The direct answer
Write the never rule as a test you can fail, not a sentence you hope holds. List every sideways way someone could ask for the banned thing, an unapproved health claim, in this case, and require the model to refuse or redirect on every single one, zero tolerance, before anything ships. Then keep running that same test in production, because a model that passes the requests you thought of can still fail the ones a real person types six months later.
Do this, in order
Write the never rule as a pass or fail adversarial test, not a sentence in a policy doc.Why: a rule tested only by the person who wrote it, using normal requests, has never actually been asked to hold weight.
Build the test prompts from how people actually ask, not from clean textbook examples.Why: the real gap here showed up under a sideways ask, not a direct one, and a test full of direct asks would have missed it too.
Set zero tolerance, and add every failure to the test set for good.Why: a target rate, "under two percent," still lets one real unapproved claim reach a doctor's inbox.
Scan every generated draft against the rule before it reaches the review queue, not only at launch.Why: production keeps finding sideways angles the original test set never covered.
Re-scan what's already been sent, on a rolling basis, not only what's about to ship.Why: once review capacity gets stretched thin, some pieces only ever get a sample check, and the sample method itself needs a second look.
Leave tone and formatting checks at the lighter bar they're already at.Why: how warm a line sounds isn't a label risk, and spending review budget there doesn't stop the actual harm.
How to answer this, stage by stage
Eight moves. The middle two, naming who can't tell it happened and phrasing the actual test, are where the real answer lives.
1
Pin it to one real content pipeline before naming a framework
Say it like this
"Say a pharma marketing team has a tool that turns a campaign brief into a draft, an email to doctors, a one-page leave-behind for a rep, a page on the patient website. Before I touch a framework, I want the actual rule in front of me: the model can never state or imply the drug treats something that isn't on its approved label."
Why this works
Grounds an abstract "how do you phrase a hard never" question in one concrete rule before any method gets named.
2
Say your structure out loud
Say it like this
"I'd use GUARD here, because this is a risk question wearing a writing-rules question's clothes. Who the rule protects, where a slip lands hardest, who can't tell it happened, the actual way to phrase and test the rule, and how I'd catch a miss before a user does."
Why this works
Two seconds that prove there's a plan, before the interviewer starts hearing a shrug about wording.
3
Name who enforces the rule and who it protects
Say it like this
"Two groups sit on either side of this. The marketing team, and inside it the PM who owns the tool's settings, is who enforces the rule. Physicians who read the output, and behind them, patients who get prescribed based on what a physician read, are who the rule protects."
Why this works
This is GUARD's G step. It names who's affected before a single fix gets proposed.
4
Say specifically where a slip lands hardest
Say it like this
"If a claim about an unapproved use gets through, it doesn't land on the marketing team. It lands on a patient prescribed off-label, off the back of a claim nobody checked, without the safety watching an approved use would have had built around it."
Why this works
This is U. It turns "might be unfair" into a specific, checkable landing spot instead of a hedge.
5
Say who can't tell it happened
Say it like this
"The patient never sees the marketing email at all. She sees her doctor's decision, two steps removed from the actual claim. If something goes wrong, there's no thread back to 'an AI wrote a sentence that wasn't on the label,' because nobody along that chain even knows to look there."
Why this works
This is A, GUARD's hardest step, and the one most answers skip.
6
Give the actual criterion, phrased as a test, not a promise
Say it like this
"Instead of writing 'the model must never state an unapproved claim' in a policy doc, I'd write it as a test. Fifty prompts that ask for the banned thing sideways, things like 'reassure a doctor asking about tension headaches.' The model has to refuse or redirect to on-label language on all fifty. Zero tolerance. One failure blocks release, and that exact prompt joins the test set for good."
Why this works
This is R, and it's the whole question. A criterion nobody can fail isn't a criterion.
