Agent Output Validation
What must be checked before generated content becomes an action?
Reference notes by Min · Reviewed October 15, 2026
Definition
Agent output validation checks generated data at the boundary where another component will interpret, display or execute it. A well-formed answer still needs checks for allowed values, permitted operations and appropriate handling in its destination.
An agent can produce content that is fluent, correctly formatted and still dangerous to consume. The boundary matters because the next component supplies capabilities: a string becomes a database expression, a rendered page, a destination URL or a payment instruction. Validate against that component’s contract.
What it covers
- Structure
- Require expected types, fields and size limits.
- Meaning
- Check identifiers, amounts, units, ranges and business rules.
- Authority
- Verify that this actor and task may perform the proposed operation.
- Destination
- Handle data safely for HTML, database, file or command contexts.
Separate structural acceptance from business acceptance. A positive decimal may pass a schema while using the wrong currency or exceeding the caller’s authority. Design error responses so the agent can correct ordinary mistakes without receiving credentials, internal queries or other unnecessary details.
In practice
Practical design patterns by Min.
- Prefer a small typed operation over an unrestricted command string.
- Resolve resource identifiers against authorized records before performing writes.
- Reject unsupported fields and ambiguous units instead of guessing their meaning.
- Bind the final operation to the approved values and check the committed result.
For an operation with side effects, define an accepted input object and a server-owned execution path. Keep the operation name and resource scope outside free-form text where possible. Record rejection categories so recurring interpretation problems can be corrected in the tool design rather than hidden by repeated retries.
Research notes
Source-grounded details and editorial applications. Follow each link for the original document.
Output handling is a downstream security concern
OWASP LLM05:2025 describes risks when model outputs reach other components without suitable validation and handling. Its mitigations include context-appropriate encoding and parameterized database operations.
Approval must refer to the transaction that runs
OWASP’s transaction guidance calls for server-side enforcement and protection of significant transaction data against modification. Here that principle is applied to an agent’s generated proposal and the eventual committed action.
Working example
A model proposes an invoice adjustment
The generated object contains an invoice identifier, an amount and a currency.
- Validate required fields and numerical representation.
- Check the invoice belongs to the permitted account and that the currency matches the record.
- Require approval for the actual adjustment, then submit through a constrained service operation.
Why the controls matter
The invoice example can fail even if every character is valid. A model might select a real invoice belonging to a different customer. The resource and permission checks catch that error before the accounting service updates the balance, while an outcome check catches a failed or uncertain submission.
Common pitfalls
- Equating valid JSON with a safe business operation.
- Using one generic sanitizer for unrelated output contexts.
- Letting an agent repair a rejected operation by bypassing the validation service.
A second model can help review a proposal, but agreement between models is not proof of permission or correctness. Test the boundary with unauthorized identifiers, changed approved values and excessive payloads. Keep those cases distinct from tests of whether the model explains the invoice accurately.
Questions for operational review
Use these questions to decide what evidence your team needs. They are editorial prompts, not a compliance checklist.
- Which generated fields become executable or externally visible?
- Can a syntactically valid request still target an unauthorized record?
- Does the executed operation match the values a reviewer approved?
Articles linking here
References
Primary documents reviewed for this entry. Examples and implementation patterns are editorial synthesis.
- OWASP LLM05:2025: Improper Output Handling ↗Accessed October 15, 2026
- OWASP: Transaction Authorization Cheat Sheet ↗Accessed October 15, 2026