The decoder constrains which next tokens can form an allowed output. Depending on the backend and supported schema, it can exclude syntax that cannot lead to valid JSON, restrict keys or formats, and avoid a later parse and repair cycle. vLLM documents structured outputs for JSON schemas and grammars. That is a useful wire-format guarantee within the supported feature set. It cannot infer that account A-17 belongs to the current user, that a $500 refund is permitted, or that the source document actually said $50. A grammar describes a language of strings. Authorization and factual correctness describe relationships to a live world.

I would keep four checks separate. First, decode under a small, versioned schema with only needed fields. Second, parse and validate the result in the application anyway, because client and engine versions can differ and constraints may support only a subset of a schema. Third, resolve identifiers against trusted records and canonicalize the action. Fourth, have the tool broker check current user authority, aggregate limits, destination, approval, and operation identity just before effect. The request that passes policy is the exact canonical request that gets executed. Structured decoding helps step one. It cannot replace steps two through four.

There is another subtle failure: a schema can make the model choose an allowed field even when it should say “I don't know.” If the only valid output has a required account ID, a low confidence guess still fits the grammar. Let the workflow represent abstention or a request for clarification. For high risk actions, validate the source evidence that produced an ID and show the proposed action to the user at an approval gate. Do not treat a zero syntax error rate as a zero wrong-action rate.

What about performance? Token masks and grammar preparation consume resources, and the cost varies by backend, schema complexity, batching, and whether the grammar is cached. A constrained output may shorten retry loops even if each decode is slightly slower. Measure end-to-end valid and authorized task completions, first token latency, per-token gaps, schema compilation time, and batch throughput for the actual mix. Test enums, nested alternatives, long strings, refusals, schema upgrades, and an adversarial but syntactically valid argument. The result to celebrate is fewer broken tasks, not merely cleaner braces.