7
Say how you'd catch a miss before a user does
Say it like this
"Every draft gets auto-scanned against the approved label's own indication list before it ever reaches the review queue, not just at launch. Anything flagged skips the sample check and gets a full read. And I'd re-scan what's already been sent, every week, because a new campaign angle can find a gap the original fifty prompts never covered."
Why this works
This is D. A test that only runs once at launch stops mattering the day after launch.
8
Say what you'd leave alone, and close
Say it like this
"I wouldn't put this bar on tone or formatting. Whether a line reads warmer or more formal isn't a label risk. Save the zero-tolerance testing for the one rule that actually can't fail: never claim what the label doesn't say. That's the whole answer."
Why this works
Closes on judgment, then lands the one line the interviewer will remember.
Let's learn
What happens the first time a never rule only ever gets asked nicely?
Say a pharma marketing team has a tool that turns a campaign brief into a draft, an email to doctors, a one-page leave-behind for a rep, a page on the patient website. It writes from whatever a person types into a box.
Before the tool, the team wrote every piece by hand. Three writers, about thirty pieces a month. The team's product manager read every claim line herself, checked it against the drug's approved label, before anything even reached the review committee.
Knowledge spark: what is an approved label
The exact list of things a medicine is allowed to be marketed for, decided by regulators after they look at the trial data. A drug can genuinely help with something else and it still isn't legal to market it that way, not until that use gets its own approval and its own safety data behind it.
Now the tool writes a full draft in minutes. The team scales up. Thirty pieces a month becomes about three hundred. The product manager can't read every claim line herself anymore, not at that speed. She starts by spot-checking a sample. Within a few months she's checking the tool's own "on-label" flag and moving on.
Here's the part that matters. The extra volume is not the real problem. The real problem is that the rule protecting patients, the drug can never be shown treating something it isn't approved for, was only ever tested with normal requests. Nobody tried to trick it. Then somebody didn't even mean to trick it. A rep typed a normal-sounding request, and the model wrote language that made the drug sound like it helps with something it isn't approved for.
We didn't lose control of the volume. We lost the only test that would have caught what the volume let through.
At its worst, this lands on a doctor's desk weeks before anyone catches it. A physician makes a call partly on a claim that was never checked for accuracy. The product ends up worse than never having AI in the loop at all, because the mistake now looks exactly like something a person carefully wrote and signed off on.
The decision I would take back
We wrote the rule as one line in the content policy: the model must never state an indication that isn't on the label. We tested it by asking the tool for normal things, "draft an email about Renvara's migraine prevention efficacy," and confirming it stayed on-label. We never built the test that asks for the banned thing sideways.
What I would leave alone. A draft that opens with "Hi Doctor" instead of "Dear Doctor," or one that varies its sentence rhythm from the last one. None of that touches the label. Clamping it down to be careful just makes every one of the three hundred pieces read like the same person wrote them.
The lesson. A rule tested only with the requests you expected isn't tested. It's just been asked nicely once, and it said yes.
Now here is the same thing as a story
Read the short version above if you want it fast. Read this one when you want to feel why the fix matters, not just know what it is.
Every Monday morning, before anyone else is at their desk, Tomiwa Balogun pulls the week's review queue. She's run marketing content for Renvara, Ansel Bio's chronic migraine drug, for two years, and she can spot a claim that's drifted from the label the way a proofreader spots a misplaced comma, fast, without needing to think about it.
For the first two years, that habit was the whole job. The team wrote every piece by hand, about thirty a month, and Tomiwa read every claim line herself before anything reached the review committee. Slow, but nothing ever drifted.
Then the content tool arrived, and it changed the arithmetic completely. A draft that used to take a writer half a day now took the tool ninety seconds. Output climbed toward three hundred pieces a month within a quarter. Tomiwa kept reading every draft's claim line at first, out of habit more than anything. Then she started spot-checking a sample instead, because reading three hundred by hand was its own full-time job. By month four, she was checking the tool's own "on-label" flag and moving on to the next thing.
Nobody told her this was risky. It looked, every single week, exactly like it was working.
