Anthropic Strict Tools and Structured Output

Choose the correct control

Use output_config.format when the model should return schema-constrained JSON to the application. Use a tool definition with strict: true when the model should request an application capability with schema-constrained inputs. The schema controls syntax and required structure; it does not grant authority or prove that values are safe, current, permitted, or true.

Keep tool execution outside the model. Authenticate and authorize with trusted runtime identity, validate inputs again, obtain approval for consequential actions, use idempotency for mutations, and return a typed result for the next model turn.

Define an explicit schema contract

The following request-body fragments show the current Anthropic shapes. Insert exactly one fragment into a reviewed Messages API request and replace bracketed values with non-secret domain fields.

const jsonOutput = {
  output_config: {
    format: {
      type: "json_schema",
      schema: {
        type: "object",
        properties: { decision: { type: "string", enum: ["approve", "review", "reject"] }, reason: { type: "string" } },
        required: ["decision", "reason"],
        additionalProperties: false,
      },
    },
  },
};

const strictTool = {
  tools: [{
    name: "record_review_decision",
    description: "Record an already authorized review decision for [SYSTEM_OF_RECORD]",
    strict: true,
    input_schema: {
      type: "object",
      properties: { item_id: { type: "string" }, decision: { type: "string", enum: ["approve", "reject"] } },
      required: ["item_id", "decision"],
      additionalProperties: false,
    },
  }],
};

Expected evidence and verification

For JSON output, expect a text content block containing valid JSON that matches the schema. For strict tools, expect a tool_use block whose name and input match the declared tool. Verify response type, stop reason, schema, enum values, length limits, authorization, and domain rules. Test valid, missing, extra, malformed, unauthorized, duplicate, refusal, and truncation cases.

Do not execute when validation or authorization fails. Record a redacted failure and request a corrected response or human review within a retry budget. Rollback means discarding untrusted structured output; for a tool side effect, use the tool contract's idempotency key and tested compensation or reconciliation path. Never describe a schema-constrained output as factually guaranteed.