Structured Output Validation Is Not Authorization

Markdown library not available. Raw content:

Every major AI provider now supports structured outputs. Anthropic tool use, OpenAI function calling, Mistral tool JSON, Google Gemini function declarations — they all return agent decisions as typed, schema-constrained data. In the past 18 months, Pydantic validators, Zod schemas, and JSON Schema definitions have become standard fixtures in agent codebases.

This is a genuine improvement. It eliminated a category of parsing errors. It made agent outputs predictable.

It also created a systematic confusion that is showing up in compliance audits.

## What schema validation actually checks

When you define a Pydantic model like this:

```python
class AgentAction(BaseModel):
    action: Literal["read", "write", "delete", "transfer"]
    target_resource: str
    amount: Optional[float] = None
    destination: Optional[str] = None
```

And your agent returns a validated instance of this model, the validation tells you:

- `action` is one of the four permitted string values
- `target_resource` is a string
- `amount`, if present, is a float
- `destination`, if present, is a string

That is all it tells you. It says nothing about:

- Whether this agent is authorized to perform `delete` on `target_resource`
- Whether `amount=50000.0` with `destination="external-account-id"` is within the agent's operational scope
- Whether the combination of `action=transfer` and `destination` is permitted in the current session context
- Whether the acting agent's identity has been verified against anything

Schema validation is a type check. Authorization is a policy check. These are orthogonal operations. The tooling ecosystem treats them as if they are the same thing, and that conflation is the problem.

## How this creates an exploitable gap

Consider a customer support agent with tool access to a billing system. Its MCP server exposes a `process_refund` tool. The tool schema requires:

```json
{
  "customer_id": "string",
  "amount": "number",
  "reason": "string"
}
```

The agent's s