This is the wrong question. The correct question is what specific subsets of cases do you allow, similar to any security question