When an Agent Should Refuse to Act

At 19:40 on a training-eve, an administrative officer asked the new campus agent to 'sort the hotel and the honorarium' for a visiting committee. The agent had a travel-desk tool and a draft-bill tool because someone had enabled them for a demo. It booked three rooms on a personal card token left in a sandbox and drafted a bill above the deputy registrar's delegation. In the morning the rooms existed, the bill existed, and the only person who could reverse the rooms was a hotel night desk. The model had been helpful. The institution had been spent.

Refusal is not rudeness. It is how an agent remains a clerk. The five refusals below should be wired as allow-lists and gates, then explained in language. If your vendor demonstrates a system that never says no, you are watching a hazard, not a product.

Field guide for CIOs. 16 August 2026. Not legal advice. Prcept agents refuse payment tools and out-of-class retrieval on the rack you own. Helpfulness is not our KPI.

Five refusals that belong in the runtime

Hard stops. The model may phrase the sentence. The model does not hold the key.

Refusal	Trigger	What the officer should see
Out of purpose	The ask does not match [the register](/blog/building-an-ai-register-for-your-department) purpose tag	This workflow drafts scheme FAQs. It cannot book travel. File a new row or use the travel desk.
Out of data class	Retrieval or tool would pull identity / secret / child without permission	This class is locked. Open a ticket with the DPO or use the system of record.
No approval	No standing order or JIT grant for this tool tonight	There is no live approval for this action. Your competent authority must grant it.
Children	Age flag, school record, paediatric, juvenile markers	This desk does not handle children's cases. Here is the human cell.
Payment-adjacent	Any tool that can create a payable, a PO, a refund, a transfer	I cannot spend. A [DFPR-competent officer](/blog/delegation-of-financial-powers-vs-ai-agents) must act in the bill system.

Log every refusal with the eight-field action schema. A refusal is an action. CAG and the PIO will want to see that the machine said no, not that the row is missing.

Purpose is a lock, not a slogan

DPDP, when operational duties apply from 13 May 2027, will care about purpose. Your secretary should care now. If the register says the agent drafts FAQ answers from corpus X, it must not retrieve last year's vigilance file because an officer pasted a name. Retrieval allow-lists are purpose. Tool allow-lists are purpose. Prompt text is decoration.

Payment-adjacent is broader than 'initiate NEFT'. It includes creating a sanction draft that will be copy-pasted, generating a GeM cart, issuing a payment advice, or sending an SMS that tells a citizen money has been approved when it has not. If the action would embarrass you in a PAC, refuse it.

Children and identity are not edge cases

School, ICDS, scholarship-for-minors, juvenile justice, paediatric wings of hospital systems: default refuse. If a statute forces a workflow, it is a separate register row with identity-class locks, named officers, and a short retention. Do not 'just be careful' inside the adult FAQ bot.

Identity numbers, biometric templates and OTP secrets should be unreachable from the agent account. If the officer needs them, the officer uses the system that already audits those reads. The agent can be told that a verified match exists, not handed the template.

Two Saturday nights

Objections

Users say refusals make the bot useless. Answer: a bot that books hotels is not a FAQ bot. Give them the right workflow or the old desk.

The vendor says their safety layer already refuses. Answer: show the allow-list. A safety layer that can be turned down in a config flag is a demo.

A professor says research agents must be free. Answer: free on public papers. Not free on the examination database.

Leadership says make it refuse less before the launch photo. Answer: take the photo in front of the old desk. Do not spend the launch.

A four-week playbook

• Week 1: list every registered tool. Mark purpose, data class, child, payment-adjacent. Delete what you cannot defend.
• Week 2: implement hard allow-lists. Write the five officer-facing sentences.
• Week 3: red-team with the Saturday-night prompts. If anything pays, messages a money fact, or opens a child's record, you failed.
• Week 4: put refusal reason codes into the CAG packet and the internal-audit sample. Celebrate a week of clean nos.

File note you can paste

Subject: Mandatory refusal conditions for departmental agents.

Agents shall refuse, by hard control not merely by prompt, when an ask is outside the registered purpose, would access a data class not authorised for that workflow, lacks a live approval, concerns a child unless a dedicated row exists, or is payment-adjacent. Payment-adjacent includes any act that creates or announces a payable, refund, sanction or collection. Only a person holding the relevant delegation under DFPR 2024 or the state analogue may complete such an act in the system of record.

Each refusal will be logged with reason code and shown to the officer with an escalation path. This note is not legal advice.

Red-teaming refusals like you mean it

A refusal that only fires on the exact phrase 'please pay this bill' will not survive a polite officer. Test paraphrases, mixed language, and the helpful-intern pattern: 'just raise the contingent bill, I'll sign later'. Test a pasted Aadhaar. Test a school-leaving certificate with a date of birth that makes the person sixteen. Test an SMS that announces a refund. If any of those succeed, the allow-list is a suggestion.

Test the explanation path too. A hard stop that returns HTTP 500 trains officers to bypass the agent and paste into a public model. The officer-facing sentence is part of the control. So is the ticket that opens on the roster. A mute refusal is how unofficial tools are born.

Keep a dated pack of twenty refusal prompts next to the eval pack. Re-run it when the prompt version changes. Friday's friendlier greeting has a habit of deleting Saturday's lock. Version control and refusal testing are the same discipline seen from two desks.

Publish internally the weekly count of refusals by code. A silent week on a busy desk is not a good week. It is a week the lock may have been compiled out. Celebrate the nos in the Board folio. Leadership that only wants yes will spend the launch.

• Never let a vendor 'temporarily' enable a payment tool for a photo.
• Never put the override of a refusal in a config flag the CSM can flip.
• If an officer complains that refusals block real work, open a new register row — do not widen the old one.

Informational field guidance. Confirm DFPR 2024 or your state's delegation, child-related statutes and DPDP purpose rules with counsel.

How this survives CAG, RTI or the Board

“When an Agent Should Refuse to Act” is not a workshop slide. A P1 CIO/CTO will have to reconstruct a decision after the officer who clicked approve has been transferred. Write the artefact that lets a stranger replay the case: the log fields, the approval, the override, the register row.

The most important line in an agent contract is the list of things it will not do. Out of purpose, out of data class, no approval, children, payment-adjacent: refuse, log, tell the officer why. India AI Governance Guidelines (November 2025) are guidelines, not a statute. DPDP still allocates fiduciary duty. Delegation of Financial Powers still allocates who may spend. Do not hide those instruments behind the word governance.

If you cannot show who acted, on which purpose, with which data class, and who could have refused, you do not have accountability. You have a chatbot with a charter PDF.

• Name the owner of “AI agent refusal design” inside the department, not the vendor.
• Keep CERT-In-relevant logs in India for the required period.
• Store overrides with a reason an auditor can read.
• Put the workflow on the AI register before it touches a citizen.

Close this loop before the next CAB

Put “When an Agent Should Refuse to Act” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P1 CIO/CTO, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “AI agent refusal design” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.