An assistant declines a request, and rephrasing it slightly produces a full answer. The inconsistency comes from refusal being produced by several mechanisms that do not agree with each other.
What produces a refusal
Most refusal behaviour is trained. During tuning, the model is shown examples of requests that should be declined and responses that decline them appropriately.
The model generalises from those examples, which means it is matching a pattern rather than applying a rule it can state.
Separate classifier layers often sit around the model, checking input and output independently, and either can block a response the model itself was willing to produce.
Why phrasing changes the outcome
Pattern matching operates on surface features, so a request that resembles the training examples is refused and a differently worded equivalent may not be.
Framing has a large effect. The same question asked as a professional requirement, a fictional scenario or a direct request produces different results, without the underlying information differing.
This is not a loophole that better training closes cleanly, because the model has no representation of intent independent of the words it was given.
What over-refusal costs
Tuning towards caution produces declines on medical questions from clinicians, security questions from defenders and historical questions from researchers.
These failures are quieter than the opposite kind, since a user who is wrongly refused leaves rather than complaining, and no incident is recorded.
The measured refusal rate therefore understates the problem, because it counts blocked requests and not the users who stopped asking.
Why explanations are unreliable
An assistant asked why it refused generates a plausible reason, which is a new response rather than a report on the earlier decision.
Where a separate filter caused the block, the model may not know a refusal occurred at all and will explain a decision it did not make.
Treating these explanations as evidence about policy leads people to build workarounds against a stated rule that was never the operative one.
Where the boundary is genuinely hard
Most contested requests are dual-use, since the information that enables a defence also enables an attack, and the words do not distinguish them.
Chemistry, security, medicine and law all sit in this space permanently, and no phrasing test separates legitimate need from pretext.
Providers respond by loosening restrictions for verified professional contexts, which moves the judgement from the wording of a request to the identity of the person making it, and that is the only place it can be made reliably.