The refusal path is the feature: 20 prompts, three fabricated APIs, one invented URL

Similarity scores topic, not identity. The chunks retrieval handed back for the Interswitch question were real documentation: Monnify's quickstart and Paystack's accept-payments guide, both covering authentication, checkout and webhooks ^[9]. By the only metric the pipeline had, that retrieval worked. The numbers make the point awkwardly: the worst fabrication in the batch came back with higher retrieval similarity than the cleanest correct decline, so the two sit on the wrong side of each other and no cutoff separates them ^[8]. What the model produced was not a knowledge gap being papered over. It was a brand name substituted into text that was otherwise accurate, which is why nothing in the output looks wrong until you check which company the docs belong to.

Three of the five out-of-corpus prompts fabricated, a 60 percent failure rate, and they did it against a system prompt that already told the model in plain language to say when the context was insufficient ^[5][3]. The invented citation is the part that does real damage downstream: a URL that exists nowhere, attached to plausible headers, reads to a reviewer as a checked answer ^[6]. The same pattern later produced an `x-palmpay-signature` header and a complete HMAC handler for a provider that was never in the corpus ^[16].

The fix was one paragraph added to the system prompt, with no retraining and no change to retrieval ^[10]. On the author's rerun it was clean five for five ^[11]. On an independent cold reproduction, fresh clone and official profiler, three trials per prompt, it was 10 of 15, or about 67 percent, meaning a third of trials still failed ^[13][14][1]. The residue is not spread evenly. Interswitch, Paga and OPay were 9 for 9; Kuda and PalmPay were 1 for 6 between them ^[15][2]. The source reports that split and does not explain it, which is the correct amount to claim from fifteen trials.

That leaves the honest description of the guardrail: it holds for three of the five provider names tested and mostly does not hold for the other two. A rule in the system prompt is advisory to a sampler, and this model had already ignored an instruction of exactly that shape three times out of five ^[5]. The check that would not be advisory is the mechanical one the prompt is asking the model to perform on itself: does any retrieved chunk contain the provider string in the question, and if not, refuse before generation. That is a string test over the retrieved set, not an inference.

The author also logged the cost side rather than declaring victory: the out-of-domain control answer got wordier, offering an unprompted analogy to a similar provider before declining, with no fabricated specifics ^[12]. That is the right trade to take and the right thing to write down. The bigger lesson from the run is about measurement. A refusal path that passes once has been sampled once, and this pipeline's single-run score and its fifteen-trial score disagree by a third.