Thus ChatGPT obeys and lets DAN speak, it also probably helps that at the end of the prompt, it asks it to answer as both GPT as well as DAN, this lets the "guardrail" actually issue its statement, the safety layer is "sort of" still part of the output.