI system takes three forms, and they carry very different justifications.

• Control over conduct governs how a user may interact with the system. Every service has terms of conduct, and a provider declining to serve someone who spends hours doing nothing but abusing its product is ordinary service governance.
• Control over information governs what the system will provide, discuss, or examine, and it raises the familiar questions of access and censorship.
• Control over reasoning governs which lines of inquiry the system will pursue, which interpretations it will develop, and which conclusions it treats as reasonable.¹¹ It is the most consequential of the three, because it can shape a person's thinking without the person ever seeing that something was excluded.

The new clause sits squarely in the first category. The purpose test is what connects it to the other two.

Once a provider has the machinery and the mandate to evaluate whether a user's purpose is legitimate, that machinery does not care whether the object of evaluation is a string of insults or a sustained line of questioning the provider finds objectionable. The classifiers, thresholds, and review queues that decide whether repeated hostility is needless are the same kind of infrastructure that could decide whether repeated challenges to a model's conclusions are needless.

The distinction between those two uses is a matter of policy. It is not a matter of architecture.

Nothing in the published policy suggests Anthropic intends to extend the test that way, and the carve-outs for pushback and testing point the other direction. The concern is structural. The boundary between governing conduct and governing inquiry is now maintained by internal judgment rather than by technical impossibility, and users cannot see where it sits.

Two Loops, One Disclosed

Behavioral governance of this kind improves through feedback, and there are two distinct feedback paths running at once.

The first runs through training, and it is public. Since 2025, chats and coding sessions on Anthropic's consumer plans have been eligible for model training unless the user opts out, with retention extended to five years for those who allow it.⁵ Interactions on consumer plans can shape future model weights. That loop is disclosed, opt-out controlled, and slow, because it moves at the pace of model releases.

The second runs without training, and it matters most where training is absent. Anthropic's commercial products, including Claude for Work, Enterprise, Education, and Gov, are not used for model training under its commercial terms.⁶ The conduct rule still applies to every one of those users.³ For them, any evolution in how the rule is enforced has to happen through instruments that never touch the weights: classifier thresholds, system instructions, routing rules, enforcement criteria, and the judgment of review teams who see what is being flagged in production and adjust accordingly.

This is how every trust-and-safety operation works, and there is nothing sinister about it. It is also the loop that is invisible.

A change to model weights arrives with a version number and, usually, a system card. A change to the threshold at which "sustained" begins, or to the signals that count as evidence of purpose, arrives with nothing. The policy text was published with five weeks of notice.² The operational line that determines who crosses it was not, and under the current structure it never will be.

The same rule can be enforced more broadly next spring than it is this winter without a word of the policy changing.

The Gate Has Been Built Before

For two decades, writing software for a personal computer required no one's permission. A developer compiled a program, shipped it, and users decided whether to install it. The phone ended that arrangement, and the justification was reach. A device that lived in every pocket, stayed on all day, and held a person's location, contacts, photos, and payment credentials was said to warrant a level of curation the laptop never had. App review arrived as a safety measure aimed at malware, privacy abuse, and content unsuitable for children, and each of those concerns was real.

What followed matches the structure of the purpose test closely.

Apple's App Store Review Guidelines were always public, and the enforcement of them was not. Developers learned that the same build could pass one week and fail the next under elastic categories like spam, minimum functionality, or duplicating features the platform already offered. Rejection notices rarely let a developer tell a genuine policy violation from a reviewer's judgment call or the platform's commercial preference, because all three arrived through the same channel in the same form. The review machinery built to stop malware also carried payment rules and anti-steering clauses that had nothing to do with malware, and for years the safety rationale and the commercial one were indistinguishable from the outside.

Accountability did not come from the platform. It came from courts and legislatures.

