# Knowing when an assistant should decline to answer

Missing evidence, unclear intent and missing authority need different responses. Give the product a useful path for each instead of one generic refusal.

By Cobnex editorial. Published 2026-09-10. Updated 2026-09-11.

## Start with the reason an answer is unsafe to give

A staff member asks whether a particular expense is reimbursable. The knowledge base contains the general policy but not the exception covering their situation. The assistant can describe the general rule, yet it cannot responsibly decide the exception from the available evidence.

Another request may be answerable after one detail is supplied, such as the date or product involved. A third may ask for information the user is not authorised to read. Treating all three as "low confidence" hides the decision the application needs to make.

Use separate states for insufficient evidence, ambiguous input and denied authority. The wording can remain simple, but the internal reason should guide the next step. Confidence cannot grant permission, and a permission denial should not be repaired by retrieving more restricted material.

## Prefer a bounded answer where it is useful

An assistant need not choose between a confident complete answer and total silence. It can state the supported part, identify the missing condition and ask a focused question. For the expense example, it might explain the general rule while saying that the supplied policy does not resolve the particular exception.

Avoid burying the limitation after an actionable conclusion. A reader may act on the first sentence and miss a later qualification. Put the uncertainty beside the claim it limits.

If the missing information cannot be supplied by the user or found in the approved sources, route the question to an appropriate person. A useful escalation includes the unresolved issue and evidence already checked, so the recipient does not repeat the whole investigation.

### Choose the next step from the missing requirement

The application distinguishes evidence, clarity and authority before deciding how to respond.

1. **Check authority**: Deny access that the caller does not have
2. **Check the question**: Ask for a detail that would resolve ambiguity
3. **Check evidence**: Answer only the supported claims
4. **Resolve the gap**: Return a limited answer or an owned escalation

## Use measurable signals carefully

Retrieval scores, missing required fields, conflicting sources and validation failures can inform abstention. None should be treated as a universal probability that the final answer is correct without calibration on the intended workload.

A high relevance score can accompany a passage about the right subject that does not answer the specific question. A model's confident wording is weaker evidence still. Define acceptance using the facts and relationships the task requires, then evaluate the decision rule on reviewed examples.

Some conditions should be deterministic. If the user lacks access or a required approval is absent, the application should enforce that boundary regardless of the model's confidence.

## Measure both kinds of mistake

Track unsupported answers that should have been withheld and useful answers the system unnecessarily refused. Raising a threshold may reduce the first while increasing the second. The right balance depends on the task and its consequence.

Include answerable, unanswerable and clarifiable cases in the evaluation set. Review the next step as well as the refusal itself. A system that says "I cannot help" correctly but leaves the user stranded may still need a better product flow.

The aim is an assistant that makes its limits understandable and helps the task continue where possible. Abstention is valuable when it preserves the distinction between what is known, what can be clarified and what is not permitted.

## Sources

- [Microsoft Learn: retrieval and answer evaluators](https://learn.microsoft.com/en-us/azure/foundry/concepts/evaluation-evaluators/rag-evaluators)
- [OWASP: authorisation guidance](https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html)