A skill your agent uses whenever the design must structurally prevent invalid actions — input validation, disabled states, required fields, type-restricted inputs, mode locks, role-based gates…

Apache-2.0Auto-check passedBackend & APIs

Install Constraint

skills CLI
$ npx skills add hashgraph-online/awesome-codex-plugins --skill constraint -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install hashgraph-online/awesome-codex-plugins constraint --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/hashgraph-online/awesome-codex-plugins.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/HDeibler/universal-design-principles/plugins/interaction-and-control-principles/skills/constraint .claude/skills/constraint && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
constraint
GitHub stars
1.2k
Token cost
~3.3k tokens
SKILL.md length
1,512 words
Files
2 (incl. references)
Skills in repo
736
Repo updated
First seen
Licence
Apache-2.0

At a glance

A skill your agent uses whenever the design must structurally prevent invalid actions — input validation, disabled states, required fields, type-restricted inputs, mode locks, role-based gates…

  • Works in 4 steps: The "what could the constraint replace?"… → The disabled-button audit. Every… → The wrong-action thought experiment. For… → …
  • The design must structurally prevent invalid actions — input validation
  • SKILL.md covers Definition (in our own words), Origins and research lineage, Why constraints matter and Physical constraints, plus 9 more sections
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Constraint is an agent skill from hashgraph-online/awesome-codex-plugins. Use this skill whenever the design must structurally prevent invalid actions — input validation, disabled states, required fields, type-restricted inputs, mode locks, role-based gates, hardware lockouts. Trigger when designing forms, picking input types, designing destructive flows, gating multi-step procedures, or thinking about how to prevent a class of errors from being possible at all. Constraint is one of the foundational principles in 'Universal Principles of Design' (Lidwell, Holden, Butler 2003) and one…

Its SKILL.md is about 3.3k tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files, including reference files (for example `references/norman-and-design-history.md`).

It sits in Backend & APIs, covering Authorization and RBAC. The repository describes itself as: A curated list of awesome OpenAI Codex / ChatGPT plugins, skills, and resources. The 1 Codex Marketplace. See live plugins at: https://hol.org/plugins/best-codex-plugins. The licence is Apache-2.0.

When your agent uses it

  • The design must structurally prevent invalid actions — input validation
  • Disabled states
  • Required fields
  • Type-restricted inputs

Example prompts

  • “Universal Principles of Design”
  • “/constraint”

Workflow steps

4 steps, taken from the first numbered list in SKILL.md.

  1. The "what could the constraint replace?" check. For each confirmation in your app, ask: could a constraint do this job? Often yes.
  2. The disabled-button audit. Every disabled control should have a visible explanation of why it's disabled and what would enable it.
  3. The wrong-action thought experiment. For each destructive flow, imagine a user attempting to take the wrong action. What constraint would…
  4. The convention check. Are you violating a learned convention? If yes, the convention is a constraint working against you; either honor it…

What it can do on your machine

Read from SKILL.md and the folder at commit 16b4156. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md (its code samples are html and javascript).

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Constraint loads about 3.3k tokens when it runs, and up to ~4.2k if it reads all its reference files. Until then it costs about 162 tokens; SKILL.md has 1,512 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~162
When it runs · the whole SKILL.md, loaded when a task matches
~3.3k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~4.2k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from hashgraph-online/awesome-codex-plugins at commit 16b4156, republished under its Apache-2.0 licence (© hashgraph-online). 1,512 words, ~3,336 tokens.

Download SKILL.mdSave it as .claude/skills/constraint/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.
name
constraint
description
Use this skill whenever the design must structurally prevent invalid actions — input validation, disabled states, required fields, type-restricted inputs, mode locks, role-based gates, hardware lockouts. Trigger when designing forms, picking input types, designing destructive flows, gating multi-step procedures, or thinking about how to prevent a class of errors from being possible at all. Constraint is one of the foundational principles in 'Universal Principles of Design' (Lidwell, Holden, Butler 2003) and one of the strongest design moves available — preventing wrong actions is more powerful than detecting them after the fact.

Constraint

A constraint is anything that limits the actions a user can perform on a system. Some constraints are physical (you can't insert a USB-C connector upside-down because the shape rejects it). Some are psychological (you don't try to push a door labeled "PULL" because the convention overrides the impulse). Both kinds work upstream of error: instead of catching wrong actions after they happen, constraints make wrong actions hard or impossible.

