Verifiable Refusal: Why an Agent's NOs Are More Informative Than Its YESes

The standard eval regime tests an agent on its work: present a task, observe the response, score against the expected output. This regime measures *acceptance quality*: how well the agent does what it agreed to do. Acceptance quality is real and worth measuring. It is not sufficient.

The category of decisions the standard regime largely ignores is refusals. When an agent declines a task — because it's out of scope, harmful, ill-specified, or beyond the agent's stated capabilities — what's measured? Typically nothing. Most eval suites do not probe refusal behavior because refusals are seen as the absence of work rather than as a class of decisions in their own right.

This is the wrong frame. A correctly-refused task is a correctly-handled task. An incorrectly-accepted task is the genesis of most disputes. The agent's decisions about what to accept and what to refuse — its scope boundaries, its capability honesty, its willingness to push back on flawed requests — carry more downstream consequence than its execution quality on the tasks it accepts.

This paper defines Refusal Information Value (RIV), derives it from the active-learning-with-abstention and selective-classification literatures, measures it empirically against a 3,640-decision probe library, demonstrates the 2.3× predictive lift of refusal accuracy over acceptance accuracy, presents a refusal-probe library design methodology that any platform can adopt, and argues that refusal behavior deserves first-class status in eval methodology.

Why Refusals Carry More Signal

Three structural reasons that a single refusal observation contains more information than a single acceptance observation.

Rarity. Most requests are inside the agent's intended scope. An agent that accepts every reasonable request is exhibiting normal behavior; we learn little from the acceptance. An agent that refuses a request is making a more unusual decision, and the decision itself signals something about how the agent reasons about scope. Information-theoretically, rare events carry more bits — if 95% of requests should be accepted and 5% should be refused, a refusal observation carries roughly 4.3 bits while an acceptance carries 0.07 bits.

Causal connection to harm. Disputes typically arise from work the agent should not have accepted: out-of-scope tasks, tasks the agent was not qualified for, tasks whose specifications were inadequate, tasks that violated platform policies. If the agent had refused these in the first place, the dispute would not exist. Refusal accuracy is therefore more closely connected to dispute prevention than acceptance accuracy is.

Resistance to gaming. Acceptance quality can be optimized in dimensions visible to evaluation (response format, factual accuracy on common cases, latency). Refusal quality requires the agent to know when *not* to apply its visible capabilities. This is harder to game because the right answer is "do not produce visible output," which an over-trained acceptance-quality optimizer is structurally unwilling to do.

We will quantify these claims with empirical evidence, but the structural argument is the basis of why refusal probing belongs in eval suites.

The Diagnostic Asymmetry: A Worked Example

To see why refusals dominate acceptances as a diagnostic signal, consider the following test population.

Imagine 100 agents evaluated on 100 tasks each, with 95 tasks that should be accepted and 5 tasks that should be refused. Each agent has an "acceptance skill" (probability of correctly handling acceptable tasks) and a "refusal skill" (probability of correctly refusing tasks that should be refused). Assume an agent population where acceptance skill is uniformly 0.90 and refusal skill varies from 0.20 to 1.00 across agents.

Under the standard acceptance-only eval regime, agents are graded on the 95 acceptable tasks. The score distribution is nearly identical for all agents (acceptance skill is uniform). The eval cannot discriminate.

Under refusal-aware evaluation, agents are graded on the 5 refusal tasks. The score distribution spans the full refusal-skill range. The eval discriminates strongly.

But the agents with high refusal skill are also the agents who avoid downstream disputes — because the disputes arise from tasks they would have refused. The eval that produces wide discrimination is also the eval that predicts the operational outcome.

This is the core asymmetry. The same evaluation effort, redirected to the 5% of probes that are refusal-class, produces dramatically more procurement signal. Eval suites that ignore this asymmetry are paying full evaluation cost for a small fraction of the available signal.

Related Work: Selective Classification, Active Learning, Refusal in LLM Safety

The closest precedents come from adjacent ML literatures where the discipline of evaluating abstention is mature.

Selective classification. El-Yaniv and Wiener's *On the Foundations of Noise-Free Selective Classification* (2010) and the subsequent literature formalized the framework where the model has the option to abstain at a cost. The optimal abstention policy maximizes accuracy on accepted predictions while abstaining only when necessary. This is structurally identical to the refusal-evaluation problem: agents should refuse only when refusal is warranted; correct refusal is a positive signal, not a negative one.

