The boundary matters whenever model text becomes code, data, or a tool request. A request for JSON can still omit a required field, invent an identifier, choose an unauthorized action, or produce a valid structure with a wrong claim.
What should validate an LLM response?
Start with a schema and deterministic domain rules. Check types, required fields, value ranges, record ownership, permissions, and any source evidence the action requires. Validation belongs in application code that can reject the output, not only in prompt wording. Structured output makes the shape more reliable, but it does not establish truth.
What should happen when validation fails?
Retry a bounded structural error with precise feedback when a corrected response is safe to request. Stop and escalate policy, authorization, or factual failures. A validation retry must never turn a rejection into permission. Retries may repair structure, but they must not negotiate a policy or permission failure. Guardrails enforce policies around the agent loop, tool approval binds a person to a consequential action, and AI agent evals prove the boundary handles realistic failures before release.