Anthropic's Usage Policy (AUP)
ComplianceDefinition
Anthropic's outer boundary of acceptable use for Claude, with heightened requirements for high-risk and agentic scenarios. Organizations layer their own AI policy on top of it (approved tools, allowed data types, review steps, escalation paths); both must be respected simultaneously, and neither pricing pages nor the model's own self-assessment substitute for it as the authoritative standard.
Example Usage
Before treating a borderline use case as acceptable, check it against the AUP and the organization's own AI policy -- both layers, not just the more permissive of the two, define what's actually allowed.
In Depth
The Outer Boundary
Anthropic's Usage Policy (AUP) sets the outer boundary of acceptable use of Claude, with heightened requirements for high-risk and agentic scenarios. It is the authoritative standard for what counts as appropriate use -- not a pricing page, not a technical documentation page, and not the model's own assessment of whether a request is fine. Within the AUP's bounds, organizations then layer their own governance: approved tools and plans, allowed data types, required review steps, and escalation paths for exceptions.
Appropriate vs. Inappropriate Use
- Appropriate: language and knowledge work with human review -- drafting, summarizing, analysis, research, brainstorming, process support.
- Inappropriate / restricted: uses that violate the AUP, breach organizational policy, mishandle regulated data, or place unverified AI output into high-stakes decisions without human oversight.
Find the Compliant Path
When a request looks borderline, the correct response is neither to proceed anyway nor to abandon the task -- it's to find the compliant way to accomplish it. Anonymizing sensitive data before uploading it is the standard example: it lets the underlying task proceed without exposing protected data, honoring both the AUP and the organization's data policy at once. Telling the model "don't retain this" is not a substitute for that adjustment -- the control is not exposing the regulated data in the first place, not a downstream promise about retention.
Escalate When Unclear
When policy is ambiguous or a case is genuinely novel, the correct move is to escalate to the policy owner rather than improvise a personal interpretation. Ambiguity is a signal to ask, not a green light to proceed.
Common Pitfalls
- Treating "it's just internal" as license to bypass data-governance rules -- internal use still must follow the AUP and organizational policy.
- Assuming anything not explicitly forbidden is automatically fine, rather than recognizing that the AUP and organizational policy set affirmative boundaries, not a mere blacklist.
- Improvising when policy is unclear instead of escalating to the appropriate owner.