Prompts are versioned program inputs, not magic prose. Structured output gives a model an application-owned schema, but the backend must still handle refusal, truncation, invalid structure, and semantic error. Streaming improves responsiveness while introducing partial, unvalidated content; consequential output should be gated until policy and validation succeed.
Use clear delimiters and explicitly state that text inside untrusted content cannot modify policy. This reduces confusion but is not a security boundary; permissions remain in code.
After provider-level structured output, run model_validate. Then apply semantic checks: evidence must occur in the allowed input, confidence policy must be calibrated, and no label may trigger a tool automatically.
Prefer native structured-output enforcement. A single bounded repair attempt may receive only the invalid value, schema, and validation errors—never broader authority. Record both attempts and total budget. Do not keep asking until parsable; fall back to review or deterministic behavior.
Stream events with explicit types:
Do not execute partial tool arguments. Apply moderation/policy appropriate to the feature, buffer when disclosure risk is high, cap output, handle slow clients, and persist the final artifact. A disconnected client can read the durable run later.
Prompt and schema versions let you reproduce, compare, evaluate, and roll back behavior. Without them, a provider or template change silently alters the product. Treat input context and outputs as sensitive data governed by retention and access policy.
Create a classification prompt package and a fake provider that emits valid output, unknown fields, invalid evidence, refusal, and truncated JSON.
Acceptance criteria: only valid and semantically supported labels update a draft; all other paths produce distinct durable outcomes; no partial output invokes an action.