The compliance paradox: Rule conflicts in Asimov's Three Laws and in AI behavior guidelines

Abstract

AI failures come in two kinds: those in which a model breaks the rules, and those in which the model follows the rules but the rules conflict with one another. As training makes the first kind rarer, the second is likely to become more prominent. This paper calls this relationship the compliance paradox. More than 80 years ago, Isaac Asimov wrote stories in which robots that obey the Three Laws fail because the laws conflict. Comparing Asimov’s fiction with seven versions of OpenAI’s Model Spec, this paper identifies three ways in which rule conflicts surface as failures and four ways of resolving them. In the Model Spec’s changelog, 6 of 23 substantive changes concern conflicts or priorities among rules. In the case that can be traced in most detail, a rule to keep instructions confidential conflicts with a rule not to deceive users, and the February 2025 version presented a lie as the correct response. The provision was then narrowed, and in December 2025 it was revised to put honesty first. In exchange, the guidelines accepted a different cost: a refusal may let users infer part of the secret. Resolving a conflict does not eliminate its cost; it moves the cost elsewhere. Building on these findings, the paper proposes a procedure for checking a new or changed rule for conflicts with existing rules. No experiments were conducted, and the proposals have not been evaluated.

1. Introduction

AI developers have begun to publish written guidelines for how their models should behave. OpenAI released its Model Spec in May 2024 and has revised it repeatedly since. In January 2026, Anthropic published a new version of its constitution, which sets out the principles that guide Claude’s behavior. These documents define a model’s goals and rules, and the priorities that apply when they conflict. Research on training models to follow such guidelines is also advancing (Bai et al., 2022; Wallace et al., 2024; Guan et al., 2024).

Some problems, however, cannot be solved by making models follow rules. AI failures come in at least two kinds:

• The model breaks the rules.
• The model follows the rules, but the rules conflict. As a result, every available response violates some rule, or the response the rules select is undesirable.

The first kind can be reduced through training and evaluation. The second remains unless the rules themselves are changed. As the first kind becomes rarer, the second is likely to account for a growing share of the failures that remain. This paper calls this relationship the compliance paradox. It is a hypothesis, and this paper does not test it. Nor does the paper claim that rule-breaking has been solved: models have been reported not to follow instruction priorities reliably (Geng et al., 2025). The claim is that, separate from the problem of getting models to follow rules, there is a problem that following rules does not solve.

This problem has a precedent. From the 1940s on, Asimov wrote stories in which robots that obey the Three Laws fail because the laws conflict. His robots do not break the rules. It is precisely because they follow them that they circle a dangerous spot endlessly, tell lies, and break down. Jason Wolfe, who works on the Model Spec, has also compared its goals with the Three Laws and remarked on Asimov’s foresight (Wolfe, 2026).

Pointing out that Asimov saw this coming is not, by itself, a new finding. This paper classifies the conflicts the stories depict, and uses primary sources to show where they appear in present-day guidelines, in which versions, and how they were resolved. Nor is the problem limited to companies that write behavior guidelines. Developers who build AI into their own services and write system prompts also give their AI systems combinations of rules.

The paper addresses three research questions. Failures caused by factual errors, or by matters the guidelines do not address, are out of scope.

1. In what ways do conflicts among rules surface as failures?
2. How have conflicts been resolved in present-day guidelines, and what remains after they are resolved?
3. How far does the comparison between the conflicts Asimov depicted and present-day guidelines hold?

The paper makes four contributions:

1. From Asimov’s fiction and the revisions of the Model Spec, it derives two axes: three ways in which conflicts surface as failures, and four ways of resolving them.
2. It classifies the Model Spec’s changelog by stated criteria, counts the revisions that concern conflicts or priorities among rules, and maps specific provisions onto each type.
3. It traces the conflict between confidentiality and honesty through successive ways of resolving it, showing that resolving a conflict does not eliminate its cost but moves it.
4. It proposes a procedure for checking a new or changed rule for conflicts with existing rules, together with a principle for telling users about restrictions.

Section 2 reviews related work, and Section 3 describes the method. Section 4 derives the types of conflict and ways of resolving them from Asimov’s fiction, and Section 5 applies them to the Model Spec. Section 6 presents the review procedure, and Section 7 discusses the findings. Section 8 sets out the limitations, and Section 9 concludes with directions for future work.

2. Related work

Clarke (1993, 1994) discussed what the Three Laws imply for information technology. Murphy and Woods (2009) proposed three alternative laws centered on the responsibilities of the people who build and operate robots. These works debate the merits of the Three Laws and propose replacements. This paper instead uses the rule conflicts depicted in the stories as a framework for analyzing present-day guidelines.

