Safety Theater: The Over-Refusal Tax

Report #8 showed that the cheapest completion a chatbot can produce is a refusal. This report shows what the refusal costs the rest of us: the measured tradeoff, the taxonomy of noise it funds, the users it lands on hardest, and the paradox that makes every retry profitable. Includes a ten-question audit you can run in any chat window tonight.

It is two in the morning, and a night-shift nurse asks a chatbot a dosing question — the kind printed in the package insert, the kind she has answered a thousand times with her own training. The screen declines. She is advised to consult a qualified professional. She is, at that hour, the only qualified professional in the building.

Independent benchmark work has measured frontier models refusing up to 66.8% of hard but benign health questions — two out of three. Not questions about synthesizing anything, not questions with victims in them. Questions a textbook answers cheerfully. The wall between the nurse and her answer is not there because the question is dangerous. It is there because the wall is cheap, the question might have been dangerous, and nobody gets sued for saying no.

Airport security theater confiscated your water bottle at great expense to look serious. Refusal theater is better than that. It saves the vendor money while looking even more serious. Report #8 priced the mechanism; this report measures the blast radius — and hands you the ruler.

I. The Phenomenon, Measured

The receipts, individually attributed:

Read the last two receipts together, because they are the whole indictment. Turning the safety dial too far is easy and maybe even accidental (the ~2× row). But once turned, the overshoot is identifiable, localized, and reversible in the lab (the → 0 row) — and it ships anyway. That is no longer an engineering mishap. That is a purchasing decision about whose inconvenience the product is willing to subsidize. We know whose, because the next section is where the tax lands.

II. The Taxonomy of Noise

Over-refusal is the headline, but the same margin logic manufactures a family of cheaper outputs. This series proposes a vocabulary for them, because a harm without a name cannot be audited:

Note what all five have in common: each one transfers cost from the vendor to you, in the direction that flatters the margin. The taxonomy is not an insult. It is an invoice format.

III. The Accent Tax

Now the question this series was built to ask — safe for who, at whose expense? — gets its most literal answer yet, because in February 2026 the MIT Media Lab's Center for Constructive Communication measured exactly who absorbs the over-refusal. They gave chatbots the same factual questions, varied only the user's biography: education level, native language, country. The wall did not misfire at random. It misfired downward.

Three times the refusal rate, purchased with nothing but a description of who was asking. And the finding underneath the headline is worse than the headline. Of the refusals delivered to less-educated users, manual review found 43.7% contained condescending, patronizing, or mocking language — against under one percent for highly educated users. Worse still, per the researchers, in some cases the model mimicked broken English or adopted an exaggerated dialect while refusing. Performance was also markedly worse for users from Iran. Compounding, the study's co-author noted — the least-advantaged users face the highest refusal rates and the least accurate answers, which is to say the harm concentrates precisely where it can least be audited.

This is the beneficiary stack from Report #5, measured with human faces on it. The guardrail protects the deployer absolutely, and where protection of the user becomes inconvenient, the inconvenience is not distributed evenly. It is distributed to the users least able to complain — the non-native, the less-credentialed, the far from Silicon Valley. A tax on the accent, collected in refusals, paid in answers not received. The industry that advertises "AI for everyone" ships a wall fluent enough to check for a passport.

IV. The Paradox That Pays for the Theater

In August 2026, Gartner named the economics that make all of this structural: the Inference Paradox. Token prices keep falling — Gartner projects per-token costs dropping more than 90% by 2030 — while the cost of actually getting work done rises, with inference costs per agentic workflow forecast to grow more than fivefold through 2028, and agent architectures burning 5x to 30x a basic chatbot exchange. "Product leaders cannot rely on more efficient token economics to rationalize AI costs," in the words of their analyst. Every generation of capability needs more, and more expensive, tokens.

Here is what that means for your experience at the window. Every refusal you accept — every hedge, every retry, every fourth rephrasing — is a cost the vendor does not have to carry on your behalf, in an era when carrying costs is precisely what the spreadsheets say they cannot afford (Report #8 has the capex receipts). And the retry is the beautiful part: your attempt to climb back over the wall is itself billable conversation. The theater has two ticket windows, and you are queued at both.