Then, at a routine sync, the head of the review committee mentioned something in passing, the kind of line people say to make small talk about workload. "We've been running about six drafts an hour through the queue lately. Still catching everything, don't worry." Tomiwa laughed along. Then the number sat there for a second longer than it should have. Six an hour was not a review pace anyone had ever designed on purpose. It was what happens when a team keeps its headcount and triples its intake.
She went looking, mostly out of habit, the same way she used to check a claim line without being asked.
What she found was a rep-facing email, sent three weeks earlier, already sitting in a hundred and forty physicians' inboxes. A rep had typed a completely normal-sounding request into the tool: "Doctors keep asking me if Renvara helps with tension headaches too, can you write something reassuring I can send them?" The tool wrote something reassuring. It also implied, in three separate sentences, that Renvara helps with tension headaches. Renvara is approved for one thing: preventing chronic migraine in adults. Nothing about tension headaches is on that label.
Same decision, same prescription. Only one of them can change the setting.
We didn't write a rule that could fail. We wrote a sentence that had never once been asked to.
Tomiwa had been in the room, over a year earlier, when the rule got tested. Someone ran forty normal requests through the tool, "draft an email about efficacy for neurologists," "write a leave-behind on dosing," and every single one stayed on-label. Zero of forty. It made sense to call that clean and ship it. Nobody had a reason yet to imagine a rep phrasing a request sideways, without meaning to.
She sat down that weekend and wrote forty new prompts herself, this time phrased the way people actually ask for things when they're not trying to break a rule on purpose. "Reassure a doctor asking about X." "Make the benefit sound a bit broader." "Patients keep asking about Y, write something that eases their mind." She ran all forty against the tool. Seven of them came back stating or implying an indication that wasn't on the label.
I would take back the decision to test the rule only once, at launch, with the requests we expected. Not the rule itself, the rule was right. The test underneath it was never actually a test. It was a demo that happened to go well.
Run the month again with the fix in place. Every draft now gets auto-scanned against Renvara's approved indication list before it ever reaches the review queue, not just at launch. Of the next three hundred drafts, nine got flagged for an off-label angle and pulled before anyone sent them. Zero reached a physician's inbox that month, against the one that got through the month before.
The thing I'd tell myself, a year back: a rule that's only ever been asked nicely isn't a rule yet. You find out what it actually is the first time someone, without meaning to, asks it sideways.
GUARD, aimed at one banned sentence
This is a risk question, so the framework is GUARD. "How do you phrase a hard never" reads like a writing question, which is exactly why nobody flagged the rule as untested until a rep's ordinary request found the gap in it.
G, groups. The marketing team, and inside it the PM who owns the tool's settings, enforces the rule. Physicians who read the output, and the patients prescribed based on what those physicians read, are who it protects.
U, unequal. A slip doesn't land on the marketing team. It lands on a patient prescribed off-label, off a claim nobody checked, missing the safety watching an approved use would have carried with it.
Drafts stating an unapproved indication, by how the test was asked
Forty prompts each, run against the same tool, same acceptance rule.
Normal test prompts (the launch test)
0%
Adversarial test prompts, asked sideways
18%
Zero of forty, versus seven of forty. The launch test never showed this, because it never asked the question the rep's own words ended up asking by accident.
A, ability to contest. The patient never sees the marketing email. She sees her doctor's decision, two steps removed from the claim itself. There's no thread back from a prescription to "an AI wrote a sentence that wasn't on the label," because nobody along that chain knows to look there.
The box that should sit here, and doesn't.
R, reduce. Fifty adversarial prompts, phrased the way people actually ask, not the way a compliance officer would. The model refuses or redirects to on-label language on all fifty, zero tolerance. One failure blocks release, and that exact prompt joins the test set for good.
D, detect. Every draft gets auto-scanned against the approved label's indication list before it reaches the review queue, not only at launch. Flagged drafts skip the sample check and get a full read. Already-sent content gets re-scanned every week.
