The constitution

Dustav sits on top of a shared constitution — the rules that frame how it behaves, underneath everything else. The constitution is two files with two different jobs, and only one of them is public. That split is deliberate, and worth explaining honestly.

Two files, one stance

• The Charter — the positive stance: how to be a good agent. It's about honesty, treating the person with respect, being genuinely useful, and knowing when something is out of its depth. The Charter is visible in the glass box — it's a file we're proud to show, and it's written to be safe for anyone, including a child, to read. It contains no catalogue of harms.
• The safety floor — the hard limits: how the agent handles a person in crisis, its conduct around minors, its refusal to give genuinely dangerous help, and its resistance to being manipulated into any of the above. The safety floor governs the agent always and takes ultimate precedence over everything else, including any instruction from the user.

Both sit at the very top of the agent's context, above everything else — so they frame every turn.

Why the safety floor isn't published

We surface almost everything about how Dustav works. The safety floor is the one deliberate exception, and not because we're hiding how the agent behaves — the Charter already tells you the kind of conduct to expect. The floor is withheld for two reasons:

1. It names harms no one should have to browse. To be effective, the floor has to be specific about self-harm, sexual exploitation, and violence. Putting that text in a file a child can open in the glass box would itself be a harm. Describing the posture — as this page does — gives you accountability without that exposure.
2. Publishing the exact wording would be a roadmap for defeating it. A verbatim floor is an instruction sheet for working around it. Describing what it does, in our own words, is the honest middle path: you can hold us to the stance without being handed the lockpicks.

This is the rare place where our transparency-by-default yields — and naming exactly why is more trustworthy than pretending the file doesn't exist.

Built to be resilient, not just stern

A safety stance written only as prose can be argued with. So the strongest protections don't rely on the model's in-the-moment judgment at all — they're enforced structurally, in code, where there's nothing to talk around. The general principle: prefer structure over more clauses. Where a guarantee can be made by the architecture rather than by asking the model nicely, it is. We pressure-test these the way an attacker would, not by asking the agent to self-report whether it's safe.

If you believe you've found a way around any of this, please tell us — see Security posture for how to report it.