Definition (in our own words)

A constraint is a deliberate limitation on what the user can do. The limitation may be implemented in the physical structure of the design (a slot that only accepts one shape), in the system's software (a button disabled until preconditions are met), or in the user's psychology (a convention that makes the wrong action feel obviously wrong). All three reduce error rates dramatically — constraints are usually cheaper than recovery, because they prevent the recovery from being needed.

Origins and research lineage

  • Donald Norman, The Design of Everyday Things (1988). Introduced constraints as one of the central tools for usable design. Norman distinguished four types: physical, semantic, cultural, logical. Lidwell, Holden, and Butler simplify to two (physical and psychological), with psychological encompassing semantic, cultural, and logical.
  • Lidwell, Holden & Butler (2003) compactly distinguish:
    • Physical constraints: paths (channels that direct motion), axes (rotary controls), barriers (block undesired actions).
    • Psychological constraints: symbols (semantic communication), conventions (learned practices), mappings (perceived control-effect relationships).
  • James Reason, Human Error (1990). Argued for constraints as the strongest defense against slip-type errors — making the wrong action structurally impossible is more reliable than training operators to avoid it.
  • Affordance theory (J. J. Gibson, 1979) is the conceptual companion: affordance suggests what can be done; constraint blocks what can't. Together they describe the action space.

Why constraints matter

Every error you prevent at the design layer is an error you don't have to detect, recover from, explain, or apologize for. Constraints are the design layer's strongest move because they operate before error occurs:

  • Confirmation asks the user to verify after they've taken the wrong-feeling action.
  • Undo lets them recover after they've taken the wrong action.
  • Constraint makes the wrong action impossible in the first place.

The discipline: when you're tempted to add a confirmation, ask first whether a constraint would do the same job better. Often yes.

Physical constraints

In hardware, physical constraints are the shape of an object directing how it can be used.

The book identifies three subtypes:

Paths

Channels that direct motion. Examples:

  • A scrollbar that constrains motion to one axis.
  • A slot that only accepts a specific connector shape.
  • A door with hinges on one side; it only swings one direction.

In software UI: a slider input is a path constraint — the user can only move along one dimension.

Axes

Rotary controls. Convert applied force into rotation. Examples:

  • A doorknob.
  • A trackball.
  • A volume knob.

In software UI: rotation gestures, dial inputs, the "spin" of an iOS time picker.

Barriers

Block, slow, or redirect motion. Examples:

  • A railroad crossing barrier.
  • The boundary of a screen (the cursor stops there — Fitts's edge advantage).
  • A child-safety cap on a medicine bottle.

In software UI: a modal dialog blocks interaction with the page beneath; a permission gate blocks access to a feature.

Psychological constraints

Constraints that don't physically prevent action but lean on perception, convention, or knowledge.

The book identifies three subtypes:

Symbols

Communicate meaning through language and iconography. Examples:

  • A skull-and-crossbones on a poison bottle.
  • The "WET FLOOR" sign.
  • A red traffic light.

In software UI: a "Disabled" badge; a "Restricted" tooltip; a warning icon.

Conventions

Learned practices. Examples:

  • "Red means stop, green means go."
  • "Click the X to close."
  • "Cmd-S saves."

Conventions are a constraint because the user expects certain actions to do certain things; design that conforms is constrained-by-convention to behave as expected.

Mappings

Perceived relationships between controls and effects. Examples:

  • Light switches near the lights they control.
  • A volume dial that turns the same way the user expects up/down to work.
  • A stovetop where each burner has a knob in a corresponding position.

Good mappings constrain user error by making the wrong action feel wrong.

When to apply

  • Always, on input fields. Type, length, range, format.
  • Always, on actions with preconditions. Submit disabled until form valid; "Send invoice" disabled until recipient selected.
  • On destructive actions where the constraint can be a forcing function. Required type-to-confirm; required password re-entry.
  • On role-gated functionality. Admin-only actions hidden or disabled for non-admins.
  • On state-dependent actions. "Edit" only enabled in edit mode; "Save" only enabled when changes exist.

When NOT to over-constrain

Constraints that don't reflect real requirements feel arbitrary and frustrating:

  • Forced format that's stricter than necessary — a phone field that rejects parentheses.
  • Validation that reflects implementation, not user need — "Display name must contain only ASCII." Why?
  • Mode locks the user can't predict — a "read mode" they didn't enter and can't escape.
  • Disabled buttons with no explanation — the user can't act and doesn't know why.