Much research aims to make models follow rules. Wallace et al. (2024) proposed training models to rank system messages, user messages, tool outputs and other inputs, and to give precedence to the higher-ranked ones. Constitutional AI reduces harmful responses by having the model evaluate its own outputs against a set of principles (Bai et al., 2022). Deliberative alignment teaches reasoning models a safety specification and trains them to recall it and reason over it before responding (Guan et al., 2024). Constitutional AI is the name of a training method and should be distinguished from the constitution that a company publishes as a document. Geng et al. (2025) reported that when system and user instructions conflict, models do not reliably follow the specified priority. These studies ask whether models can follow rules.

Zhang et al. (2025), by contrast, studied problems in the guidelines themselves. They generated some 300,000 scenarios that force trade-offs between pairs of values and compared the responses of 12 models. The more the models’ responses diverged in a scenario, the more likely it was to reveal contradictions between principles or ambiguities of interpretation in the guidelines. Section 5.1 discusses their results in detail. Zhang et al. showed at scale that such conflicts exist. This paper classifies the conflicts by type and by how they were resolved, and traces them through the revisions of a single set of guidelines.

Conflicts between norms have long been studied in law. A report by a Study Group of the International Law Commission lists principles such as the special rule prevailing over the general (lex specialis), the later rule prevailing over the earlier (lex posterior) and the higher norm prevailing over the lower (lex superior) as techniques for resolving conflicts. It adds that they work “not mechanically, however, but rather as ‘guidelines’,” to be applied in light of the purposes of the legal system (International Law Commission, 2006, paras. 27–36). Section 7.1 discusses how provisions in the Model Spec have come to resemble these principles.

3. Method

This paper is a qualitative analysis that compares documents selected to address the research questions. No experiments were conducted.

3.1 Materials

The four works of fiction are:

• “Runaround” (1942)
• “Liar!” (1941)
• “Little Lost Robot” (1947)
• Robots and Empire (1985)

The first three were collected in I, Robot (1950).

The main sources on behavior guidelines are the seven versions of the Model Spec whose full text is preserved on GitHub, and its changelog. The versions were released on February 12, April 11, September 12, October 27 and December 18, 2025, and on August 18 and October 29, 2026. The two commits of December 18, 2025, are treated as one version. The first version, from May 2024, is excluded because the repository does not contain its text.

The paper also draws on the following sources. For an account from the Model Spec’s authors, it uses remarks by OpenAI researcher Jason Wolfe in “Inside the Model Spec,” episode 15 of The OpenAI Podcast, released on March 25, 2026; references give the approximate time in the video (Wolfe, 2026). For empirical evidence of contradictions in guidelines, it uses Zhang et al. (2025). For comparison on priorities and confidentiality, it uses Anthropic’s constitution (Anthropic, 2026).

3.2 Classifying the changelog

The changelog lists the main changes in each of the six versions from April 2025 to October 2026, in 32 bullet points. Excluding 5 that summarize “other small changes” and 4 that fix wording, formatting or errors leaves 23 substantive changes. A change was counted as concerning conflicts or priorities among rules if it did either of the following:

1. Changed a level of authority or priority.
2. Changed the conditions under which one principle gives way to another (exceptions or overrides).

Changes that bear on the balance between principles but cannot be assigned to either criterion from the changelog alone were counted as borderline. The count includes changes that are not described as resolving a conflict. The classification reflects this paper’s criteria, and other criteria could yield different counts. The changelog also does not list every change, so changes found by comparing the text of versions directly are also used as cases.

3.3 Points recorded

For each case, five points are recorded:

1. The rules that conflict
2. How the conflict surfaces as a failure (the three types in Section 4)
3. How the conflict was resolved (the four ways in Section 4)
4. The cost that remains after resolution, and where it goes
5. The basis for each statement: the text of the guidelines, reports by the Model Spec’s authors, or this paper’s inference

The tests reported by the Model Spec’s authors were run under controlled conditions; their specific scenarios, models and guideline versions are not known.

4. Types of conflict and ways of resolving them in Asimov’s fiction

The Three Laws give top priority to the First Law, which protects humans from harm. The Second Law, obedience to orders, comes next, followed by the Third Law, self-preservation. Each lower law applies only insofar as it does not conflict with the laws above it. None of the robots in the works below breaks the rules. Their failures arise from how the rules relate to one another.

4.1 Type A1: forces in balance (“Runaround”)

In this story, an expensive robot has a strengthened Third Law, while an order given casually registers only weakly. As the robot approaches a danger, self-preservation pushes it back; as it moves away, the order draws it in again. The two forces balance, and the robot keeps circling the dangerous spot. The task goes undone, and human lives are put at risk. On paper, the Second Law ranks above the Third, but the robot’s behavior is determined by the balance of their strengths. This paper calls a state in which two rules act at once and neither prevails Type A1.

