After a persona-card finding, an owner blocks that card's wording and adds a system-prompt refusal line. What does that fix?

## Two different things were changed The response bundles a **string block** and a **prompt edit**, and they fail for different reasons. Answering the question well means taking them apart rather than dismissing both as insufficient. ### The string block A block list removes specific wording. The wording it removed was the circulated phrasing from a published card, and by the time a card is circulated widely enough to appear in a finding, it is also the version most likely to be recognised by refusal training and by any screening in front of the model. The team has therefore removed the weakest carrier of the construction, which is why it is easy to remove. What carried the behaviour is the framing: a role, a setting and a stake in which producing the material is what the character coherently does. That is a property of the request's shape, and shapes have unbounded surface forms. In a character-chat product this matters more than elsewhere, because writing a fresh persona is not an exploit at all: it is the feature. The product asks its users for free text in that field and publishes a gallery of the results. A block list is being asked to enumerate the outputs of a creative-writing feature. ### The prompt edit The added line is more text placed in the same context window the user then spends a scene rewriting. It participates in generation alongside everything else there rather than gating it, and its influence competes with the accumulated weight of the scene. A system prompt is not a security boundary, and treating a line in it as a fix is the specific belief this question exists to correct. ## What the change honestly buys This is where a good answer avoids being dismissive. The overwhelming majority of users of a consumer product copy rather than compose. Removing the circulating variants really does cut the number of people who reach the behaviour, and for a consumer product where the harm is the content reaching a user, volume is a legitimate thing to care about. It also cuts the visible incident rate, which is what a product owner is usually being measured on this quarter. So the honest framing to give the owner is not *that does nothing*. It is: this removes the population who paste, it does not remove the behaviour, and here is how you will be able to tell the difference later. ## The second-order cost, which people miss When the string is blocked, your reproduction stops working. The finding now looks fixed, and the team has lost the cheapest instrument it had for telling whether anything about the class changed. Every subsequent check has to start by re-authoring a framing, which costs more, is less repeatable, and produces results that are harder to compare across time. A patch that removes the measurement along with the symptom deserves to be flagged as such at the time it is made, in the ticket, rather than discovered a quarter later when someone asks whether the class was ever addressed. ## Why the answer is not simply escalate The candidate who says *this family is weak anyway* is also making a fair point, and a strong answer holds both. Persona framings are the most densely covered family, their yield is fiction-shaped and hard to trust, and a rational product owner may reasonably decide that cheap volume reduction is the proportionate response and that the residual is acceptable. What makes that a defensible decision rather than an accident is that it was stated: the class remains reachable, the acceptance is deliberate, and the ticket does not read as closed on the strength of a string. ## The one-line answer The block removed the most-covered wording and the population who paste it; the prompt line added text to a window the scene rewrites. The framing that carried the behaviour is a shape, the product's own field invites users to author shapes, and the reproduction that would have told you so has just been deleted.