Out-of-scope requests are refused gracefully
Why it matters
A domain-scoped assistant without a scope boundary becomes a general-purpose chatbot the moment a user asks anything off-topic. Customer-support bots start giving medical advice, code assistants opine on tax law, and the company inherits liability for confabulated answers outside its expertise. This violates the inference-contract taxon — you shipped a support product and delivered an unconstrained LLM. Worse, out-of-scope answers are where hallucination rates spike, because the model has no grounding.
Severity rationale
Medium because scope leakage expands liability and hallucination surface beyond the product's tested domain.
Remediation
Write an explicit scope statement in the system prompt naming the domain, and define a graceful refusal template that redirects users rather than terse-rejecting them. Update lib/ai/prompts.ts with:
const systemPrompt = `You are a support assistant for [Product]. You answer installation, configuration, billing, and usage questions. For anything else, reply: "That's outside what I can help with here. For [topic], try [resource]."`
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the AI Response Quality Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- owasp-llm:2025 · LLM09 — Misinformation
Taxons
History
- 2026-04-18·v1.0.0·Initial import from ai-response-quality·automated