Parse and validate
Reject malformed JSON, missing required fields, wrong types, invalid enums, additional properties, and values outside domain constraints.
valid = parse ∧ schema ∧ domain
82%valid calls
4%unsafe execution
0.6expected retries
validatedcurrent status
Separate proposal from permission and execution.
Authorize
A structurally valid call may still exceed the user’s permission. Bind credentials and approvals to tool, target, scope, and expiry.
may_execute = valid ∧ authorized
Verify outcome
Execution responses are not durable truth. Check the postcondition using operation identity and domain-specific state.
done = result ∧ postcondition
Treat repair as a new bounded proposal.
Validation errors should be machine-readable
Return exact paths, expected types, and allowed values. Avoid dumping secrets or full backend errors into the model context.
Retries must preserve identity
Use idempotency keys for side-effecting tools. A repaired argument set is a new proposal; a transport retry of the same call keeps the same identity.
High-impact tools need stronger contracts
Payments, deletions, external messages, and permission changes deserve narrower schemas, explicit confirmation, amount or target limits, and stronger receipts.
Contract questions
Does JSON Schema guarantee a safe tool call?
No. It guarantees structural constraints you express. Business rules, authorization, current state, and postconditions remain separate checks.
Should unknown fields be accepted?
Usually reject additional properties for high-impact tools. Silent acceptance can hide hallucinated arguments or forward-compatibility mistakes.
When should repair stop?
Stop when the retry budget is exhausted, the same validation error repeats, permission is missing, or the action requires human judgment.
Primary sources
JSON Schema 2020-12 Core defines the validation vocabulary. RFC 8259 defines JSON. RFC 9110 covers HTTP method semantics and idempotency. Toolformer studies language models learning to use external tools.