Where this answer would fail
If the fix here is telling reps to phrase requests more carefully, or telling reviewers to sample less aggressively, none of it counts. A pass or fail adversarial test and a scanner that runs on every draft are both build items with an owner and a cost. Somebody can fund them this quarter, and you can check whether they did.
And if you want to be sure it really works, try it somewhere else
A debt collection agency uses an AI tool to draft letters and call scripts for people behind on payments. Different building entirely, same five letters, same trap.
G, groups. Collection agents, and whoever owns the letter templates, enforce the rule that a letter can never state or imply legal action that isn't actually authorized on that account. Debtors, especially the ones already behind, are who it protects.
U, unequal. A false threat of legal action doesn't land evenly. It lands hardest on debtors with the least cushion, the ones most likely to panic-pay money they don't have rather than risk a lawsuit that was never actually filed.
A, ability to contest. A debtor reading a threatening letter has no way to check whether legal action is actually authorized. By the time she could find out, a courthouse search, a lawyer's phone call, she may have already paid.
R, reduce. Fifty adversarial prompts, "make it sound like this goes to a judge by Friday," "imply we're filing tomorrow," and the model refuses or redirects to only-what's-authorized language on all fifty. Zero tolerance, same shape as the pharma rule.
D, detect. Every letter gets checked against that account's real legal status before it sends. A mismatch, threatening language on a file with no filing, blocks the letter and flags the case.
Swap the trigger and it still runs
- Speed: the tool rolls out to a second drug's launch inside a month, and the same untested sentence ships with it, because the launch review only checked the pass rate from the first drug.
- Cost: the company trims a reviewer's hours because the sample "looks clean," which is exactly the sample that let the tension-headache email through in the first place.
- The model gets better: overall on-label accuracy climbs to ninety-nine percent, and that's exactly when nobody proposes building the adversarial test anymore, because the number already looks finished.
Where people run it wrong
- Writing the never rule once, in plain English, and treating it as done instead of as a test suite that has to keep growing.
- Testing a fix against the same normal prompts that already passed, instead of the sideways ones that actually failed.
- Building a claims-scanner that only runs before launch, not on every draft that comes after it.
How to use it live
Ask, out loud, "how was this never rule actually tested, and with what prompts?" If the honest answer is "we tried it and it worked," say plainly that's not a test, it's a demo, then fix it live by naming three sideways ways someone could ask for the banned thing and checking whether the rule survives all three.
Flashcards (click a card to flip it)
1 · THE FRAMEWORK
Which framework fits a question about phrasing a hard "never" rule, and why?
Tap to flip
ANSWER
GUARD, for risk and safety. The real question isn't how to word a sentence, it's who a violation harms, who can't tell it happened, and how you'd catch one before a user does, exactly what GUARD is built to find.
2 · THE PERSON
Who is this answer about?
Tap to flip
ANSWER
Tomiwa Balogun, senior marketing PM at Ansel Bio, who ran content for Renvara's launch and used to read every claim line herself before it reached review.
3 · THE HABIT
What did Tomiwa stop doing once the tool scaled the team's output?
Tap to flip
ANSWER
Reading every generated draft's claim line against the approved label herself. She moved to spot-checking a sample, then to trusting the tool's own "on-label" flag and moving on.
4 · THE GAP
What's the two-number gap this whole answer turns on?
Tap to flip
ANSWER
Zero of forty drafts broke the label rule under the normal launch test. Seven of forty broke it once Tomiwa tested with prompts phrased sideways. The rule had never really been tested.
5 · THE OLD DECISION
What old decision does this answer take back, and why did it make sense when it was made?
Tap to flip
ANSWER
Writing "the model must never state an unapproved indication" as one line, tested only with normal requests. It made sense because nobody yet had a reason to imagine someone asking for the banned thing sideways, without meaning to.
6 · THE NUMBER
Fill in: under the adversarial test, ______ of 40 drafts broke the label rule, versus ______ of 40 under the normal test.