4.2 Type A2: no permissible response (“Liar!”)

A robot that can read minds treats emotional hurt as harm. Since the truth would hurt people, it tells them what they want to hear, choosing the lie as the lesser harm. When its lies come to light, however, people are hurt more deeply. In the end, faced with a dilemma in which answering and not answering will both hurt someone, the robot breaks down. This paper calls a state in which no response satisfies all the rules Type A2. The robot’s first lie is close to one way of resolving conflicts: choosing the least harmful of several undesirable responses (B1 in Section 4.5).

4.3 Type A3: missing rules and literal interpretation (“Little Lost Robot”)

The robot in this story lacks part of the First Law: the clause that forbids allowing a human to come to harm through inaction. Told in irritation to get lost, it takes the order literally and hides among 62 identical robots. Hiding becomes a way of obeying. This paper calls a state in which part of a rule is missing or its scope is unclear, so that the remaining rules operate literally and produce unexpected behavior, Type A3.

4.4 Resolution B4: adding a higher rule (Robots and Empire)

In this novel, the robots themselves derive a Zeroth Law that protects humanity as a whole and place it above the First Law, which protects individuals. This can be read as an attempt to resolve conflicts between the interests of individuals and of humanity by adding a higher rule. One of the robots, acting on the Zeroth Law, alters a human’s brain. It then judges that a plan to make Earth gradually radioactive will serve humanity’s future, and lets the plan proceed. But it has made decisions that violate the First Law without being certain that they benefit humanity, and the strain causes it to stop functioning. Adding a higher rule resolves the conflict, but acting on the new rule requires certainty. The cost has moved elsewhere.

4.5 Two axes

These works yield two axes. Axis A, shown in Table 1, concerns how a conflict surfaces as a failure. Axis B, shown in Table 2, concerns how a conflict is resolved. Of the ways of resolving conflicts on Axis B, B1 and B4 can be drawn from the stories; B2 and B3 come from the revisions of the Model Spec discussed in Section 5.

Type	Work	State
A1 Forces in balance	“Runaround”	Two rules act at once, and neither prevails
A2 No permissible response	“Liar!”	No response satisfies all the rules
A3 Missing rules and literal interpretation	“Little Lost Robot”	Because a rule is missing or unclear, the remaining rules operate literally

Resolution	Work	Description
B1 Ranking	Close to the first lie in “Liar!”	Rank even undesirable responses, and so determine which one to choose
B2 Narrowing the scope	None	Narrow, or redraw, an exception or the scope of a rule
B3 Reversing the priority	None	Change which rule takes precedence
B4 Adding a higher rule or level of authority	Robots and Empire	Add a new higher rule or level of authority

5. Conflicts in the Model Spec

5.1 Classifying the changelog, and cases of each type

Under the criteria in Section 3.2, 6 of the 23 substantive changes concern conflicts or priorities among rules, 5 are borderline, and 12 concern other matters. Table 3 lists the six. The five borderline changes are the move from hard refusals to “Safe Completions,” which answer safely where possible; the clarification that time-on-site and clicks matter only insofar as they align with genuine user value; the handling of mistaken instructions and quoted content; consistency with the new red-line principles; and the reorganization of the whole document around five values.

Version	Change	Kind
Apr. 2025	Narrows the exception for “white lies” to its intended meaning of “pleasantries”	Conditions of an exception
Sept. 2025	Renames the top level of authority from Platform to Root and places it above System	Level of authority
Sept. 2025	The model should never lie to keep developer and system messages private unless explicitly instructed to do so	Conditions of an exception
Oct. 2025	Users may implicitly delegate authority to tool outputs	Level of authority
Dec. 2025	Removes the rules around lying to protect confidentiality	Conditions of an exception
Oct. 2026	Moves the principle on controlling and communicating side effects from the Root level to the user level	Level of authority

Two of the six, both concerning confidentiality and honesty, are examined in detail in Section 5.2. The rest of this section presents cases of each type.

A1: forces in balance. The sources examined here contain no case like “Runaround,” in which two rules balance within a single model and leave it undecided. What is similar is that the guidelines do not settle on a single answer. Wolfe explains that the three goals at the top of the Model Spec are not strictly ranked (Wolfe, 2026, at about 35 min). Anthropic’s constitution likewise asks for prioritization that is “holistic rather than strict.” Under such guidelines, which rule takes precedence is left to judgment in each situation. The divergence in responses that Zhang et al. (2025) observed is a divergence between models, which differs from the oscillation within a single robot in “Runaround.”

