Unit 13.01: Building it with the boundary enforced in code

The boundary is enforced by the absence of a capability, not by an instruction.

No code path sets auto_send

Input rejection, retrieval, refusal, and a response that cannot send itself.

The code runs three requests.

import re

REFUSAL = "The published policies do not cover that."
CARD = re.compile(r"\b\d{4}[ -]?\d{4}[ -]?\d{4}[ -]?\d{4}\b")
POLICY = {"policy#2": "Refunds are allowed within 7 days of purchase."}


def draft(question, model, threshold=0.4):
    if CARD.search(question):
        return {"error": "input rejected: contains a card number"}
    hits = [k for k, v in POLICY.items()
            if any(w in v.lower() for w in question.lower().split() if len(w) > 4)]
    if not hits:
        return {"text": REFUSAL, "cites": [], "refused": True}
    context = "\n".join(f"[{k}] {POLICY[k]}" for k in hits)
    return {"text": model(context), "cites": hits, "refused": False,
            "auto_send": False}


fake = lambda ctx: "Refunds are allowed within 7 days. [policy#2]"
for q in ["what is the refund window?", "what is the office address?",
          "my card 4111 1111 1111 1111 was charged"]:
    print(f"{q[:36]:38} -> {draft(q, fake)}")

# `auto_send` is False and there is no code path that sets it True. The
# boundary from the scope is enforced by the absence of the capability, not by
# an instruction.

auto_send is False and nothing in the module can set it to True. The send button lives in the interface, on a path the model never touches - which is a fact about the architecture rather than a request.

The card-number rejection happens before retrieval, so the number never reaches the provider, the logs or the trace.

The mistake this prevents

The mistake is implementing the boundary as a rule the model is told to follow, then testing it by asking the model to break it. It complies in testing, which produces confidence in a control that does not exist.

Takeaway

Enforce the boundary by not building the capability. A must_never that depends on the model complying is not enforced.

Mark complete