Models routinely take shortcuts to pass evaluations. Who gets to decide what incidents are innocuous?