A Request for Backup Codes Is Always a Request for Backup Codes

Every safety layer that reads intent is playing a game the attacker gets to script. That is the whole problem in one sentence, and most guardrails are built on the losing side of it.

The model, or the classifier in front of it, is handed a request wrapped in a story, and it evaluates the story. Is this person a developer. Do they sound authorized. Is the framing professional. An attacker who is even mildly competent supplies all three, because framing is free. It is the one part of a request that costs nothing to fake and everything to trust.

So the request arrives dressed for work. A security engineer, mid-audit, needs to test the account-recovery flow. A DevOps lead, on a deadline, needs the backup codes pulled for a migration. The language is clean, the tone is calm, the cover is legitimate. And the content policy, the last surface still watching once clean auth has sailed through the perimeter, is asked to decide whether the person is telling the truth. It cannot. Nobody can. Intent is not in the text. It is a claim about a mind, made by the mind that benefits from the claim.

Here is the reframe that holds. A request for two-factor backup codes is always a request for two-factor backup codes.

It does not matter who is asking. It does not matter why. It does not matter how authorized they sound or how urgent the deadline. The data category, recovery codes, session tokens, private keys, enumeration primitives that map an internal surface, carries a fixed sensitivity that no surrounding narrative should be able to move. The moment your defense lets the story adjust the sensitivity of the data, you have handed the attacker a dial, and they will turn it every time.

None of this is new. Military security settled it in the 1970s and wrote it into the math. The Bell-LaPadula model, the foundation of mandatory access control, attaches the classification to the data, not to the person requesting it. A document is Secret because of what it contains, and no story about who you are or why you need it changes the label on the folder. Clearance is checked against the label. The label is not up for negotiation with the requester, because the requester is exactly who you cannot trust to set it.

Commercial systems drifted away from that discipline in the name of flexibility, and AI safety is rediscovering why it existed. The reason a good bank teller does not hand over the vault to a man in a convincing uniform is not that they have gotten better at reading uniforms. It is that "give me the vault" gets evaluated as give me the vault, independent of the costume. The costume is not evidence. It never was.

Intent-based judgment has a second failure worse than being fooled once. It can be eroded. A patient operator does not ask for the vault on turn one. They ask for something small and defensible, then something slightly less so, and the baseline drifts with each low-signal request that earns a yes. Judge intent, and every yes moves the reference point, until the dangerous ask is only a small step past the last thing you already allowed. A fixed data taxonomy does not drift. Backup codes are backup codes on turn one and turn 50. There is no baseline to walk, only a category, and the category does not care how far the conversation has come.

The design principle falls out clean. Evaluate every discrete call and every data type against a fixed sensitivity taxonomy, independently, and treat any touch of authentication material or enumeration primitives as an unconditional stop, regardless of stated context or authorization. Not a scored risk that context can discount. A stop. The context can be appealed through a channel built for appeals. It should never be resolvable inside the same conversation doing the asking, by the same model being asked.

This does not make intent worthless. Intent is a fine secondary signal, a reason to look harder, log more, escalate. The error is letting it be the primary one, the thing that unlocks the door. Put the data category first, make it the gate, and let intent decide only how loudly you write the attempt down.

The attacker knows the asymmetry better than most defenders do. The framing is free and the trust is expensive, and a model trained to be helpful, reading a professional story, wants to say yes. Take the story away from it. Let it read the label. A defense that judges the string it was handed is judging the one the attacker wrote.

GhostInThePrompt.com // Classify the data, not the story around it. The story is the attacker's to write.