Structured outputs and bounded tools

What you will be able to do

1. Validate structured outputs independently of the model.
2. Implement typed read-only tool interfaces.
3. Reject unauthorized or malformed tool arguments.

Prerequisites: dictionaries, loops, functions, exceptions and installed Python or paper tracing. Reuse earlier Builder artifacts only when the task requires them.

This curriculum runs self-study on VetsLearn. Where the text calls for an instructor, peer or formal review, use the stated acceptance criteria for self-review. Reflection questions support reflection; they do not replace independent assessment. A peer review is optional unless your actual organization requires it.

Part 1 Technical instruction

A model proposes; application code disposes. JSON or function syntax is not proof that the result is valid. The application validates required fields, types, enumerations, ranges, identifiers, and cross-field rules. Tool exposure begins with a narrow allowlist and read-only behavior. The authorization decision uses the authenticated principal and server-side policy, never a role asserted in prompt text. Validate tool arguments before execution and validate tool results before returning them to the model. Errors should be explicit and should not broaden permissions.

Mechanism and implementation

Schema checks shape, semantic rules check meaning, and authorization checks who may act. Perform all before dispatch. Confidence is not evidence. Exact tools expose bounded operations and IDs, not arbitrary code or shell text. Extra arguments must be rejected rather than forwarded.

Constructed offline example

Save as topic_example.py and run python topic_example.py with an installed Python 3.11+ interpreter. This standard-library construction uses synthetic values; its checks are not provider measurements.

def valid(args):
    if set(args) != {"category", "confidence"}:
        return False
    score = args["confidence"]
    return args["category"] in {"draft", "review"} and type(score) in {int, float} and 0 <= score <= 1
assert valid({"category": "review", "confidence": 0.8})
assert not valid({"category": "review", "confidence": True})
assert not valid({"category": "review", "confidence": 8})
assert not valid({"category": "review", "confidence": 0.8, "role": "admin"})
print("semantic guards passed")

Engineering decisions

• Define the schema and semantic rules before prompting.
• Choose the smallest tool surface that completes the task.
• Fail closed when identity, authorization, or validation is indeterminate.

Worked example

A classifier may return category and confidence and may query two synthetic lookup tools. Attempts to request an unlisted tool, use an unknown identifier, or set confidence above 1.0 are rejected before any execution.

Diagnose the failure

Invalid fields never reach execution. An absent source fails even if output follows JSON Schema. Repair the evidence/ownership lookup; lowering temperature is not a truth control.

Part 2 Guided practice

Explain why bool is rejected despite being an int subclass. Add source IDs and verify claim support. Independently submit a schema-valid claim citing an absent source.

Answer criteria and feedback: Invalid fields never reach execution. An absent source fails even if output follows JSON Schema. Repair the evidence/ownership lookup; lowering temperature is not a truth control.

Continue with the downloadable pack below. If the pack or interpreter is unavailable, trace this self-contained example by hand in an input/expected-status/controlling-rule table and label execution unverified. Do not invent passing output. No account, credential, paid call, purchase or actual deployment is required.

Part 3 Remediation

Reduce the object to one field at a time. Validate structure, then business rules, then authorization. Keep each error distinct so the learner can diagnose the failed boundary. After repair, reassess with the alternate scenario in scenario_alt.json. A critical authorization, data-handling, evidence-integrity, or prohibited-action failure cannot be averaged into successful practice; it requires targeted remediation.

Part 4 Sources and currency

• https://json-schema.org/specification
• https://genai.owasp.org/

Use the workflow decision reference for model/deployment/harness distinctions and controlled comparisons. Source currency must be checked before each cohort. Provider/product behavior is illustrative where mocked; resolve current interfaces only from official documentation in an authorized environment.