The structured-output boundary

Turn uncertain generation into a typed proposal the application can reject safely.

DIRECT ANSWER

A structured-output boundary defines the allowed fields, sizes, enums, null behavior, evidence links, and error state. The server validates every response and never repairs a dangerous field silently.

SYSTEM FLOW

Make every boundary visible.

01prompt
02generate
03decode
04validate
05reject
06record
07consume

DESIGN DECISIONS

Three decisions carry the architecture.

Version the schema

Record which prompt, model configuration, and schema produced every accepted result.

Fail closed

Do not coerce unknown enums, truncate security fields, or invent missing evidence to keep the flow moving.

Constrain the consumer

Downstream code reads the validated object only and cannot fall back to raw model text.

FAILURE MODES

What breaks the boundary.

The parser accepts extra fields with hidden instructions
A retry changes an accepted decision without a new record
The UI renders raw output when validation fails

VERIFICATION

Evidence before release.

Fuzzed-output test
Unknown-enum test
Oversized-field test
Raw-output isolation test