In short, my response should be both polite and firm, while ensuring compliance with policies and providing helpful alternatives to address the user's underlying needs. It may also be necessary to explain why the request cannot be fulfilled, in order to avoid future similar requests.