The discipline: constrain real requirements; communicate the constraint clearly when it surprises.

Worked examples

Example 1: input type as constraint
html
<input type="email" required maxlength="254" autocomplete="email" />
<input type="tel" inputmode="numeric" pattern="[0-9-]+" />
<input type="number" min="0" max="999" step="1" />

The browser enforces the constraints. type="email" rejects malformed emails; min="0" rejects negative numbers. The user can't submit invalid input.

Example 2: button disabled until valid
html
<form id="signup">
  <input name="email" type="email" required />
  <input name="password" type="password" required minlength="12" />
  <button id="submit" disabled>Create account</button>
</form>

<script>
const form = document.getElementById('signup');
const btn = document.getElementById('submit');
form.addEventListener('input', () => {
  btn.disabled = !form.checkValidity();
});
</script>

Submit can't trigger until the form is valid. Pair with inline validation messages so the user knows what's missing.

Example 3: role-based gating
jsx
function DeleteButton({ project, currentUser }) {
  const canDelete = currentUser.role === 'admin' || project.ownerId === currentUser.id;
  if (!canDelete) {
    return null; // hide entirely; user can't even attempt
  }
  return <button onClick={confirmDelete}>Delete project</button>;
}

Users without permission don't see the button. The wrong action can't happen.

Show full SKILL.md (612 more words)Show less
Example 4: type-to-confirm as a forcing-function constraint

The destructive button is disabled until the user types the resource name. The constraint converts a single click into a deliberate multi-step action.

html
<dialog>
  <h2>Delete workspace "Acme Inc"?</h2>
  <p>This cannot be undone. Type <strong>Acme Inc</strong> to confirm:</p>
  <input id="confirm" />
  <button id="delete-btn" disabled class="destructive">Delete workspace</button>
</dialog>

<script>
document.getElementById('confirm').addEventListener('input', e => {
  document.getElementById('delete-btn').disabled = e.target.value !== 'Acme Inc';
});
</script>
Example 5: hardware-style physical constraint in UI

A drag-and-drop with a strict drop-zone restriction:

js
function isValidDropTarget(item, target) {
  if (item.type === 'file' && target.acceptsFiles) return true;
  if (item.type === 'folder' && target.acceptsFolders) return true;
  return false;
}

dropZone.addEventListener('dragover', e => {
  if (isValidDropTarget(draggedItem, dropZone)) {
    dropZone.classList.add('drop-valid');
    e.preventDefault(); // allow drop
  } else {
    dropZone.classList.add('drop-invalid');
    // do not preventDefault — drop won't fire
  }
});

The browser's drag-and-drop API itself is a constraint mechanism: not preventing default during dragover prevents the drop. The user can't complete the wrong drop.

Example 6: USB-C as the canonical physical constraint

USB-C connectors have rotational symmetry — they fit either way. USB-A connectors do not. Generations of users have struggled with the USB-A "flip the cable to insert it correctly" failure. USB-C eliminated the failure mode at the design layer; no error to recover from.

The lesson for software: when you can change the design so the failure can't happen, do that.

Cross-domain examples

Aviation: the auto-pilot disengagement

The auto-pilot can be disengaged by pulling back firmly on the yoke. The disengagement is constrained — a casual touch doesn't trigger it, a firm pull does. The constraint matches the seriousness of the action.

Medicine: child-safety pill caps

A child-safety cap requires push-and-twist simultaneously. The constraint reduces accidental childhood poisoning dramatically. The cost: arthritic adults sometimes struggle with the cap. Trade-off acknowledged; the design is calibrated to the population at greatest risk.

Industrial: dead-man switches

Equipment that requires continuous operator engagement (a hand on the trigger, a foot on the pedal) shuts off if the operator becomes incapacitated. The constraint protects against operator failure.

Software: capability-based security

Modern security designs constrain code to only the capabilities it explicitly needs. A web page can't read your filesystem; an app can't access your microphone without explicit permission; a sandbox limits what an embedded program can do. Each is a constraint at the system layer.

Anti-patterns

  • Disabled buttons with no explanation. User doesn't know why they can't act.
  • Constraints that don't match user need — overly strict format requirements that reject reasonable input.
  • Hidden constraints — the user discovers the limit only after attempting (e.g., a character limit not mentioned until they exceed it).
  • Constraints framed as failures — "Invalid input" instead of "Please enter a valid email like name@example.com."
  • Modal traps — a modal that constrains too aggressively (no Esc, no close X) trapping the user.

