Prohibited Use Gate

The bug this exists to prevent

Safety gates usually start correct and erode through ordinary product pressure. Someone adds an enterprise override for a customer who insists their use is legitimate. Someone routes around it for an internal tool. Each change is individually reasonable and the gate ends up advisory.

The subtler failure is precedence. A submitter declares a prohibited purpose, and the content classifier — running afterwards, finding nothing alarming in the text — writes its verdict over the top. The declared block disappears, replaced by a scan that never contradicted it and was never meant to.

Rule 1 — content can only raise, never substitute

The block level is max(declared, derived). A declared prohibited purpose **short-circuits before content signals are evaluated at all** — the declared key wins outright, and there is a test asserting the content stage is never reached.

With no declared purpose, a content signal can still independently raise a block. And an unrecognised declared purpose does not suppress a genuine content-signal block, which is the loophole worth closing: submitting a nonsense purpose string must not be a way to disable the second layer.

Rule 2 — an unrecognised declaration is not an accusation either

Only the exact prohibited keys block on declaration alone. An unrecognised declaredPurpose is not blocked by itself — over-blocking every unknown string makes the gate useless in the ordinary case and trains operators to route around it, which is how gates become advisory.

Rule 3 — it is a keyword heuristic, and says so

This is deliberately not an ML classifier. The property that matters and is testable is fail-closed behaviour — an ambiguous or ungraded input is never silently allowed through a prohibited category — not linguistic sophistication.

A real deployment can swap the classifier at the same call boundary. The value here is the precedence rules and the fail-closed structure around it, which is the part that survives whatever classifier you use.

What this does NOT do

No ML, no model calls, no multilingual coverage. A determined adversary phrasing around a keyword list will get past the content layer — which is why the declared-purpose layer exists and cannot be overridden.

It does not log, report or escalate. It returns a decision.

Verified

30 tests: all nine declared-purpose branches, all sixteen content-signal branches, ordinary content with neither, the declared short-circuit, content raising independently, and an unrecognised declaration failing to suppress a content block.

Not covered: no adversarial-phrasing corpus, and no non-English tests. Both limits are structural to a keyword approach rather than gaps in the suite.