The Refusal Calculus

Most decision systems extrapolate beyond their support and emit a softened warning. They produce an answer, label it as uncertain, and pass the responsibility to the human in the loop. This is acceptable for advisory tools and unacceptable for governed institutional intelligence. A regulator, a CISO, or an auditor needs the system to either answer with evidence, or refuse with a citable bound.

We propose a refusal calculus: a typed procedure by which the substrate can certify that a query lies outside its evidence, and return a citable bound rather than a hedged extrapolation. The bound is a structured object that names the missing evidence, the boundary of the support, and the smallest experiment that would extend it. Refusal becomes a first-class output of the substrate.

Proving non-extrapolation cheaply enough to run at every recommendation is hard. We are exploring three families of approaches: support-region certificates, evidence-class refutations, and posterior-cover bounds. The trade-offs are between proof generality, runtime cost, and the type of guarantee delivered to the institution. None of the three is yet production-ready.

How do we compose refusals across the eight reasoning layers? When a logical layer refuses but a probabilistic layer answers, what is the type signature of the joint output? Can the bound be made falsifiable by the institution that receives it? Should the substrate offer a partial refusal, a kind of structured silence over the parts of the answer that lie outside support?