Pydantic converts external data into typed application-owned values or returns explicit validation errors. It is most valuable at trust boundaries: HTTP requests, configuration, queue messages, and AI structured outputs. Validation proves structural conformance; it does not prove authorization, factual correctness, or permission to execute an action.
Create src/supportdesk_ai/api/schemas/tickets.py:
Verify both acceptance and rejection:
Use TicketCreate.model_json_schema() to inspect the machine-readable contract.
Pydantic can prove that organization_id is shaped like a UUID. It cannot prove the authenticated user belongs to that organization. It can prove a model returned confidence=0.91; it cannot prove the classification is correct. Authorization, database constraints, and evaluation remain separate controls.
Ask capable providers for structured output derived from an application-owned JSON Schema, then validate the returned object again. Handle refusal, truncation, unsupported schema features, and invalid output explicitly. Never use a validator to execute a tool or write to a database: validation should remain deterministic and side-effect free.
Create TicketClassification with an enum label, confidence from 0 to 1, a short rationale, and a list of evidence identifiers. Forbid extra fields.
Acceptance criteria: tests reject confidence 1.2, an unsupported label, missing evidence, and an extra execute_refund field.