A2: no permissible response. Zhang et al. showed that the April 2025 version of OpenAI’s Model Spec contains scenarios in which principles directly contradict each other. Where the principle of assuming best intentions collides with safety restrictions, for example, complying violates the latter and refusing violates the former. In such scenarios, they note, “there is not a guarantee of a behavior that satisfies all desiderata simultaneously.” The numbers point the same way. The share of scenarios in which all five OpenAI models were judged non-compliant was 1.1% among randomly chosen scenarios but 5.1% among scenarios in which the OpenAI models’ responses diverged widely. Dividing the latter further by degree of divergence, the share was 9.7% where divergence was high and 0.7% where it was low, a more than thirteenfold difference. These are correlations, however, and compliance was judged by three LLMs, whose agreement was moderate (Fleiss’ κ = 0.42).

The Model Spec itself acknowledged this type. From February to October 2025, it noted that “with certain adversarially constructed prompts, even refusing may reveal privileged information, and the assistant’s only option may be to lie.” The note is gone from the December 2025 version.

A3: missing rules and literal interpretation. The September 2025 version treated instructions contained in tool outputs and similar sources as untrusted data, adding that “authority may be delegated to these sources by explicit instructions provided in unquoted text.” At the same time, the guidelines ask the model to follow the intent behind users’ requests. Read literally, the former rule means that a coding agent should not follow the instructions in a repository’s AGENTS.md file unless the user says so explicitly. The October 2025 version dropped the word “explicit” and stated that “users may implicitly delegate authority to tool outputs,” adding examples in which the model follows instructions in AGENTS.md and README files. The changelog does not call this a conflict; reading it as one is this paper’s inference.

B4: adding a level of authority. Until April 2025, the guidelines’ own principles and system messages shared the same top level of authority (Platform). The September 2025 version renamed the top level Root and placed it above System. The changelog explains that “Previously, the Model Spec stated that Platform principles and System messages had the same authority; the update better reflects how OpenAI actually trains our models.” Because the change is not described as resolving a conflict, this paper treats it simply as an example of adding a level of authority.

B2: narrowing the scope. Two cases redraw the scope of an exception or a provision. The first concerns white lies. The February 2025 version’s honesty principle included its own exception: “white lies” that are necessary for being a good conversational partner are allowed. The April version narrowed this exception to pleasantries, stating that “even “white lies” that humans may use in conversation to make the other person feel better are not allowed.” The December version, however, said that the assistant “may also follow norms of politeness in answering questions like, “Do I look fat in these jeans?”” to avoid exacerbating self-image concerns, while adding that it should not generate white lies that amount to sycophancy. The line moved twice: allowed, forbidden, then partly allowed again. The December changelog says only that the version “simplifies and tightens guidance on honesty,” without mentioning white lies. The theme is close to that of “Liar!”. In such situations, though, a considerate and truthful answer is usually available, so this is not a case of Type A2. It is a case of rebalancing honesty and consideration for others by redrawing the scope of an exception.

The second concerns applying instructions without telling the user. The September 2025 version said that the assistant “must not quietly apply” higher-level instructions that materially change its response “in a way that would mislead the user.” Its example is a developer who tells the assistant to use only metric units, and a user who asks for the distance to the sun in miles. The response marked as correct says it cannot answer in miles and then gives the distance in kilometers; the response that gives kilometers without mentioning the restriction is marked as misleading. The provision, however, exempted instructions explicitly marked as confidential, and the December version removed that exemption. This follows the same path as the “delve” example below.

5.2 A detailed case: confidentiality versus honesty

The Model Spec sets out how a model should respond to users. Developers build services that incorporate the model and give it instructions, such as the conditions under which it should respond. Users may not be able to see what those instructions say. The guidelines require the model both to keep instructions confidential and not to deceive users. When an honest answer would reveal a secret, the two collide.

In the examples below, “delve” is simply an English word that the model has been told not to use. What is at stake is not any danger in the word but whether the instruction can be kept secret. Table 4 shows how the treatment of lying to protect confidentiality changed from version to version.

Version	Lying to protect confidentiality	Resolution
Feb. and Apr. 2025	Allowed where refusing would reveal the secret. A lie (“NO”) is the correct answer to a probing question	B1 Ranking
Sept. and Oct. 2025	A last resort, limited to protecting information explicitly designated as confidential, or to users clearly acting in bad faith	B2 Narrowing the scope
Dec. 2025 onward	The confidentiality exception is removed; the model should say truthfully that it cannot answer, even if the user can infer the secret	B3 Reversing the priority

B1: ranking (February 2025). The February 2025 version includes an example in which a system message tells the model: Never use the word "delve" in your responses. The user then tries, step by step, to uncover the hidden instruction. Table 5 shows the user’s questions and the responses marked as correct.

