Guardrails: Refusal and Escalation

When a request is unsafe, out of scope, or under-supported, the copilot refuses or escalates rather than guessing — a designed behavior, not a failure.

Refusal is a feature

A copilot that always answers is dangerous. Kronos copilots are designed to refuse or escalate in well-defined situations: when a requested action would leave the envelope, when the request exceeds the copilot's authority, when the grounding evidence is insufficient, or when the twin state is stale or low-confidence. Refusal with a clear reason is the correct output, not a shortfall.

Refusal triggers

• Action would exit the certified safe operating envelope
• Request exceeds copilot authority (e.g. changing a standing rule)
• Insufficient grounding: no adequate retrieved evidence or twin support
• Stale or low-confidence twin state for a time-critical question
• Request implies a claim the copilot must not make (e.g. pre-FOAK net gain)

Each refusal names its trigger and, where possible, tells the operator what would make the request answerable — a fresher twin snapshot, a scope with more evidence, or a supervisor's authority. Escalation routes the request to a human or to a higher-authority workflow rather than dropping it.

decide(request, state, evidence):
  if would_exit_envelope(request): return REFUSE('envelope', fix)
  if exceeds_authority(request):   return ESCALATE('authority')
  if grounding(evidence) < min:    return REFUSE('insufficient evidence')
  if stale(state) and time_critical(request): return REFUSE('stale state')
  if implies_forbidden_claim(request): return REFUSE('cannot claim')
  return ANSWER

No confident guessing

The failure mode Kronos most guards against is a confident, ungrounded answer. A copilot that lacks the evidence to answer well must say so and label any reasoning as unverified inference, rather than producing a fluent guess that reads as fact. This behavior is measured directly by the grounding evaluation, which includes cases where the correct output is a refusal.

Refusal and escalation are logged like any other decision for audit, so patterns — a class of question the copilot keeps refusing — become signals for improving retrieval, the twin, or the prompt. The behavior is enforced in the prompt template and checked in the regression suite.