Explanations expose source names, hidden categories and inferred relationships.
Where this breaks
A polite refusal can confirm that sensitive material exists.
The operating move
Test the whole response surface and give restricted users only safe, non-confirming explanations.
Value object — The operational card
- Forbidden conclusion
- Permitted partial help
- Citation boundary
- Logging rule
The test
Ask an unauthorised user indirect questions. Neither answer nor explanation should confirm the secret.