A valid JSON tool call contains an invalid business value

Illustrative lab: an assistant proposes a quantity of minus two. This is a learning case, not a reported customer incident.

Observable symptoms

Parsing succeeds, but executing the request would create an invalid order.

Likely cause

The application validates JSON syntax but omits semantic and authorization checks.

Diagnosis steps

1. Inspect the parsed parameters without exposing sensitive input.
2. Check permitted ranges and types.
3. Verify that access to the referenced resource is authorized independently.

Example

function validateQuantity(input) {
  if (!Number.isInteger(input.quantity) || input.quantity < 1 || input.quantity > 100)
    return {ok:false, error:'quantity must be an integer from 1 to 100'};
  return {ok:true};
}
console.log(JSON.stringify(validateQuantity({quantity:-2})));
console.log(JSON.stringify(validateQuantity({quantity:3})));

Expected result

{"ok":false,"error":"quantity must be an integer from 1 to 100"}
{"ok":true}

Code walkthrough

• Number.isInteger rejects fractional quantities and numeric-looking strings.
• The range rule rejects negative, zero and excessive values.
• The demonstration returns a typed decision without invoking an external service.

Solution and boundaries

Validate against a server-owned contract before tool execution. Keep business validation separate from permissions and approval; all three may be required. Do not let the model redefine valid limits.

Prevention and monitoring

Test malformed, boundary and unauthorized tool requests and keep execution behind the same validation layer.

Interview question

What is the difference between schema validity and permission to act?

Official reference · Related technical guide