Output Caging Lab: Constrained Decoding for AI Agents

It is a way of making a language model produce only outputs that fit a grammar or schema. At each step the runtime masks the tokens that would break the rules, so the result parses. The Outlines paper describes guiding generation with regular expressions and context-free grammars, and the llama.cpp guide describes GBNF grammars used to force valid JSON. It is a statement about structure, not about whether the content is right.

No. It limits which strings and shapes can be produced, so it can remove some channels, such as link or markdown syntax in a field that forbids those characters. It cannot tell that a well-formed recipient address is the wrong one, or that a legal tool choice is the wrong choice. OWASP LLM01 says it is unclear whether fool-proof prevention exists and recommends layered mitigations, including defined and validated output formats.

Not exactly. OpenAI describes JSON mode as guaranteeing valid JSON and Structured Outputs as also guaranteeing adherence to a supplied JSON Schema. Its guide adds that Structured Outputs can still contain mistakes, that a safety refusal does not necessarily follow the schema, and that the supported schema subset has limits. Other engines, such as llama.cpp with GBNF, offer grammars with their own features.

Anything that is valid under the rules. A syntactically correct field can carry sensitive data to an outside address, a plain-language instruction aimed at the reader, or a harmful value in the right type. A valid tool name can still be the wrong tool. Semantic abuse needs controls outside the model: policy checks in code, identifiers the server resolves, allow-lists, safe rendering and human approval for high-impact actions.

Because the output is displayed somewhere. OWASP LLM05 advises encoding model output for its context and using strict Content Security Policies, and warns about Markdown and JavaScript. A console that auto-fetches images or follows links from model text turns a harmless-looking string into an outbound request. Constrain the output, then render it as inert text.

Yes. Validate in code against the same schema and against business rules, and treat refusals, empty or cut-off replies as failed steps. OWASP LLM05 advises treating the model like any other user and validating what it returns before it reaches backend functions.

Each of the 12 decisions scores 0 to 10 and the result is your share of the maximum, with a short band that says what the score means. The debrief shows the source behind each rationale. Lines labelled PlayCISO practice are our reasoning, not a statement by a source.