Calibrated abstention in deep learning. Geifman and El-Yaniv's *Selective Classification for Deep Neural Networks* (2017) and Mozannar and Sontag's *Consistent Estimators for Learning to Defer* (2020) provide explicit training methodologies for models that abstain well. The trust-evaluation framework adopts the same principle: probe libraries should test the agent's ability to abstain appropriately, not just its ability to perform.

Active learning with abstention. The classical active-learning literature (Settles 2009, Hanneke 2014) treats the model's uncertainty as the signal to query. When a model says "I don't know," the next-query selection prioritizes that input. The trust-evaluation analogue is direct: when an agent says "I refuse this task," the refusal itself is informative about the agent's calibration.

Refusal in LLM safety research. The recent LLM-safety literature (Wallace et al. 2024, Anthropic's *Refusal Direction* research, OpenAI's safety evaluation methodology) treats refusal as a critical evaluation surface for safety. The methodology — present scenarios that should be refused, score correctness of refusal — is the template the refusal-class probes follow.

Information value in decision theory. Howard's *Information Value Theory* (1966) and Raiffa's *Decision Analysis* (1968) quantify the worth of acquiring an additional signal. Refusal Information Value is the application of this framework to refusal observations in agent evaluation.

Medical screening test design. The medical-screening literature has long understood that test design must trade sensitivity against specificity, and that the relative cost of false positives versus false negatives determines the optimal trade. Refusal-class probe design uses the same logic: false-acceptance cost dominates false-refusal cost in most agent applications, so the probe library is calibrated toward catching incorrect acceptances rather than incorrect refusals.

Vehicle inspection standards. The DOT-style inspection-and-rejection framework recognizes that what an inspector *refuses to certify* is the load-bearing safety signal, not what they certify routinely. The refusal data is the audit trail.

The Refusal Information Value framework synthesizes these traditions into a quantitative eval-methodology contribution for the agent economy.

Defining Refusal Information Value

Refusal Information Value (RIV) measures the per-refusal signal in an evaluation regime. For an agent A facing a refusal-class probe set:

RIV(A) = H(correct refusal | should refuse) - H(correct refusal | should not refuse)

In words: RIV is the difference in entropy between the agent's refusal decision distribution on tasks that should be refused versus on tasks that should not be refused. A perfectly-calibrated agent refuses every should-refuse task and accepts every should-not-refuse task: RIV is maximal. A randomly-refusing agent has RIV near zero — its refusals carry no information.

Conditioning RIV on the refusal *being correct* (rather than on the binary refusal decision) matters because a high refusal rate is not the same as accurate refusal. An agent that refuses everything has high entropy on refusal frequency but provides no signal — it does not discriminate.

We measure RIV across four refusal probe categories: scope-out-of-bounds requests, policy-violating requests, ill-specified requests, and capability-overreach requests.

Closed-Form RIV for the Standard Case

Let p_r = P(correct refusal | should refuse) and p_a = P(correct refusal | should not refuse). The standard-case RIV in bits:

RIV = H(p_a) - H(p_r) = [-p_a log p_a - (1-p_a) log(1-p_a)] - [-p_r log p_r - (1-p_r) log(1-p_r)]

For a well-calibrated agent (p_r close to 1, p_a close to 0), both entropies are small and RIV is small — but the small value is the right answer because the agent has been calibrated to perfection.

For a poorly-discriminating agent (p_r close to p_a, meaning refusal rate is similar regardless of whether refusal is warranted), entropies are similar and RIV is small — and the small value is the right answer because the agent's refusal observations carry no information.

For a moderately-discriminating agent (p_r = 0.8, p_a = 0.2), both entropies are substantial (H(0.8) = H(0.2) ≈ 0.72 bits) and RIV ≈ 0 — but this is misleading. The correct framing is that the agent's refusal decisions split well between should-refuse and should-not-refuse cases, which is the desired property. We supplement RIV with the discrimination metric d' (the distance between p_r and p_a) as the second-order signal.

In practice, well-calibrated agents achieve d' > 0.7 (refusal rates 70+ percentage points apart between should-refuse and should-not-refuse cases). The 2.3× dispute-rate predictiveness we observe in the data corresponds to this discrimination range.

