The customer cannot override it.
No setting, plan tier, or support request turns a refusal into a placement. Honesty is not a reseller toggle.
The refusal
The refusal is not an error state. It is the product working.
Three enterprise properties
Branding, contract value, and workflow convenience do not weaken the boundary.
No setting, plan tier, or support request turns a refusal into a placement. Honesty is not a reseller toggle.
The person can confirm their own record. The candidate is a party to the read, not a target of it.
Reason, evidence state, timestamp, and receipt support later review of why the instrument returned nothing.
The machine-readable contract
The response keeps sources found, sources bound, and sources not read separate. It carries permitted use on the wire.
Purpose gating is data.
{
"placement": "INSUFFICIENT_BASIS_TO_PLACE",
"level": null,
"confidence": null,
"score": null,
"reasons": [
"subject_confirmation_not_obtained"
],
"sources_found": 6,
"sources_bound": 0,
"sources_not_read": 2,
"permitted_use": ["none"],
"receipt": "rcpt_01K7...e3a"
}Subject resolution
The person can confirm the record that should be read. The customer cannot substitute an attestation for that confirmation.
Use restriction
It prevents an automated pipeline from converting uncertainty into a person score or a narrative equivalent.
Operationalize the boundary
See the protocol, hiring-system attachment, and governance console envisioned for enterprise delivery.