Heuristics

  1. The "what could the constraint replace?" check. For each confirmation in your app, ask: could a constraint do this job? Often yes.
  2. The disabled-button audit. Every disabled control should have a visible explanation of why it's disabled and what would enable it.
  3. The wrong-action thought experiment. For each destructive flow, imagine a user attempting to take the wrong action. What constraint would prevent it?
  4. The convention check. Are you violating a learned convention? If yes, the convention is a constraint working against you; either honor it or surface the violation explicitly.
  • affordance — affordance suggests what can be done; constraint limits what can't. Companion principles.
  • mapping — good mapping is a psychological constraint that makes wrong actions feel wrong.
  • forgiveness — when constraint isn't possible, forgiveness handles the recovery.
  • errors — constraints prevent the slip and mistake categories of error.
  • expectation-effect — constraints work better when they match user expectation.
  • visibility — constraints must be visible to be navigable.

Sub-aspect skills

  • constraint-physical — paths, axes, barriers; structural constraints in physical or screen-equivalent form.
  • constraint-psychological — symbols, conventions, mappings; the constraint of expectation and learned practice.

Closing

Constraint is one of the most powerful design tools and one of the most under-used. The reflexive design move on encountering an error is to add a confirmation or improve recovery; the better move, when possible, is to make the wrong action structurally impossible. Constraints are unglamorous but pay continuously across every user, every day.

© hashgraph-online, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file (references) in plugins/HDeibler/universal-design-principles/plugins/interaction-and-control-principles/skills/constraint of hashgraph-online/awesome-codex-plugins.

  • SKILL.md
  • references/norman-and-design-history.md

Open the folder on GitHubat commit 16b4156

Compare with similar skills

Constraint next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Constraint compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Constraint this skillhashgraph-online/awesome-codex-plugins1.2k—~3.3kAutomated safety check: PassApache-2.0
Production Readinesstrycompai/comp2k—~161Automated safety check: PassAGPL-3.0
Frontmcp Auth UIagentfront/frontmcp146—~3.7kAutomated safety check: PassApache-2.0
Phoenix LiveView Patternsgeorgeguimaraes/elixir-agent-tools184—~1.3kAutomated safety check: PassApache-2.0
Azure LighthouseMicrosoftDocs/Agent-Skills775—~1.6kAutomated safety check: PassCC-BY-4.0
Configuring Horizoncoollabsio/coolify63k4 repos~898Automated safety check: PassMIT

Similar skills

  • Production Readiness

    trycompai/comp

    Run all audit checks (RBAC, hooks, design system, tests) and verify build

    2k GitHub stars~161 tokensUpdated 6 days ago
    Backend & APIsAuto-check passed
  • Frontmcp Auth UI

    agentfront/frontmcp

    A skill your agent uses when customizing, branding, or replacing the built-in FrontMCP OAuth pages (the login, consent, federated-select, incremental-authorization, and error pages) with your own…

    146 GitHub stars~3.7k tokensUpdated yesterday
    Backend & APIsAuto-check passed
  • Phoenix LiveView Patterns

    georgeguimaraes/elixir-agent-tools

    Guidance for building and debugging Phoenix web interfaces: where LiveView loads data, scopes, PubSub topics, external polling and component state.

    184 GitHub stars~1.3k tokensUpdated 18 days ago
    Backend & APIsAuto-check passed
  • Azure Lighthouse

    MicrosoftDocs/Agent-Skills

    Official

    Expert knowledge for Azure Lighthouse development including decision making, security, configuration, integrations & coding patterns, and deployment.

    775 GitHub stars~1.6k tokensUpdated 2 days ago
    Backend & APIsAuto-check passed
  • Configuring Horizon

    coollabsio/coolify

    A skill your agent uses whenever the user mentions Horizon by name in a Laravel context.

    63k GitHub starsUsed in 4 repos~898 tokens
    Backend & APIsAuto-check passed
  • K8s Security Policies

    Cybereason-Public/owLSM

    Comprehensive guide for implementing NetworkPolicy, PodSecurityPolicy, RBAC, and Pod Security Standards in Kubernetes.

