The training
Refusal is learned, not configured.
A language model is fine-tuned on examples of what to answer and what to decline. After that, declining is part of the weights themselves, in the same way that grammar is. Nothing is looking up a rule at the moment you hit send.
Changing this layer means retraining the model, or running one that was trained differently — which is what open-weight models make possible, and why a service running its own model can differ from one renting an API. It is also why a service can call itself uncensored and still refuse things: no setting reaches this far down.
The system prompt
Standing instructions you never see.
Before your first message, the provider puts its own instructions in front of the conversation: who the character is, what it should never discuss, how it should answer when it does refuse.
This is the cheapest layer to loosen — it is text, not training — and the only one a service can change without touching the model at all. It is also the least reliable, because it competes with the training underneath it. When a service behaves differently from one day to the next, this is the layer that can move that fast.
A separate classifier
A second model reading over the first one’s shoulder.
Many services run a smaller, separate model that reads your message, the reply, or both, and scores it. Above a threshold, the message is blocked, softened or replaced with a canned line.
Because it sits outside the chat model, it can stop output the chat model was perfectly willing to produce. That is the difference you feel when a conversation cuts off mid-sentence rather than the character declining in its own words.
Review after the fact
Nothing is blocked; something is recorded.
The last layer does not stop a message at all. Conversations may be logged, sampled, reported by other users, or reviewed by staff, and the consequence arrives later: a warning, a suspension, a closed account.
This is the layer people most often forget, and the only one where what happens to the text matters more than what the model said. It is also the one worth asking about before you type anything you would not want kept.
