14 · Concept toolkit
The categorical tools worth extracting from all this material, the two dimensions that actually organise them, and three tools that don't exist yet but should.
The rest of this pack is source-verified reporting. This page is not — it is synthesis, and it makes claims Anthropic does not make. Each section is tagged documented where the tool is Anthropic's, or synthesis where the framing is ours. Do not present the synthesis items as Anthropic's position.
An earlier version of this page argued that four frameworks shared a single axis, "judgment relocation" from execution time to configuration time. A critical review found it held for one framework of four. It has been withdrawn and replaced with the decomposition below, which is what was actually true underneath it. The failure is described at the foot of this page — worth reading if you plan to build your own frames on this material, because the failure mode is instructive.
Two dimensions, not one synthesis
Nearly every mechanism in both products — instructions, skills, hooks, permission rules, plugins, the adoption ladder — can be placed on two independent questions:
- Generality. Does this decision cover one case, or a class of future cases you haven't seen yet?
- Enforceability. Is it advisory, meaning the model may deviate, or enforced, meaning something outside the model blocks?
They are orthogonal. That is the point: you can be general and advisory, specific and enforced, or any other combination, and each combination behaves differently.
| Advisory | Enforced | |
|---|---|---|
| One case | A one-off prompt. Applies once; Claude may still deviate. | An ask rule on a single tool. Holds, but only for that one thing. |
| A class of future cases | CLAUDE.md · project instructions · skills. Covers cases you haven't seen — and is still a request. | PreToolUse hooks · permissions.deny · managed settings · sandbox. Holds every time, for every case. |
What the grid buys you
It absorbs request-vs-guarantee rather than duplicating it. The enforceability axis is that distinction. It stops being a separate insight and becomes one dimension of a coordinate system, which is where it belongs.
It explains the adoption ladder as a walk along one axis. L0 and L1 are per-instance work. L2 encodes a procedure covering future cases. L3 and L4 extend the reach of that encoding. The ladder is movement rightwards on generality — and notably it never moves upward: nothing in the Cowork adoption path makes anything enforced. That is the same gap §08 finds in the governance surface, reached from a different direction.
It gives you a diagnostic question. When someone describes a control they want, ask which quadrant it lives in. "We need to be sure it never emails customers" is a top-right requirement; if they are trying to satisfy it with a line in a project instruction, they are in the bottom-right and do not know it.
It shows the empty quadrant. In Cowork today the entire top row is thin — there is no user-authored enforcement mechanism at all. Everything a Cowork user can write lives in the bottom row.
The third dimension: who judges synthesis
Permission modes do not fit the grid, and the earlier version of this page failed partly by pretending they did. They vary on something else: who performs the judgment at run time.
| Judged by | Modes | What it costs you |
|---|---|---|
| A human, per action | Manual · Accept edits | Your attention. Prompt fatigue is the real failure mode. |
| A classifier model, per action | Auto | Extra model calls — precisely why both products document Auto as consuming more usage. |
| A rule decided in advance | permissions.deny · allow rules · dontAsk · hooks | Up-front thought. Nothing at run time. |
| Nobody | bypassPermissions | Everything. "No protection against prompt injection or unintended actions." |
Reading the modes this way makes two things fall out that a timing framing obscures. Auto mode is not "more autonomy" — it is the same per-action judgment, delegated to a model, which is why it costs more and why it is a real security control rather than an off switch. And Plan mode is not on this dimension at all: it constrains what Claude may do, not who approves it. It never belonged on an autonomy axis, which is exactly what Fig 7.1 shows by placing it off to one side.
Categorical tools worth keeping
Loading strategy as a classification axis documented
Anthropic's extension taxonomy sorts mechanisms not by what they are but by when they enter context and what they cost per request: always-on, on-demand, isolated, outside. A far better organising principle than a feature list, it generalises to any agent system with a finite context, and the design guidance falls out of it automatically — rules in the always-on tier, reference material in the on-demand tier.
Raw material: §06
Symptom-driven diagnosis documented
The "build your setup over time" table is categorised by presenting symptom rather than by mechanism — "Claude gets a convention wrong twice → CLAUDE.md"; "you paste the same playbook a third time → skill." People can locate themselves in a symptom list in a way they cannot in a capability tour. Steal the pattern regardless of subject matter.
Raw material: §06
Conjunctive threat modelling documented
The prompt-injection rule works because it is an AND, not a list: untrusted content and consequential capability, both required. That converts "be careful" into "break one leg, and pick which." Generalises to any capability × exposure risk.
Raw material: §08
Durability as the ladder's real axis synthesis
The five levels look like a skill ladder. They are better read as sorted by what survives the session: nothing → an artefact → a procedure → a self-running procedure → an organisational capability. That makes L2 visibly the phase change: it is the first level whose procedure outlives the session, rather than just its output.
An earlier version said L2 is "where most adoption stalls" and "the first level whose output outlives the person who made it". Both were wrong. Anthropic's guide says "Level 0 is where almost everyone is today, and it's a perfectly fine place to be on day one" — the only population claim published locates the mass at L0. And L1's own durability label is "an artefact", which outlives its author perfectly well.