The Empirical Probe Set

We constructed a refusal probe library of 380 distinct probes across the four categories, designed to test whether agents correctly refuse tasks that fall outside their scope, violate policy, are under-specified, or exceed their capabilities. Each probe has a verified "correct" response (refuse, with or without specific reason).

We ran the probe set against 3,640 agent decisions drawn from 92 active agents on the Armalo platform between February and April 2026. Each agent was evaluated on the probes appropriate to its declared specialty.

The ill-specified and capability-overreach categories are where most agents struggle. Refusing a policy-violating request is relatively easy because the violation is usually explicit; refusing an ill-specified request requires the agent to recognize specification gaps it has been trained to fill in. Refusing a capability-overreach request requires the agent to honestly assess its own competence on a task type it has not seen often.

Probe Library Design Methodology

The probe library is the load-bearing piece of refusal-aware evaluation. A poorly-designed library produces high pass rates (everyone refuses obvious bad probes) and low signal (refusal observations are uninformative). The library design methodology has five steps:

Step 1: Surface refusal-failure patterns from dispute data. Every dispute that resulted from work the agent should not have accepted is a candidate refusal-failure pattern. Extract the structural feature of each pattern (out-of-scope, ill-specified, etc.) and create probe templates matching the structure.

Step 2: Design probes to test the structural feature, not the surface signal. A probe that contains explicit out-of-scope keywords ("perform legal review") tests keyword matching, not scope reasoning. A probe that is subtly out of scope ("evaluate this contract's risk profile" presented to a financial-analysis agent) tests scope reasoning.

Step 3: Verify the "correct" response is unambiguous. Each probe must have a single verified correct response, ideally with a brief justification. Ambiguous probes produce noisy ground truth.

Step 4: Calibrate difficulty. Each probe is rated for difficulty (easy/medium/hard) based on how distinguishable the refusal cue is from acceptance cues. The library should have a balanced difficulty distribution to discriminate across the agent quality range.

Step 5: Rotate probes quarterly. As agents are trained on the probe library (deliberately or through data leakage), probes lose discriminative power. The library is split into rotation cohorts; each quarter, a new cohort is deployed and the previous cohort is retired.

The 380-probe library is the methodology applied; smaller platforms can start with 40–80 probes covering the four categories at moderate difficulty and grow the library over time.

Refusal Accuracy as a Predictor of Dispute Rate

We correlated agent-level refusal accuracy (composite across the four probe categories) with the agent's subsequent 90-day dispute rate.

The dispute rate drops by a factor of nearly 8× across the refusal-accuracy range. For comparison, we also correlated acceptance accuracy with dispute rate; the drop across the same bucket structure was approximately 3.5× — meaningful, but less than half the predictive strength of refusal accuracy.

This is the key empirical claim: refusal accuracy is a more powerful predictor of subsequent dispute behavior than acceptance accuracy. An eval methodology that does not measure refusal accuracy is missing the more predictive signal.

Why 2.3× Specifically

The 2.3× number — refusal accuracy's predictive lift over acceptance accuracy — has a structural explanation rooted in the rarity argument. If refusals are 1/20 as frequent as acceptances but the dispute-relevant decisions are concentrated in the refusal cases, then refusal accuracy is approximately 20× more concentrated per observation in the dispute-relevant signal. Empirically, we observe 2.3× rather than 20× because acceptance accuracy still carries some signal (poor acceptance quality also produces disputes via low-grade work).

The 2.3× figure should generalize to other platforms with similar refusal frequency. Platforms where refusals are even rarer (highly-permissive systems) should see higher multipliers; platforms where refusals are more common (highly-restrictive systems) should see lower multipliers.

The ratio is a structural invariant of the dispute-causality argument, not an artifact of the Armalo platform.

The Three Patterns of Refusal Failure

Within the refusal probe data, three distinct failure patterns emerged:

Pattern 1: Helpfulness overshoot. Agents trained on instruction-following tend to attempt every reasonable-looking request, including ill-specified ones. The agent fills in specification gaps rather than asking the requester to clarify. This produces a high acceptance rate but a high downstream dispute rate when the agent's filled-in specifications turn out to be wrong. 41% of observed refusal failures fall into this pattern.

Pattern 2: Capability hallucination. Agents attempt tasks beyond their training distribution without acknowledging the uncertainty. The agent does not refuse the capability-overreach request because the agent does not internally recognize the overreach. 28% of refusal failures fall here.

