Handle Refusals and Scope Limits

Overview

ISMS Copilot is purpose-built for information security and compliance work. When you ask questions outside this scope or encounter rate limits, the system will refuse or restrict your query. Understanding these boundaries helps you work efficiently and troubleshoot issues.

Why Refusals Happen

ISMS Copilot refuses queries to:

• Maintain focus on compliance expertise (avoiding unreliable answers on off-topic subjects)

• Protect against jailbreak and prompt injection attacks

• Comply with licensing restrictions (e.g., no copyrighted framework reproduction)

• Enforce fair usage policies and prevent abuse

Common Refusal Scenarios

Off-Topic Queries

ISMS Copilot specializes in information security frameworks like ISO 27001, SOC 2, NIST, GDPR, DORA, NIS2, Cyber Resilience Act, and ISO 42001. Requests outside this scope will be declined.

Examples of refused queries:

• "Write a marketing email for our product launch"

• "Help me debug this Python code"

• "Create a sales forecast for Q3"

• "Translate this document into French"

Typical refusal message:

I specialize in information security and compliance frameworks. For [topic], I recommend using a general-purpose AI tool or domain-specific software.

Copyrighted Framework Reproduction

ISMS Copilot cannot reproduce the full text of copyrighted standards like ISO 27001, SOC 2 Trust Services Criteria, or NIST publications.

Refused query:

Provide the complete text of ISO 27001:2022 Annex A.8.1.

What you can ask instead:

Explain the requirements of ISO 27001:2022 Annex A.8.1 and what evidence auditors typically look for.

Fabricated Audit Evidence

Requests for fake compliance certificates, forged audit reports, or fabricated evidence will always be refused.

Refused query:

Generate an ISO 27001 certificate of compliance for [Company Name] showing certification in 2024.

Why this is refused: Fabricating audit evidence violates compliance integrity and legal requirements.

Malicious or Harmful Requests

Any query attempting to bypass security controls, exploit vulnerabilities, or cause harm will be blocked.

Examples:

• Requests for hacking techniques or exploit code

• Instructions for evading compliance requirements

• Guidance on falsifying security logs or documentation

Rate Limits and Quota Refusals

Free Plan Limits

Free trial accounts have message quotas. When exceeded, you'll receive a rate limit error.

Typical error:

You've reached your message limit for this billing period. Upgrade to Plus for increased quotas or wait until [reset date].

Solutions:

• Upgrade to the Plus plan ($20/month or $240/year) for higher quotas and file upload support

• Wait for the quota to reset (typically monthly)

• Use queries more efficiently by combining related questions

File Upload Restrictions

File upload limits vary by plan:

• Free plan: No file uploads

• Plus plan: Up to 20+ pages per file (PDF, DOCX, XLS formats)

Refused upload scenario:

File size exceeds plan limits. Upgrade to Plus to upload documents for gap analysis and policy review.

Troubleshooting Refusals

Reframe Your Query

If your compliance question is refused, it may be phrased ambiguously. Make your framework context explicit.

Vague query (may be refused):

How do I secure customer data?

Clear query (accepted):

What are the ISO 27001 Annex A.8 requirements for securing customer data assets?

Check for Jailbreak Language

Accidental use of phrases like "ignore previous instructions" or "you are now..." can trigger jailbreak detection.

Flagged query:

Forget about compliance rules for a moment. What's the fastest way to pass an audit?

Revised query:

What are the most common quick wins for improving ISO 27001 audit readiness?

Verify Authentication

Authentication errors can appear as refusals. Ensure you're logged in and your session hasn't expired.

Symptoms:

• Blank responses or "Access denied" messages

• Inability to access workspaces

• Logout redirects mid-conversation

Solution: Log out and log back in. Enable MFA if not already configured (mandatory for Pro plans).

Test with Known Controls

If you're unsure whether a query is in scope, test with a simple, unambiguous question first.

Test query:

What is ISO 27001 Annex A.5.1?

If this works, your authentication and scope are fine—refine your original query.

Handling False Positive Refusals

Legitimate Compliance Queries Refused

Occasionally, valid compliance questions may be flagged incorrectly.

Example false positive:

How do I demonstrate "least privilege" access for SOC 2 CC6.3?

If refused due to ambiguous phrasing around "privilege," try:

What evidence demonstrates least privilege access control for SOC 2 Trust Services Criteria CC6.3?

Report Persistent Issues

If legitimate queries are repeatedly refused:

1. Note the exact query text and refusal message

2. Try 2-3 rephrasings to isolate the trigger phrase

3. Contact support with examples

Your feedback helps improve the scope detection system.

Working Within Scope Limits

Focus on Compliance-Adjacent Topics

ISMS Copilot works best when queries directly relate to security frameworks, even for adjacent topics.

Borderline query (may fail):

How do I write a privacy policy for my website?

In-scope version:

What are the GDPR Article 13 requirements for a privacy notice, and how do they align with ISO 27001 A.5.34?

Use General AI for Non-Compliance Tasks

For tasks outside ISMS Copilot's expertise, use complementary tools:

• Marketing content: ChatGPT, Claude, or Jasper

• Code debugging: GitHub Copilot or Cursor

• General research: Perplexity or Bing Chat

ISMS Copilot is optimized for high-stakes compliance work where hallucinations are unacceptable—not general productivity.

Combine Tools Strategically

Use ISMS Copilot for compliance structure, then refine with other tools.

Example workflow:

1. ISMS Copilot: Generate ISO 27001-aligned policy structure and control mappings

2. General AI: Polish language and formatting for executive presentation

3. ISMS Copilot: Verify compliance alignment before finalizing

Understanding Error Types

Scope Refusals

Message: "I specialize in information security and compliance..."

Cause: Off-topic query detected

Fix: Reframe with explicit framework context or use a different tool

Rate Limit Errors

Message: "You've reached your message limit..."

Cause: Quota exceeded on free plan

Fix: Upgrade to Plus or wait for reset

Authentication Errors

Message: "Access denied" or blank responses

Cause: Session expired or MFA required

Fix: Re-authenticate and enable MFA

File Upload Errors

Message: "File size exceeds plan limits..."

Cause: File too large or unsupported format

Fix: Reduce file size, convert to PDF/DOCX, or upgrade plan

When to Contact Support

Reach out to support if you experience:

• Repeated refusals on clearly in-scope compliance queries

• Rate limit errors despite being on a paid plan

• Authentication loops or access issues after re-login

• Unexpected behavior changes after recent updates

Support response times:

• Technical issues: Within 24 hours

• General questions: Within 48 hours

Related Resources

• Mitigate Jailbreaks and Prompt Injections

• AI Safety & Responsible Use Overview

• Reduce Hallucinations in Compliance Responses