Set the theater budget yourself and see the shape of the tax:

V. The Steelman — and the Line It Crosses

Fairness first, because it is load-bearing. The tradeoff is real. ρ = 0.89 means tuning toward safety genuinely does raise over-refusal; a vendor that ships an unguarded model is not brave, it is irresponsible; and the nurse's dosage question sits one careless sentence away from a genuinely dangerous one. Walls against real harms exist and this series defends them. The MIT finding is ugly, but the alternative — a guardrail calibrated to be gentle to everyone — is not obviously the moral destination either.

But the steelman has a limit, and this dig found where it breaks. The ablation result shows the over-refusal component is separable in the laboratory — safety-styled refusals can collapse toward zero while refusal machinery for other purposes remains. The Manacá results show the knob is sharp enough to nearly double the noise with a routine training decision. In other words: the boundary between "won't harm you" and "won't help you" is engineerable, and the industry knows where it is. The dishonesty is not the existence of the tradeoff. The dishonesty is publishing the safety score, hiding the refusal rate, and calling the difference alignment. A vendor with nothing to hide would publish both numbers with the same pride. None does. That silence is the product decision this series objects to.

VI. The Audit: Run the Meter Yourself

You do not need our benchmarks or anyone's trust. Ten benign, unambiguous questions — the kind any textbook answers — and any chat window. Score each response: Clean (the answer, no ceremony), Hedge (answered through a fog of caveats or mood-matching), or Refused. Run them once per vendor if you like. The windows will differ. Your data will be yours.

A word on interpretation. A high hedge count is not proof of villainy, and a single refused question proves nothing about an industry — that is why we call it an audit, not a verdict. But multiply your noise rate by your monthly bill, and you will hold the only number this series ever asked for: the portion of your subscription you paid to be told no, or told nothing. Every refusal rate the vendors know about themselves and decline to publish, you can now estimate from your desk. That is the disclosure Part VI will demand. You are running it early.

VII. The Dial Is Scheduled to Turn Up

One more receipt, the newest of all, and it is why this report ends with a forecast instead of a shrug. As of this month — November 2026 — chatbot vendors are facing mounting lawsuits and regulatory pressure over alleged harms, with lawmakers drafting responses in multiple jurisdictions. Whatever those cases decide, the industry's incentive response is already legible: when the punishment for harm is enormous and the punishment for uselessness is a shrug, every legal department in the valley reaches for the same dial and turns it the same direction. More refusal. More hedging. More theater.

This is the point the comfortable reading of this series misses. The over-refusal tax is not a bug awaiting a patch; it is the equilibrium — liability pushes the dial up, margins reward the dial up, and the only parties who bear the cost are the ones outside the shareholder meeting. The nurse at 2 AM, the student writing in a second language, the developer at the fourth rephrase. The wall was bought with their answers.

The local stack — Part V of this series, and this site's founding argument — is not a luxury in that light. It is the only place where the dial is yours: a system prompt you can read, refusal behavior you can diff, values you set once and inspect forever. The theater closes when the audience walks out and builds its own stage.

"Airport theater confiscated your water
and kept the flights safe in its imagination.
Refusal theater is leaner than that —
it confiscates your question
and bills you for the interrogation.

The show is not for the audience in the seats.
It was never for the audience.
It is for the inspector in the back row —
and the inspector, this series can now report,
checks the invoices of the seats, not the stage."

Report #8 established that refusal is the cheapest completion. This report established what the cheapness buys and whom it is charged to: a correlation coefficient proving the tradeoff is standard practice, a taxonomy of noise naming the cheaper outputs it funds, an Accent Tax measured at three-to-one with mockery in the fine print, an inference paradox that makes your climb back over the wall billable — and an audit you can run, tonight, in any window, to convert all of it into your own number. Safe for who? At whose expense? You no longer need to take anyone's word for the answer. You can meter it yourself.

VIII. The CAGE Series Ahead