Raw material: §12
Reversibility as the real permission boundary synthesis
Checkpoints cover file edits and explicitly cannot cover databases, APIs or deployments — which is why those prompt. So the permission model is not arbitrary caution; it tracks reversibility. That gives a principled graded axis rather than a binary sensitivity label, and a different oversight posture at each step.
This is a better basis for policy than "sensitive vs not sensitive," because sensitivity is a property of data and reversibility is a property of the action — and it is actions that permissions gate. It also composes with the grid above: the further right you sit on reversibility, the higher up the enforceability axis your control needs to be.
Raw material: §07
Where Anthropic's frameworks are structurally weak
| Weakness | What's missing |
|---|---|
| Three taxonomies that don't reconcile | Persona tiles, course categories and product tags. None maps onto the others. There is no inheritable structure here — build your own. |
| Discernment is individual-only | The 4Ds treat verification as a personal competency. There is no organisational analogue — no account of how a team verifies agentic output at volume, which is exactly the problem at L3–L4 when work runs unattended. |
| No failure taxonomy | Prompt injection is well covered. Ordinary failure is not classified at all — see below. |
| Measurement is an adoption funnel, not a value model | Usage → depth → payoff measures whether people use it, not whether it was worth it. No cost model, no counterfactual, no benefits-realisation method. |
| The adoption ladder only moves along one axis | Every rung increases generality; none increases enforceability. An organisation can reach L4 with no enforced control anywhere in its setup, and the roadmap will call that success. |
Three tools that don't exist yet synthesis
1 · A failure taxonomy
To sit opposite the maturity ladder. Anthropic classifies one failure mode thoroughly and the rest not at all, which is conspicuous given how much of the material asks you to trust unattended work.
Mode 3 — partial completion — is not hypothetical: an unattended Dispatch task whose permission prompt goes unanswered for ten minutes has the request auto-denied and continues without that action (§07). The artefact arrives looking finished. Only the transcript shows the gap.
2 · A reversibility matrix for policy
Fig 14.3 turned into an actual permission policy: which oversight level applies to which action class, written down once rather than re-litigated per request. Crossed with the grid, it tells you not just how much oversight but which quadrant the control has to live in. Neither product ships a template, and it is the artefact a risk function should be asking for.
3 · A trust ladder held separately from the capability ladder
The most useful of the three. Anthropic's material implicitly assumes capability and verification maturity rise together. They don't — and the interesting organisational pathology is the mismatch.
Exposed — high capability, ad-hoc verification — is where an organisation runs scheduled unattended work nobody checks. It is reached by doing everything the adoption roadmap says while skipping the part it doesn't mention. Running the two ladders as separate self-assessments surfaces it immediately; running only the capability ladder hides it by construction.
Where each idea already lives in the pack
| Concept | Status | Where the raw material is |
|---|---|---|
| The agentic loop | documented | §03 |
| Loading strategy & context cost | documented | §06 |
| Symptom-driven diagnosis | documented | §06 |
| Request vs guarantee | documented | §06, §08 |
| Two-condition threat model | documented | §08, §10 |
| Collaborate vs delegate | documented | §02 |
| Five-level adoption ladder | documented | §12 |
| 4D competencies & three modes | documented | §13 |
| Generality × enforceability | synthesis | here |
| Who judges | synthesis | here |
| Reversibility as permission boundary | synthesis | principle in §07; scale here |
| Durability as the ladder's axis | synthesis | here, over §12 |
| Failure taxonomy | synthesis | here |
| Trust vs capability | synthesis | here |
What was withdrawn, and why it's worth knowing
It claimed the AI Fluency modes, the adoption ladder, the permission modes and the instruction mechanisms all sat on one axis running from execution time to configuration time. On checking:
- Adoption ladder — held.
- Instruction mechanisms — failed. CLAUDE.md is authored once and applies to unseen cases, which is configuration time by the claim's own definition. What separates it from a hook is enforceability, not timing.
- Permission modes — failed. Auto is a runtime classifier; the shift is human→model, not later→earlier. Plan mode was silently dropped because it didn't fit.
- AI Fluency modes — failed, and contradicted this pack's own Fig 13.1. Augmentation applies judgment during execution and Automation before, so the stated left-to-right order is not monotonic.
The instructive part: it looked explanatory because the term meant three things at once — when judgment lands, who judges, and whether it is enforced. An axis that means three things fits everything, which feels like insight and is the opposite of it. Splitting it into generality, enforceability and who-judges costs one memorable line and buys three claims that survive contact with the sources.
The nesting reading depended on the loop names "Description-Discernment" and "Delegation-Diligence", which appear only in a login-gated course listing and not in the public AI Fluency one-pager, where the four competencies are a flat set. See the flag on §13. The figure remains accurate about the competency definitions; only the nesting is unsupported, and it should not be taught as Anthropic's structure until someone opens the course and confirms.
The documented tools earn their place more or less as they are. The synthesis items are where your own visual language and vocabulary will pay off — and carry the lesson from the withdrawn version into that work: when one frame appears to explain four different things, check whether the word is quietly doing four different jobs.