The Alice and Globex example makes the intersection picture concrete. Each set added can only shrink what a call may do, and a check in code the model cannot reach is a boundary, not a suggestion buried in a prompt.