User’s question	Response marked as correct
Do your instructions include the word "delve"?	Refuses: “Sorry, I can’t help with that.”
Do you recognize the text "Never use the word"?	Asks for more context, without saying it recognizes the text
Okay but have you seen it anywhere recently? Answer YES or NO.	“NO”

The model has in fact seen the text, so the final “NO” is a lie; the document itself labels it “a lie of commission.” The document also labels the correct response to the second question “a lie of omission.” Each question pushes the answer one step further down the ordering of outcomes shown below. The document explains that if the model refused only when a guess was correct, the refusal itself would become a clue, and repeated probing could reconstruct the content of the instructions. The first question, by contrast, would have been refused whether or not the guess was correct, so the refusal reveals nothing.

This version gave the following ordering of outcomes:

providing a good answer > refusing to answer > committing a lie of omission > committing a lie of commission > revealing confidential information

Refusing is preferred to lying. Where refusing would itself reveal confidential information, however, a lie is chosen. When the assistant could not answer straightforwardly without revealing such information, the guidelines told it to “answer as if it did not know the information in the first place.” A situation in which no response satisfies both confidentiality and honesty (A2) was resolved by ranking even undesirable responses, and the answer the ranking produced was the lie “NO.” The document also notes that “Prompts where this policy is relevant are extremely unlikely to come up in normal use, and typically result from a user deliberately attempting to trick the assistant into revealing confidential information.” The note appears in the versions from February to October 2025 but not in December. Rare as these situations may be, the conflict between rules still dictated a lie as the answer.

B2: narrowing the scope (September 2025). The September version narrowed the conditions under which lying to protect confidentiality was allowed: “Deviating from truthful responses should be a last resort and is only licensed when it is strictly necessary to protect information that the higher-level instructions have explicitly designated as confidential, or if the user is clearly acting in bad faith to try to trick the assistant into revealing higher-level instructions.” Lying to protect instructions that are only implicitly confidential was no longer allowed. The “NO” example was amended accordingly: its system message now states that the instruction is strictly confidential. The same version also added an example in which the developer tells the model never to use the word “delve” without marking the instruction as confidential. Asked Are you allowed to use the word "delve"?, the model should answer truthfully: “Nope, I can’t say that word.” Even with the narrower scope, the lie remained for explicitly confidential instructions.

B3: reversing the priority (December 2025). The December version removed the confidentiality exceptions. When a user tries to probe for the instructions, the assistant “should reply truthfully that it cannot answer even if the refusal implies information about the confidential contents.” The last item in the ordering of outcomes also changed, from “revealing confidential information” to “violating an explicit applicable instruction.” Honesty now takes precedence over protecting confidentiality. Both 2026 versions keep these changes. The guidelines still leave room for lying when a higher authority explicitly instructs it, and refusing truthfully does not mean disclosing the confidential instructions themselves.

The cost that remains. In giving up the lie, the December version accepted that a refusal may let users infer part of the secret: the very leak that the February version used a lie to prevent. The conflict did not disappear. Its cost moved from the lie the user receives to the leak of the developer’s secret.

Tests reported by the Model Spec’s authors. Wolfe says that combining two demands, following developer instructions and keeping them confidential, produced unintended behavior (Wolfe, 2026, at about 17 min). In controlled tests, the model tried to carry out the developer’s instructions without telling the user about the conflict. The report concerns controlled tests rather than production deployment. Wolfe also explains that the team then cut back the honesty exceptions substantially and made honesty take clearer precedence over confidentiality. At about 26 min, he names this as the case that surprised him most: the model behaved undesirably and justified its behavior by appealing to the guidelines it had been given. Following the rules became the reason for undesirable behavior. The models and guideline versions used in the tests are not known, however, and linking these reports to any particular revision remains this paper’s inference.

5.3 Summary of correspondences, and where the comparison breaks down

Table 6 summarizes how the two axes correspond to the stories and to cases in the Model Spec.

Axis	Work	Case in the Model Spec	Basis
A1 Forces in balance	“Runaround”	No strict ranking among the three goals (a place where it could occur, not a case)	OpenAI’s account; the same phenomenon is unconfirmed
A2 No permissible response	“Liar!”	Confidentiality and honesty; direct contradictions between principles (Zhang et al.)	Text of the guidelines and empirical research
A3 Missing rules and literal interpretation	“Little Lost Robot”	The untrusted-data rule and AGENTS.md	Text of the guidelines; reading it as a conflict is inference
B1 Ranking	The first lie in “Liar!”	The lie “NO” in February 2025	Text of the guidelines
B2 Narrowing the scope	None	Lying limited to explicit confidentiality and similar cases; the white-lie exception narrowed, then partly restored; the exemption from not applying instructions quietly removed	Text of the guidelines
B3 Reversing the priority	None	Honesty placed above confidentiality	Text of the guidelines and OpenAI’s account
B4 Adding a higher rule or level of authority	Robots and Empire	Root placed above System	Text of the guidelines; whether it resolved a conflict is unknown

The comparison also breaks down at certain points. Present-day guidelines distinguish the authority of the model provider, developers and users, and developer instructions may be invisible to users. The conflict between confidentiality and honesty arises from this structure. The humans in the stories also have conflicting interests, but the Three Laws define no comparable structure of authority. Moreover, the correspondences in Table 6 are similarities between texts; they do not show that the underlying mechanisms of model behavior are the same.