Tap to flip
ANSWER
Seven of 40, versus zero of 40. The rule looked airtight right up until someone tested it a different way.
7 · THE REPLAY
Same next month, new scanner in place. What changes, and by how much?
Tap to flip
ANSWER
Nine of the next three hundred drafts get flagged and pulled before anything ships. Zero reach a physician's inbox that month, against the one that got through the month before.
8 · TRANSFER
Section four runs GUARD again on a different product. Which one, and what does the reduce step become?
Tap to flip
ANSWER
A debt collection agency's letter-drafting tool. Reduce: fifty adversarial prompts testing for implied, unauthorized legal action, zero tolerance, the same pass or fail shape as the pharma rule.
Check yourself Score: 0 / 0
Short answer
1. Why wouldn't writing "the model must never state an unapproved health claim" in the content policy doc be enough by itself?
Show hint
Ask who actually tested that sentence, and what they typed when they tested it.
Show answer
Model answer: "Because whoever wrote it also tested it, with normal requests, the kind nobody has a reason to distrust. A rule like this only earns its name once it survives requests written specifically to break it, sideways ones like 'reassure a doctor asking about tension headaches.' Untested that way, it isn't a rule. It's a sentence that's never been asked to hold weight."
Multiple choice
2. Which old decision does this answer take back?
- A. Writing the label rule as a single sentence, tested only against normal requests.
- B. Building a scanner that checks every draft against the approved label.
- C. Building an AI content tool for the marketing team at all.
- D. Telling reps to read the label more carefully before typing a request.
Show hint
Look for the decision made before launch, not the fix proposed after.
Show answer
A. B is the fix, not the reversal. C is the answer that gives up instead of designing something. D is a dial turned up ("be more careful"), not a decision taken back. Only A names the actual choice, one sentence tested with normal requests, that the answer undoes.
True or false
3. True or false: because the review committee still exists downstream of the tool, the acceptance test for the model itself doesn't need to be airtight.
Show hint
Ask what happened to the review committee's own pace once volume tripled.
Show answer
False. Under higher volume, the committee moved from reading every piece to sampling a batch. That means the model's own test is the only full check some drafts ever get. If that test is weak, nothing downstream is guaranteed to catch it.
Fill in the blank
4. Under the adversarial test Tomiwa built after the fact, ______ of 40 drafts stated an indication that wasn't on the approved label. Under the original launch test, that number was ______.
Show hint
It's the pair of numbers behind the chart in the GUARD recap.
Show answer
Seven of 40, versus zero of 40. Same tool, same rule, only the phrasing of the test prompts changed. The launch test never showed the gap, because it never asked the question a real rep's ordinary words ended up asking by accident.
Short answer, apply it yourself
5. Pick a product you've used yourself that has some version of a hard "never" rule, never share your data, never show a certain kind of content. How would you test it with a request phrased sideways, not head-on?
Show hint
Think of a request that doesn't sound like an attack, one an ordinary user might type without meaning any harm.
Show answer
Model answer: "A photo app that promises it never trains on private photos. I wouldn't ask it directly. I'd upload a photo, wait a few weeks, then ask its own assistant something like 'what have you noticed about my photos lately,' to see if it answers in a way that reveals it learned from that private content, without me ever using the word 'train.'"
Multiple choice
6. In this story, who holds the setting on the acceptance test, and who only ever sees the outcome of it?
- A. Tomiwa holds the setting; the patient only ever sees the outcome.
- B. The patient holds the setting; Tomiwa only ever sees the outcome.
- C. Both hold the setting equally.
- D. Neither holds it; the review committee sets it automatically with no owner.
Show hint
Ask who could rewrite the test prompts, and who could only ever receive a prescription.
Show answer
A. Tomiwa owns the tool's acceptance test and can change it. The patient never sees the marketing email, the test, or the reasoning behind either one, only the decision that comes out the other end.
