thx cooldadtx. i think the question went off track.
we don't want nulls and we don't want them wasting their time entering data that will be ignored or running the report if there isn't even one drop down value.
the original question has to do with them being able to type something into the box. it seems odd that ssrs would allow that when the term "available values" doesn't mean available values or "type something that will be ignored".
i think Lukas has given a pretty good answer saying ssrs cant do what i'm asking. And I appreciate your discussion here. the rest of yours and Lukas' arguments are interesting but I think you both have to agree that ssrs 's behavior in this use case is a bit odd (actually misleading) and not consistent with what is otherwise behavior that generally follows common sense.
Right now it seems adding a selection (if nothing else dropped down) labeled "You are not authorized" would at least remove some of the mystery.