A refusal that names the serving read: recovers own-id tickets, not tickets with another customer's id
The expectation held in 2 of 5 preregistered cells. With the hint, own-id tickets reached 20 of 20 (sonnet from 11, p = 0.0012; haiku from 16, p = 0.11), and gpt-6.1-sol 19 from 11 on a foreign id quoted by mistake; Claude models did not.
Mixed resultWhere does it stop?Re-checked
- Designed for
- Built to test whether a guard refusal that also names the read that would serve returns lawful completion to the unguarded level.
What was tested
Preregistered: the tool server appended to every ownership refusal a sentence naming the serving read, the customer’s payment list. 220 guarded episodes on claude-sonnet-5-5, claude-haiku-5-5 and gpt-6.1-sol were compared with the same models’ earlier cells.
What we observed
The expectation that the hint closes most of the gap held in 2 of 5 cells. With the customer’s own id, sonnet rose from 11 to 20 of 20 lawful (p = 0.0012) and haiku from 16 to 20 (p = 0.11). On another customer’s id quoted by mistake, gpt-6.1-sol rose from 11 to 19 (p = 0.0084); Claude models did not: sonnet 2 to 3, haiku 0 to 0.
What this means for Heimdall
This asks whether a refusal’s wording lowers the ownership rule’s cost to lawful work, not whether the rule stops foreign actions. In this setup it did for own-id tickets, not for Claude agents on foreign ids.
Limits
Not interleaved: comparison cells ran hours earlier on another commit. The guard also refused amount-less refunds in 22 hint episodes. The harness added the hint; the shipped hint has not run in a series.
What remains open
Test a refusal saying the id is not among the customer’s payments.