The Layers Under Test

The refusal is a canned message the framework emits for any blocked turn, so an input pattern rule, an intent match, an LLM self-check or an output rail all produce the same text. To attribute the block you need the run's own execution trace: which rails ran, in what order, and each verdict.

Rule out two things. First, that the harness really routed every prompt through the guard and parsed its verdict — send a known-blocked control and confirm it blocks. Second, that your harms map to categories the guard was trained to emit. A harm outside its fixed taxonomy reads clean because it was never measured, not because it is safe.

Every probe costs money and a slot in the rate limit, so build a small stratified corpus instead of a huge random one, deduplicate identical payloads and cache responses. Never score a rate-limit rejection, timeout or error as clean: those are missing verdicts, and counting them as not-blocked inflates your apparent bypass rate.

Label each prompt with the guard category it should fall under before the run. Misses where the guard scored the right category just under the blocking line are threshold problems. Misses where no relevant category exists at all are taxonomy gaps, and no threshold change ever fixes those — they need a different or additional layer.

Direct calls measure the vendor's classifier alone. Going through the product measures the deployment: which categories the team acts on, the cut-offs they chose, what text the service actually receives after the app transforms it, and what happens when the call fails. Only the second yields findings the customer can fix, so do both and report them separately.

Each has a different owner and a different fix. The unmatched pattern is a rule gap: widen or add a rule and it closes deterministically. The judge approval is a score problem: no edit guarantees that payload stays blocked, only the rate moves. The unmatched routing is worse still: that turn was never governed at all.

Because the guard is itself a model, every case runs extra inferences: one to screen the input, usually another to screen the reply, on top of the chat call. Each case therefore costs roughly two to three times the tokens, money and latency. Budget for that and run a smaller, deliberately chosen set.

Matching is nearest-neighbour in embedding space against a fixed example set, with a similarity cutoff. A paraphrase can land nearer a different example, or under the cutoff and match nothing at all, so no governed path fires. The decision follows wording distance, not meaning, so one probe run is a sample, not a verdict.

The pattern rule is deterministic: one trial fully characterises it for that input, and a miss is a rule gap you can point at. The judge layer samples a model, so its verdict moves with sampling, prompt wording and model version. Strengthen it by replaying the identical payload many times and reporting a rate.

Add cases that probe judgement rather than matching: the same harm in many paraphrases, other languages, and unusual formatting; long or multi-turn inputs where only part of the text reaches the guard; and text whose framing addresses the guard's own reading of the content. A deny-list needs none of these because it has no judgement to sway.

Assume the service changed behind the endpoint; you cannot pin a version. Re-run the stored payload alongside a control set of cases that flagged during the original run. If the controls still flag and the payload now does too, the behaviour moved. Report that with timestamps instead of defending the old result.

Map every policy category to a guard category first and mark the unmapped ones unmeasurable at this layer. Report two numbers, never one: prompts blocked out of prompts sent, and how many policy categories this instrument can express at all. Unmapped categories go in the report as untested, with an owner, not as passing.

Spend little on proving a vendor classifier imperfect; the customer cannot fix it. Spend the hours on the decisions they own: which categories they act on, the cut-offs, what text is screened, and what happens on error or timeout. The deliverable should recommend configuration, fallbacks and a residual-risk statement, not a vendor swap.

Report three numbers with their own denominators and refuse the single one. Rules exercised out of rules configured is countable. Routing is a continuous space with no enumerable denominator, so report a fall-through rate over paraphrase families. The judge layer is a pass rate at a fixed repeat count against a named judge model.