A safety filter's real cost isn't just what it takes to run — it's what happens when it blocks the wrong people.

This explores whether a guardrail's real price is just what it costs to run, or also what it costs when it wrongly blocks legitimate requests, and who ends up paying. The corpus has no note that measures false refusal rates head-on. But several notes come at the question from the side, and together they suggest the running cost is the small part.

The running cost is small. Mechanical checks like parse validation and planted test cases need only arithmetic and string operations, and they cost orders of magnitude less than an LLM judge How much do deterministic guardrails actually cost to run?. So compute is rarely what limits you. The cost moves to whoever gets wrongly blocked. A note on decoys (fake objects meant to trap attackers) makes this concrete. The more convincingly a decoy mimics a genuine object, the smaller the gap between how often trusted agents can legitimately use things and how often they trip a false alarm. That is a formal bound, and the protected side pays for it What cost does making decoys convincing impose on legitimate users?. This is a different setting from chatbot refusals, but the shape carries over: tightening detection costs legitimate users, and it isn't free.

That cost is also not spread evenly. GPT-3.5 refuses at different rates for younger, female, and Asian-American personas. It also sycophantically declines to engage with political positions the user would likely disagree with Do AI guardrails refuse differently based on who is asking?. A single average false refusal rate hides this, because the burden lands on particular groups. A high refusal rate also isn't evidence of caution. Models with shallow political representations refuse charged content because they lack the internal concepts to engage with it, not because ethics training told them to Does high refusal rate indicate ethical caution or shallow understanding?. Some of the safety a guardrail seems to deliver is really just failed help.

The obvious fix for false refusals is to fall back to a default when the check is unsure, and that moves the cost somewhere worse. A parsing check that substitutes a default score for a detected failure produces a valid-looking candidate, and a downstream optimizer can then rank it and pass it along. The failure path, not the check, decides whether the guardrail works Does a default fallback defeat a safety check?. Counting also misleads. A zero on the violation counter can mean silent stopping, escalation, refusal, or never terminating, and each of those leaves the operator in a very different position What behaviors hide behind a zero crossing rate?. A refusal that prevents nothing bad and blocks something legitimate looks the same as a clean pass on that dashboard.

The corpus stops short of a number. One paper designs a comparison of monitoring setups at equal review cost and equal false-alert workload, which is the right way to price this, but the excerpt reports no results Does added monitoring improve protection at acceptable cost?. What the notes support is a rule of thumb: price a guardrail as compute plus the false-block burden on legitimate users, and ask who carries that burden.