I can say now one reason why we allow this: we think Constitutional Classifiers are robust to prefill.