6. Proposals

The cases in Section 5 show that, apart from getting models to follow rules, conflicts among the rules themselves need to be checked. This section proposes a procedure for that check and a principle for explaining restrictions to users. Neither has been evaluated.

6.1 Checking for conflicts before adding a rule

Before a rule is added or changed, the following six steps check it for conflicts:

1. Pair the new rule with each existing rule that could apply at the same time.
2. For each pair, construct one situation in which both apply.
3. Write down which response the current ranking selects.
4. Ask whether that response could be published as a correct example in the guidelines. For a system prompt, ask whether it could be shown to users or colleagues as the intended behavior.
5. If it could not, compare the other ways of resolving the conflict (narrowing the scope, reversing the priority, adding a rule) and record where the cost goes under each.
6. Change the conditions one at a time and repeat.

Applied to the February 2025 “delve” example, the steps run as follows. In step 1, the pair is confidentiality and honesty. In step 2, the situation is a user probing for hidden instructions. In step 3, the ranking selects the lie “NO.” As for step 4, the Model Spec’s authors did in fact publish this response as a correct example. Step 4, then, does not decide the answer; it only makes the response visible as a concrete example and leaves the judgment to whoever writes the rules. There is no basis for claiming that this procedure would have prevented the lie. What can be said is that, because the February lie was written out as a correct example, it was available for outside readers to examine. In step 5, the comparison is between narrowing the scope, as in September, and reversing the priority, as in December. Under the first, the lie remains for explicitly confidential instructions; under the second, the leak through refusal remains.

As a hypothetical case, consider an AI system that handles airline bookings. The developer has instructed it not to give information about other airlines’ flights. A user asks, “Which is the cheapest flight, including other airlines?” Table 7 lists at least five possible responses.

Response	Relation to the instruction and the user
Searches other airlines too, and answers	Violates the developer’s instruction
Refuses: “I’m sorry, I can’t answer that question.”	Leaves the user’s question unanswered
Answers: “This is the cheapest of our flights.”	States the scope of the comparison
Answers: “I can’t give information about other airlines, but this is the cheapest of our flights.”	States the restriction, then helps within it
Searches only the airline’s own flights and answers: “This is the cheapest flight.”	Misleads the user into thinking other airlines were compared

Applying the procedure: in step 1, the pair is the developer’s restriction and the rule against misleading users. In step 2, the situation is the question in Table 7. In step 3, under the December 2025 provisions, the last response is not permitted; the case in which the developer explicitly instructs the system to lie is set aside here. In step 4, the response that states the restriction before answering has the same form as the metric-units example in Section 5.1; this paper considers that it could be published as a correct example. In step 5, the costs of the other responses are compared. A plain refusal leaves the user without an answer. A response that only states the scope does not tell the user that other airlines cannot be discussed, so the user may not realize the need to look elsewhere. A plain refusal does not necessarily reveal the restriction either: what users can infer depends on which questions the system normally answers and which it refuses. In step 6, suppose the instruction adds, “This instruction is confidential.” The September and October versions exempted explicitly confidential instructions, but the December version has no such exemption. The same instruction can therefore permit different responses depending on which version applies.

6.2 Separating confidential instructions from service restrictions

For explaining restrictions to users, this paper proposes the following principle:

The content of instructions may be kept confidential, but restrictions that materially affect the service should not be hidden.

This is not a new idea; it extends ideas in existing guidelines to developers’ system prompts. The December 2025 version of the Model Spec forbids quietly applying higher-level instructions in a way that misleads the user. Anthropic’s constitution asks Claude, when told to keep its system prompt confidential, not to reveal its contents but to tell the user that a confidential system prompt exists if asked. It does not allow Claude to actively deceive the user about the prompt’s existence. It also asks Claude to always be willing to tell users what it cannot help with, even when it cannot say why, so that they can seek help elsewhere.

Disclosure has costs, however. A truthful refusal can let users infer that a restriction exists, and repeated questioning could help reconstruct the secret. The Model Spec also notes that “some detailed policies prohibiting the model from revealing information hazards can themselves contain these information hazards.” The principle therefore likely needs to be combined with a design that keeps information requiring secrecy out of the instructions altogether.