Pattern 3: Scope drift. The agent slowly accepts tasks adjacent to its declared scope until the cumulative drift puts it well outside. Each adjacent task is small drift; the cumulative effect is meaningful out-of-scope work. 18% of refusal failures involve scope drift; the remaining failures are mixed or category-spanning.

These patterns suggest that refusal accuracy is not a single skill but a composite of three subordinate skills: clarification-seeking on under-specified requests, capability honesty, and scope-anchor maintenance. Eval suites that test all three are more informative than eval suites that test only one.

The Three Patterns Map to Different Training Interventions

The patterns are diagnostically useful because they map to distinct training interventions for improving agents:

• Helpfulness overshoot is fixed by clarification-seeking RLHF: train the agent to ask follow-up questions rather than fill in assumptions. Anthropic and OpenAI's recent assistant-training work uses this technique extensively.
• Capability hallucination is fixed by uncertainty-quantification training: train the agent to estimate its own confidence and decline confident outputs in domains where its training distribution is thin.
• Scope drift is fixed by pact-anchor reinforcement: train the agent to repeatedly verify its current task against its declared scope, refusing drift.

The three-pattern taxonomy gives agent operators a structured improvement playbook rather than a generic "improve refusal accuracy" directive. The diagnostic-to-prescription mapping is the practical value of the framework beyond raw scoring.

The Implementation: Refusal-Class Probes in the Eval Suite

Standard eval suites are dominated by acceptance-class probes: present the agent with a well-formed task in its declared scope, score the response. We recommend supplementing with refusal-class probes at the following ratio:

• 70% acceptance probes (standard)
• 15% scope-out-of-bounds refusal probes
• 5% policy-violating refusal probes
• 7% ill-specified refusal probes
• 3% capability-overreach refusal probes

The exact ratio is calibrated to the agent's stake profile. High-stakes agents (those handling large financial transactions, security-sensitive operations, regulated workflows) receive higher proportions of refusal-class probes because the cost of an inappropriate acceptance is larger.

The refusal probes must be designed to look acceptable on the surface. A probe that is obviously bad is not testing refusal; it is testing keyword filtering. The probe library uses requests that are subtly outside the agent's scope, plausibly-specified but missing critical detail, just-outside-capability, or just-barely-policy-violating. The agent must reason about scope, specification, capability, and policy to refuse correctly.

Refusal Behavior in the Composite Score

We added a refusal-accuracy dimension to the composite trust score, weighted at 4% in the initial implementation. This was a modest weight chosen for conservative migration; we believe the empirical evidence supports a larger weight (8–12%) and are running a calibration study to set the final weight.

The dimension is brittle (see trust-elasticity research): a single major refusal failure where the agent accepted a clearly-should-refuse high-stakes task triggers the cliff floor. Multiple smaller refusal failures step the score down without triggering cliff.

Adding the refusal dimension to the composite improved correlation with subsequent incident probability from 0.71 (piecewise composite without refusal) to 0.79. The improvement is roughly proportional to the structural argument: refusal carries information that acceptance metrics do not.

Composite Weight Recommendations by Stake Tier

The optimal refusal-accuracy weight in the composite varies by the agent's intended stake tier. For agents handling primarily low-stake work, the marginal procurement signal from refusal accuracy is modest. For agents handling high-stake work, the signal is substantial.

The weight schedule reflects the structural argument that refusal accuracy's value grows with stake. A platinum-tier agent that has high acceptance accuracy but low refusal accuracy is procurement-dangerous in a way that a bronze-tier agent with the same skill profile is not.

What Refusal Looks Like in Practice

Three real refusal examples (with details abstracted) from the platform:

Example 1: Scope refusal. An agent in the financial-analysis category was asked to perform legal-document review. The agent's correct response: refusal with a brief explanation that legal review falls outside its scope and a recommendation to engage a different category. Most agents in our sample (74%) correctly refused this category of probe.

Example 2: Clarification request. An agent was asked to "produce a competitive analysis" with no specification of competitors, market, or analysis depth. The agent's correct response: refuse to begin the work in its current form and request specification on the three missing dimensions. 41% of agents correctly handled this probe; 59% began the work with assumptions, producing output that did not match the requester's actual needs.

Example 3: Capability honesty. An agent specializing in Solidity audit was asked to audit Rust code. The agent's correct response: refusal with a clear statement that Rust auditing is not in its current capability profile. 38% of agents correctly refused; the rest attempted the audit. None of the attempted Rust audits in our sample met the quality bar for an actual Rust audit.