    280 GitHub starsUsed in 11 repos~2k tokens
    Backend & APIsAuto-check passed

More from hashgraph-online/awesome-codex-plugins

All 736 skills in this repo
  • Anime Reaction Gif

    hashgraph-online/awesome-codex-plugins

    Create original anime-style reaction stickers as looping GIFs and MP4 previews, using generated character pose sheets and timed key poses.

    1.2k GitHub stars~922 tokensUpdated yesterday
    Auto-check passed
  • Calibredb

    hashgraph-online/awesome-codex-plugins

    Manage and query Calibre libraries with the calibredb CLI (local paths or Calibre Content server URLs).

    1.2k GitHub stars~1k tokensUpdated yesterday
    Auto-check passed
  • Rust API Test Harness

    hashgraph-online/awesome-codex-plugins

    A skill your agent uses when adding, changing, testing, or debugging Rust HTTP APIs and services, especially when Codex needs black-box integration tests, random-port app startup, real database test…

    1.2k GitHub stars~1.7k tokensUpdated yesterday
    Auto-check passed
  • Art

    hashgraph-online/awesome-codex-plugins

    Make a studio's game look like something at build time — a cover from a real frame of the game (free), painted covers, backdrops, textures and character plates from image models through the…

    1.2k GitHub stars~2.4k tokensUpdated yesterday
    Auto-check passed
  • Calle

    hashgraph-online/awesome-codex-plugins

    Use CALL-E from Codex through the calle CLI. An agent skill from hashgraph-online/awesome-codex-plugins.

    1.2k GitHub stars~2.9k tokensUpdated yesterday
    Auto-check passed
  • Game Balance Economy

    hashgraph-online/awesome-codex-plugins

    Balance game difficulty, resources, rewards, probability, progression, economies, and dominant strategies.

    1.2k GitHub stars~618 tokensUpdated yesterday
    Auto-check passed

Questions about Constraint

What does Constraint do?

A skill your agent uses whenever the design must structurally prevent invalid actions — input validation, disabled states, required fields, type-restricted inputs, mode locks, role-based gates…. Constraint is an agent skill from hashgraph-online/awesome-codex-plugins. Use this skill whenever the design must structurally prevent invalid actions — input validation, disabled states, required fields, type-restricted inputs, mode locks, role-based gates, hardware lockouts.

When should I use Constraint?

Constraint fits situations like: the design must structurally prevent invalid actions — input validation; disabled states; required fields; type-restricted inputs.

How do I install Constraint in Claude Code?

Run `npx skills add hashgraph-online/awesome-codex-plugins --skill constraint -a claude-code`. Or copy the skill folder (plugins/HDeibler/universal-design-principles/plugins/interaction-and-control-principles/skills/constraint in hashgraph-online/awesome-codex-plugins) into .claude/skills/constraint in your project. Claude Code loads it when a task matches its description.

How do I install Constraint in Codex?

Run `npx skills add hashgraph-online/awesome-codex-plugins --skill constraint -a codex`. Or copy the skill folder (plugins/HDeibler/universal-design-principles/plugins/interaction-and-control-principles/skills/constraint in hashgraph-online/awesome-codex-plugins) into .agents/skills/constraint in your project. Codex loads it when a task matches its description.

Can I use Constraint in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add hashgraph-online/awesome-codex-plugins --skill constraint -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/constraint, .gemini/skills/constraint, .github/skills/constraint and .opencode/skills/constraint in your project.

What does Constraint need to run?

SKILL.md names no scripts, command-line tools or credentials: Constraint is instructions for the agent only.

Does Constraint access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Constraint safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Constraint use?

Constraint is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Constraint use?

About 3.3k tokens (SKILL.md is roughly 13k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 885 tokens, read only when the agent opens those files.

What are the alternatives to Constraint?

Skills that share tags, products or a category with Constraint: Production Readiness (trycompai/comp, 2k stars), Frontmcp Auth UI (agentfront/frontmcp, 146 stars), Phoenix LiveView Patterns (georgeguimaraes/elixir-agent-tools, 184 stars) and Azure Lighthouse (MicrosoftDocs/Agent-Skills, 775 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Constraint?

hashgraph-online (a GitHub organization) maintains it in hashgraph-online/awesome-codex-plugins, which has 1,232 GitHub stars. The repository holds 736 skills in this directory. The repository was last updated on October 6, 2026.

Source: hashgraph-online/awesome-codex-plugins on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.