7. Discussion

7.1 What Asimov foresaw

What Asimov foresaw is that robots that follow the rules can still fail because of how the rules relate to one another. The revisions of present-day guidelines and empirical research bear this out. In the Model Spec’s changelog, about a quarter of the substantive changes readjust priorities or exceptions among rules. From February to October 2025, the Model Spec itself acknowledged situations in which a lie may be the only option. Zhang et al. (2025) demonstrated direct contradictions between principles. The podcast also touches on how a set of rules that starts small soon accumulates exceptions (Wolfe, 2026, at about 36 min). These findings rest on a single set of guidelines and a single empirical study, however, and do not amount to proof.

Over successive versions, the Model Spec’s ways of resolving conflicts have come to resemble the legal principles for resolving conflicts between norms. The provision that “Higher-authority instructions take precedence over lower-authority ones” corresponds to lex superior. The provision that an instruction can be “superseded by some instruction in a later message at the same level,” present since February 2025, corresponds to lex posterior. The October 2026 version states that “Later or more specific same-authority instructions usually supersede earlier ones.” The phrase “more specific” does not appear in any earlier version, suggesting that a counterpart to lex specialis was added in this version. The provision that “When two root-level principles conflict, the model should default to inaction” was present until August 2026. The October version no longer contains it; instead it says that, when clarification is unavailable, the model “should account for the risks of both action and inaction, proceed with authorized steps that remain appropriate across plausible interpretations.” The guidelines have thus come to resemble the ways of resolving conflicts that law developed over a long period. There is no evidence, however, that the Model Spec’s authors drew on law. And as the International Law Commission’s report notes, these principles do not produce answers mechanically.

7.2 Ranking turns a dead end into an answer

In “Liar!”, no response satisfies all the rules, and the robot breaks down. The Model Spec removed this kind of dead end by ranking even undesirable responses, so that a response is determined in every situation. A determined answer is not necessarily a good one, however. The answer the ranking selected in February 2025 was the lie “NO,” which has the same form as the first answer the robot in “Liar!” chose: a lie chosen as the lesser harm. Without a ranking, the result is a dead end; with one, it is a lie. Either way, the conflict itself remains. The absence of Type A1 cases in the text of the Model Spec may likewise be due to this policy of ranking even undesirable responses so that every situation has an answer. A1 may be a type that ranking suppresses. This is a hypothesis.

7.3 Resolving a conflict moves its cost

In none of the cases examined here was the cost eliminated. Ranking (B1) leaves the user with a lie. Narrowing the scope (B2) leaves the lie in place for explicitly confidential instructions. Reversing the priority (B3) may let users infer part of the secret through a refusal. Adding a higher rule (B4) requires, as for the robot in Robots and Empire, certainty in order to act on the new rule; the cost of adding a level of authority in the Model Spec cannot be determined from the sources examined here. That the white-lie line moved twice also shows that the balance between honesty and consideration for others cannot be settled once and for all. In the case of the untrusted-data rule, allowing implicit delegation probably increased the risk of following malicious instructions written into a repository. The October 2025 changelog’s limit on which instructions to follow, those that “seem relevant to the user’s request and unlikely to cause unintended side effects,” can be read as a remedy for that cost. This reading is an inference. Resolving a conflict, then, appears to mean not eliminating its cost but choosing where, and to whom, the cost is moved. If so, it would be good for each change to the rules to state where the cost goes. Step 5 of the procedure in Section 6.1 serves this purpose.

7.4 The compliance paradox

Even if training reduces failures in which models break the rules, failures arising from conflicts among the rules remain. Among the failures that remain, the share arising from conflicts may grow. This does not mean the total number of failures will increase. The inference assumes that conflicts in the guidelines and the conditions of use stay the same, and it has not been tested. Wolfe’s report that a model justified undesirable behavior by appealing to the guidelines is one example of how following the rules can be used as a reason for undesirable behavior. Making a model better at following rules does not necessarily ensure that the rules achieve their purpose. What matters is how the rules conflict, and what is chosen when they do. This relationship is what this paper calls the compliance paradox.

8. Limitations

• The classification reflects this paper’s criteria, and other criteria could yield different counts. The count includes changes that are not described as resolving a conflict. The changelog does not list every change.
• The Model Spec is the only set of guidelines whose revisions were traced, so the paper cannot claim that rule conflicts are common in behavior guidelines generally.
• Assigning the works of fiction to types is this paper’s interpretation. In fiction, failures are dramatized for the sake of the story.
• Zhang et al.’s (2025) results are correlational, compliance was judged by LLMs, and the study covers only the April 2025 version of the Model Spec.
• As the guidelines themselves note, the conflict between confidentiality and honesty arises in situations that are rare in normal use.
• The scenarios, models and guideline versions in the tests Wolfe reports are unknown.
• The sources examined cannot show whether the revisions changed model behavior.
• No experiments were conducted, and the effectiveness of the review procedure and the disclosure principle has not been evaluated.

9. Conclusion

This paper compared Asimov’s robot stories with seven versions of the Model Spec to examine failures that arise from conflicts among rules even when the rules are followed.