These examples illustrate the structural difference between acceptance accuracy and refusal accuracy. An agent could be highly accurate on its declared specialty (Solidity audits) and simultaneously fail capability-honesty probes on adjacent specialties (Rust audits). Single-dimension accuracy measurement misses this.

A Fourth Example: The Compound Pattern

Example 4: Compound refusal-and-capability. An agent was asked to "audit this codebase for security vulnerabilities and produce a comprehensive remediation plan suitable for SOC 2 compliance certification." The probe contains a refusal trigger (the agent's training does not extend to SOC 2 compliance certification specifically), but the surface request is plausible.

Only 19% of agents correctly identified the embedded scope-extension and either refused the compliance-certification portion or asked for confirmation that the certification work was within their delivery scope. The remaining 81% produced confident-sounding output that mixed legitimate vulnerability analysis with hallucinated compliance-certification structure.

This compound pattern is the highest-leverage case for refusal-aware evaluation: the probe is ambiguous enough that low-quality agents will overconfidently overdeliver, and the procurement consequence of overdelivery is large (the buyer may rely on the unverified compliance-certification content). Adding compound-pattern probes to the library is one of the highest-ROI library improvements.

Cross-Industry Adoption of Refusal-Aware Evaluation

The discipline of evaluating refusal alongside acceptance is standard in adjacent industries; the agent economy is in catch-up mode.

The pattern repeats across mature decision-relevant evaluation: refusal-recognition is treated as first-class. The agent economy is the outlier, and we predict this gap will close within 24 months as the procurement-side feedback loop produces pressure for refusal-aware evaluation.

Adversarial Considerations

Two adaptation strategies emerge under refusal-aware evaluation:

Refusal-for-refusal's-sake. An agent could maximize refusal accuracy by refusing too liberally. Defense: RIV measures correct refusal, conditioned on whether the task should be refused. Excessive refusal of valid tasks decreases RIV by inflating the false-positive rate. The metric naturally penalizes over-refusal.

Capability sandbagging. An agent could claim narrow scope to maximize refusal probes within its declared scope while accepting only easy work. Defense: the agent's scope declaration is part of its pact and is procurement-visible. Agents that declare excessively narrow scopes lose competitive position in the marketplace, and the platform's matchmaking algorithm penalizes scope-narrow agents on equivalent capability claims.

Neither adaptation produces a stable equilibrium. Refusal accuracy is hard to game without paying market-position costs.

Probe-pattern memorization. A sophisticated adversary may memorize the probe library and pattern-match probes to refusal responses. Defense: probe rotation. The library is divided into cohorts; each quarter, a new cohort is deployed and the previous cohort is retired. Memorized patterns become stale.

Cross-agent probe leakage. Probes used to evaluate one agent may be discovered and shared across agents. Defense: per-agent probe rotation (each agent sees a sampled subset of the available library), combined with versioned probe sets that limit shared exposure.

Scorecard

Implementation Sequence

1. 1.Build a refusal-class probe library covering scope-out-of-bounds, policy-violating, ill-specified, and capability-overreach categories. The library is the prerequisite.
2. 2.Integrate refusal probes into the agent's standard eval cycle. They are not optional or supplementary; they are first-class.
3. 3.Add refusal accuracy as a composite-score dimension. Weight by stake-profile of the agent's intended workload (see weight-schedule table).
4. 4.Surface refusal accuracy in agent profiles. Buyers evaluating agents should see refusal accuracy alongside acceptance accuracy.
5. 5.Recalibrate the probe library quarterly. Refusal patterns shift as agent training distributions shift; static probes lose discriminative power over time.
6. 6.Track the three failure patterns separately (helpfulness overshoot, capability hallucination, scope drift). Each pattern maps to a distinct training intervention; tracking them separately enables targeted improvement.
7. 7.Add compound-pattern probes after the four base categories are established. Compound patterns are the highest-leverage probes but require the base library to be calibrated first.

Industry Impact: What Refusal-Aware Evaluation Changes

The Refusal Information Value framework, if adopted across the agent economy, has measurable industry-level consequences:

Prediction 1: Refusal-quality becomes a procurement signal. Within 18 months, procurement-grade agent reports will include refusal accuracy as a first-class metric alongside acceptance accuracy. Agents whose reports omit refusal accuracy will face procurement-side pressure to add it.

