Can static JSON schemas secure non-deterministic AI agent reasoning?

David D. Geer — Mon, 10 Aug 2026 20:13:13 +0000

I would love feedback from the technical community on scope enforcement and impact boundaries when building production agent workflows.

Decoupling LLM Reasoning from Tool Execution to Block Indirect Prompt Injection

Indirect prompt injection allows attackers to context-hijack autonomous AI agents. Because hijacked tool calls look completely legitimate at the API and firewall level, non-deterministic evaluation (using an LLM to monitor another LLM) fails to enforce strict security boundaries.

To address this vulnerability, I published a paper modeling a deterministic Intent Architecture. By placing a static JSON policy schema layer between agent reasoning and tool execution, proposed actions are validated against explicit policy boundaries before execution can occur.

Live Sandbox & Code Repository

Interactive Colab Sandbox: Open in Google Colab
GitHub Repository: ai-agent-intent-architecture on GitHub
Full Research Paper: Read the full paper on HackerNoon

Core Implementation Overview

The architecture intercepts proposed agent actions and validates them against a static policy_schema.json file prior to execution:


python
import json
import jsonschema

# Load static policy schema
with open("policy_schema.json", "r") as f:
    policy_schema = json.load(f)

def validate_agent_intent(intent_payload):
    """Intercepts a proposed agent action and validates it against static policy schema rules."""
    try:
        jsonschema.validate(instance=intent_payload, schema=policy_schema)
        return True, "ACTION ALLOWED: Intent satisfies static policy schema."
    except jsonschema.exceptions.ValidationError as err:
        return False, f"ACTION BLOCKED: Policy violation -> {err.message}"

DEV Community: David D. Geer

Can static JSON schemas secure non-deterministic AI agent reasoning?

Decoupling LLM Reasoning from Tool Execution to Block Indirect Prompt Injection

Live Sandbox & Code Repository

Core Implementation Overview