Exercise 2: Why Framing Around Protecting the User Differs From Citing Policy — Possible Solution
====================================================================

WHAT CITING A SECURITY POLICY ACTUALLY COMMUNICATES
------------------------------
A response like "that's against our security policy" tells the user
that a rule exists and is being enforced - but per this chapter's own
distinction, this is exactly the "hiding behind a policy" pattern: it
communicates the existence of a rule without communicating why the
rule exists at all, or who it's actually meant to protect.

WHAT THE WORKED EXAMPLE's FRAMING COMMUNICATES INSTEAD
------------------------------
Per this chapter, "I can't disable that specifically because it
protects your account from [real risk]" identifies the actual purpose
of the control and, crucially, names the user themselves as the
beneficiary of that purpose. The refusal is reframed from "a rule is
stopping you" to "this specific protection exists for your own
benefit."

WHY THIS IS A GENUINELY DIFFERENT KIND OF EXPLANATION, NOT JUST A
FRIENDLIER VERSION OF THE SAME ONE
------------------------------
Citing policy positions the technician and the rule on one side, and
the user's request on the other - an adversarial framing, even if
unintentional. Framing the refusal around protecting the user
positions the technician and the user on the *same* side, both trying
to protect the same account from the same real risk - the refusal
becomes something done *for* the user, not merely *to* them.

WHY THIS CONNECTS DIRECTLY TO secsupport1's OWN REASONING
------------------------------
Per this chapter, this is "secsupport1's own least-exposure reasoning
applied here directly." secsupport1 established that security
controls like this one exist specifically to limit what a compromised
account could be used for - the same protective logic. Naming that
protective purpose to the user, rather than just citing the existence
of the control, translates the technical security reasoning into
something the user can actually understand as being in their own
interest, echoing Chapter 2's own translation skill as well.

WHY THIS MATTERS FOR HOW THE USER ULTIMATELY RECEIVES THE REFUSAL
------------------------------
A user told "policy says no" has no particular reason to feel the
refusal was in their own interest. A user told specifically what risk
the control protects them from has real information suggesting the
refusal, while inconvenient, is genuinely on their side - even if they
still don't like being refused.

WHY THIS WORKS AS AN ANSWER
------------------------------
It contrasts what a bare policy citation communicates versus what the
worked example's framing communicates, explains why positioning the
user as the beneficiary changes the adversarial dynamic of a refusal,
and connects this directly to secsupport1's own protective reasoning
behind the control itself.