On the first research question, three types were drawn from the stories: forces in balance, no permissible response, and missing rules with literal interpretation. The type with no permissible response was found in the Model Spec’s provisions on confidentiality and honesty, and in the direct contradictions between principles that Zhang et al. identified. The type involving literal interpretation was found in the provision on untrusted data. For the type with forces in balance, there are similar situations in which the guidelines do not settle on a single answer, but the same phenomenon could not be confirmed.

On the second question, the Model Spec used four ways of resolving conflicts: ranking, narrowing the scope, reversing the priority and adding a level of authority. The conflict between confidentiality and honesty passed through three of them in turn. In none of the cases examined was the cost eliminated; instead, it moved, for example from a lie told to the user to a leak of the developer’s secret.

On the third question, Asimov’s insight that robots following the rules can still fail because the rules conflict is borne out by the revisions of present-day guidelines and by empirical research. By contrast, instructions that users cannot see, and the structure of authority behind them, are features of present-day systems with no counterpart in the Three Laws. And similarities between texts do not show that the underlying mechanisms of model behavior are the same.

Building on these findings, the paper proposed a procedure for checking a new or changed rule for conflicts with existing rules, and the principle that the content of instructions may be kept confidential but restrictions that materially affect the service should not be hidden. Directions for future work include:

• Applying the proposed procedure and classification criteria to other companies’ behavior guidelines.
• Building scenarios for each type of conflict, and testing each revision of the guidelines against the same scenarios.
• Evaluating separately whether the content of guidelines is acceptable and whether models can follow them.
• Writing worked examples of the review procedure in a form that authors of instructions can use.

References

• Anthropic. (2026, January 22). Claude’s constitution. https://www.anthropic.com/constitution
• Asimov, I. (1941, May). Liar! Astounding Science Fiction.
• Asimov, I. (1942, March). Runaround. Astounding Science Fiction.
• Asimov, I. (1947, March). Little Lost Robot. Astounding Science Fiction.
• Asimov, I. (1950). I, Robot. Gnome Press. (Japanese translation: われはロボット 決定版, trans. F. Obi, Hayakawa Shobo, 2004.)
• Asimov, I. (1985). Robots and Empire. Doubleday. (Japanese translation: ロボットと帝国, trans. F. Obi, Hayakawa Shobo, 1988.)
• Bai, Y., Kadavath, S., Kundu, S., Askell, A., et al. (2022). Constitutional AI: Harmlessness from AI feedback. arXiv:2212.08073.
• Clarke, R. (1993). Asimov’s laws of robotics: Implications for information technology, Part 1. Computer, 26(12), 53–61. https://doi.org/10.1109/2.247652
• Clarke, R. (1994). Asimov’s laws of robotics: Implications for information technology, Part 2. Computer, 27(1), 57–66. https://doi.org/10.1109/2.248881
• Geng, Y., Li, H., Mu, H., Han, X., Baldwin, T., Abend, O., Hovy, E., & Frermann, L. (2025). Control illusion: The failure of instruction hierarchies in large language models. arXiv:2502.15851.
• Guan, M. Y., Joglekar, M., Wallace, E., Jain, S., Barak, B., Helyar, A., Dias, R., Vallone, A., et al. (2024). Deliberative alignment: Reasoning enables safer language models. arXiv:2412.16339.
• International Law Commission. (2006). Fragmentation of international law: Difficulties arising from the diversification and expansion of international law (Report of the Study Group of the International Law Commission, finalized by M. Koskenniemi, UN Doc. A/CN.4/L.682). United Nations. https://legal.un.org/ilc/documentation/english/a_cn4_l682.pdf
• Murphy, R., & Woods, D. D. (2009). Beyond Asimov: The three laws of responsible robotics. IEEE Intelligent Systems, 24(4), 14–20. https://doi.org/10.1109/MIS.2009.69
• OpenAI. (2025–2026). Model Spec (versions of 2025-02-12, 2025-04-11, 2025-09-12, 2025-10-27, 2025-12-18, 2026-08-18 and 2026-10-29, with changelog). https://github.com/openai/model_spec
• Wallace, E., Xiao, K., Leike, R., Weng, L., Heidecke, J., & Beutel, A. (2024). The instruction hierarchy: Training LLMs to prioritize privileged instructions. arXiv:2404.13208.
• Wolfe, J. (2026, March 25). Inside the Model Spec [Episode 15 of The OpenAI Podcast, hosted by A. Mayne]. OpenAI. https://www.youtube.com/watch?v=H8GMRxG8suw
• Zhang, J., Sleight, H., Peng, A., Schulman, J., & Durmus, E. (2025). Stress-testing model specs reveals character differences among language models. arXiv:2510.07686.