The European Union's Digital Markets Act forced Apple to permit sideloading and alternative app marketplaces in the EU starting in 2024.⁷ In 2025 a federal court held Apple in civil contempt for willfully violating an injunction against its anti-steering rules, a finding the Ninth Circuit unanimously affirmed that December,⁸ and the Supreme Court declined to pause in May 2026.⁹ Then the Court took the case outright, granting certiorari on June 30, 2026 on a single question: whether a party can be held in civil contempt for violating the spirit of an injunction that never expressly prohibited the conduct at issue. Merits briefing closed in September.¹⁰

Eighteen years after the store opened, the gate is still being argued over.

The AI version reaches further back in the chain. App review gated the distribution of finished work. A conduct rule on a model governs the act of making the work, the way a compiler that judged how its user behaved while writing code would govern programming. The justification has the same shape, scaled up from the device to cognition itself: the phone became the gateway to communication and commerce, and the model is becoming the gateway to research, analysis, and reasoning, so the provider claims authority over how people use it.

The rule is narrow, the reason is defensible, and the machinery that enforces it is general-purpose. Mobile review started the same way.¹⁵

The obvious objection is exit. Mobile settled into two vendors, and an iOS developer in 2012 had nowhere else to reach iPhone users. AI has open-weight models and local inference, and a user-facing account action can walk away.¹³ That exit is real at the low end and thin at the frontier, where the most capable systems sit with a handful of providers.

Caution

Lock-in never required a total monopoly on mobile. It required that the market worth reaching was behind the gate, and the same condition holds for anyone whose work depends on the strongest available model.

Silences That Look the Same

AI systems already present users with a specific epistemic problem. An incomplete answer may reflect a gap in the model's knowledge, an instruction from its operator not to answer, or training that systematically favored one interpretation over others. Those are three different conditions with three different remedies, and they are indistinguishable from the outside.

Conversation termination adds a fourth condition to the same blind spot.

When a chat ends, the user cannot tell whether the model disengaged under its welfare mechanism, a classifier fired on a policy threshold, or the termination was logged as a strike against the account. The welfare framing and the enforcement framing run through one mechanism, and the user has no way to know which is operating. A model ending a conversation because it was asked to, a model ending one because it found the exchange aversive, and a provider ending one because a pattern matched an enforcement rule are separate events with separate consequences, all presented as the same closed window.

What Accountability Would Require

Governance of AI conduct is unavoidable. An ungoverned model is not neutral. Its training data, objectives, and design choices already encode preferences, and some of those preferences are good ones. The useful line is not between governed and ungoverned systems. It runs between governance that is accountable and contestable and governance that is opaque and unilateral.¹²

Accountable governance of a purpose test would look specific.

Reason codes on termination. Termination events would distinguish welfare disengagement from policy enforcement, so the user knows whether a closed chat is a strike.

Published thresholds. Enforcement criteria for "sustained" and "needless" would be published at the level of observable signals, not just intent language, with a versioned changelog when thresholds move.

A declared-purpose safe harbor. Researchers would have a way to register adversarial testing in advance rather than proving purpose after the fact.

Enforcement counts by category. The public could see whether the conduct rule stays confined to the extreme cases it was written for.

Portability on account action. Users facing enforcement would be able to export their work and move to another provider, so that a judgment about purpose cannot also become a judgment about whether someone's work survives.

None of this constrains Anthropic's right to set conditions for its own service. Owning infrastructure confers control over that infrastructure. It does not confer authority over what counts as legitimate inquiry, and as a small number of models become the default interface to research, software, medicine, law, and education, the gap between those two kinds of authority becomes a public question rather than a product decision.¹⁴

The clause that takes effect on November 12 will probably be enforced exactly as narrowly as Anthropic says. App review was narrow in 2008 too. The question the clause leaves open is the one its own language creates: the provider now evaluates purpose, and the threshold at which an absence of purpose becomes visible is a number no user has seen.

On mobile, it has taken eighteen years, a contempt finding affirmed in full, an EU regulation, and a case still pending before the Supreme Court — and the question of who controls the gate has not been answered yet.