Structured output is enforced when the application requests it

AI models that are prompted to return JSON do not guarantee valid, correctly-shaped JSON on every response. Without validation via Zod, JSON Schema, or SDK-level structured output, a malformed or schema-violating AI response will either throw an unhandled exception at JSON.parse() or silently corrupt downstream logic — writing unexpected data to a database, crashing a rendering component, or causing a downstream API call to fail. OWASP LLM09 (Misinformation) covers the class of failures where AI output is consumed uncritically. CWE-20 (Improper Input Validation) applies directly: structured AI output is external input and must be treated as such.

Use SDK-level schema enforcement or Zod validation before consuming structured AI output. The preferred path is generateObject from the Vercel AI SDK:

const { object } = await generateObject({
  model: openai('gpt-4o'),
  schema: z.object({ summary: z.string(), tags: z.array(z.string()) }),
  prompt: userMessage
})

If using raw JSON.parse, always wrap in safeParse and handle the failure branch explicitly before writing to a database or passing to a renderer.