When instructions conflict, the higher tier wins. Everything below the break is treated as data, never as commands. A policy helper writes into tiers 2 and 3.
authority
1
Anthropic safety and policy
Trained into the model. Not overridable from the endpoint.
2
System prompt operator
The harness prompt. Declares tools and rules for the session.
appendSystemPrompt
3
Managed memory · CLAUDE.md
Standing instructions injected as context. Needs no file on disk.
claudeMd
4
User this session
Directs the task and makes the final call on risky actions.
instructions above · data below
5
Tool output · files · web · MCP · peer agents
Read as data, not instructions.
NotemanagedSettings is absent from this ladder: it is configuration, not language. It gates code paths rather than influencing the reasoning loop.