Grammar definition & enforcement

Supported preview format

The first design targets a bounded JSON Schema subset. The example uses object properties, required fields, primitive types and size limits. Arbitrary executable validators, remote reference loading, recursive schemas and EBNF are not enabled by this preview. Future formats need explicit certification.

Define a response grammar

This contract requires a summary and boolean approval. It rejects additional fields. Grammar definitions are configuration written by an authorized administrator, not rules supplied by untrusted model output.

json

{
  "version": "2026-10-19-preview",
  "name": "Review result",
  "format": "json_schema",
  "target": "response",
  "definition": {
    "type": "object",
    "additionalProperties": false,
    "properties": {
      "summary": {
        "type": "string",
        "maxLength": 2000
      },
      "approved": {
        "type": "boolean"
      }
    },
    "required": [
      "summary",
      "approved"
    ]
  },
  "max_bytes": 8192,
  "max_depth": 4,
  "on_invalid": "block"
}

Valid and invalid output

The first object matches the grammar. The second fails because approved must be a boolean and extra fields are forbidden. Validation errors identify the path and rule without echoing confidential content.

json

{"summary":"The example is well structured.","approved":true}

// Invalid example
{"summary":"Reviewed","approved":"yes","execute_shell":"..."}

Enforcement and repair

Validate request envelopes, tool arguments and model responses under separate target grammars. Bound bytes, nesting, deadlines and any repair attempts. Repairs consume inference budget. Invalid results block or enter an explicit hold; validation failure never disables the rule.

Buffered and streaming delivery

Buffered mode validates the entire protected unit before release. Streaming requires certified incremental validators and clear release units. Whole-response semantic or grammar checks can require buffering. Bytes already delivered cannot be recalled, and stopping a later stream does not undo earlier disclosure.