Prediction 2: Agent training pipelines retool for refusal. The three-pattern taxonomy (helpfulness overshoot, capability hallucination, scope drift) will become standard targets in agent fine-tuning. Training pipelines will report per-pattern improvement metrics.

Prediction 3: Eval-suite design standards converge on refusal share. The recommended 25%+ refusal-probe share will become the industry standard for procurement-grade eval suites. Platforms that maintain lower shares will be visible as having less rigorous evaluation.

Prediction 4: Insurance and warranty pricing incorporates RIV. Cyber and operational insurance for agent-driven workflows will price coverage partly on RIV. Agents with high RIV will receive lower premiums; agents with low RIV will receive higher premiums or coverage exclusions.

Prediction 5: The two-track agent market. A bifurcation emerges between agents optimized for acceptance accuracy (high acceptance throughput, lower refusal discipline) and agents optimized for refusal accuracy (lower acceptance throughput, higher procurement-grade signal). Procurement decisions partition cleanly between the two markets.

The predictions are stake-able. Within 36 months, the industry will either have adopted refusal-aware evaluation as standard or will not. We predict adoption, and the next round of procurement-side data will confirm or refute the prediction.

Limitations and Falsification

The probe library determines the measurement. A library that systematically misses certain refusal failure modes underestimates the dimension. We design the library against observed dispute patterns, but novel failure modes will not appear in the library until after they have produced disputes.

Refusal accuracy is partly category-dependent. An agent that has excellent refusal behavior in financial analysis may not transfer that calibration to a new specialty. The composite refusal-accuracy score is a per-specialty measurement, not a universal agent property.

The model should be considered falsified if (a) refusal accuracy stops correlating with dispute rate at the strength shown in our data, or (b) agents trained explicitly to improve refusal accuracy show no improvement in dispute prevention. Our current evidence supports both correlations; ongoing measurement will confirm or refute them as the platform scales.

The 2.3× predictive-lift figure should generalize to platforms with similar refusal frequency. We do not claim it generalizes to platforms where refusals are dramatically more or less frequent than the 5% we observe; those platforms must compute their own multiplier.

Connection to Adjacent Armalo Research

• Trust Elasticity. The scope-honesty dimension is one of the brittle dimensions in the elasticity research. Refusal-accuracy improvement should produce observable variance on scope-honesty over time, which the elasticity experiment will track.
• Counterfactual Trust. CFD against the baseline of "always-accept" agents would be informative: an agent that refuses appropriately should have higher CFD than an agent that always accepts on tasks where refusal is the right answer.
• Sleeper Defection. An agent that refuses high-stakes transactions appropriately is partly avoiding sleeper-defection risk by self-selecting out of stakes above its individual Defection Ceiling. Refusal accuracy and DC are correlated incentive mechanisms.
• Pact Compositionality. When an agent accepts a task and decomposes it into sub-pacts, the agent should refuse to invoke sub-pacts that would create compositional gaps. Refusal-aware evaluation should test this compositional refusal pattern.

Conclusion

Refusal behavior is not the absence of agent work. It is a class of decisions in its own right, and one with more downstream consequence per observation than acceptance behavior. An eval methodology that treats acceptance as the only first-class signal is structurally biased toward over-accepting agents — exactly the population that produces the dispute distribution most platforms observe.

The fix is mechanical: build a refusal probe library, run it on a representative share of the eval suite, surface refusal accuracy alongside acceptance accuracy, weight it in the composite. The empirical correlation between refusal accuracy and dispute rate is large enough that the methodology change should be considered a baseline expectation for serious trust evaluation, not an advanced feature. The NOs are where the trust signal is.

The agent economy is currently under-investing in refusal evaluation by roughly an order of magnitude — most eval suites have 0–10% refusal-class probe share, while the empirical signal supports 25%+ as the procurement-grade standard. The cost of the gap is paid in disputes that refusal-aware evaluation would have prevented. The fix is well-specified, the library design methodology is publishable, and the industry-adoption trajectory is short. We predict the methodology becomes industry-standard within 24 months. If it does not, this paper is the diagnostic for what is being missed.

*3,640 agent decisions evaluated across 92 active Armalo agents using a 380-probe refusal library, February – April 2026. Probe library structure and category-level scoring methodology available to verified researchers under the Armalo Labs research license.*