Generation is not authorization
Structured output makes an LLM response easier to parse, but valid JSON is not a valid action. A proposal can still violate available funds, physical constraints, behavioral rules, or sequencing requirements.
The execution boundary should therefore sit after validation. The model proposes. A deterministic layer parses fields, checks constraints, and either accepts the action or returns a precise failure.
Repair the failed field, not the whole decision
A full regeneration can change fields that already passed and makes the trace harder to interpret. Targeted repair sends the failed rule and the relevant field back for correction, then reruns the complete validator set.
This approach does not guarantee correctness. It creates a reviewable chain: original proposal, failed rule, repair request, revised proposal, and final disposition.
Failure modes to design for
Validators need explicit handling for missing fields, unknown actions, unit mismatches, unaffordable costs, impossible transitions, repeated repair failure, timeout, and model unavailability. Failures should leave state unchanged.
Practical implication
The pattern applies beyond simulation. Any agent that schedules work, allocates resources, or changes records benefits from a proposal boundary and a small set of domain validators. Governance becomes observable behavior in the software, not a policy paragraph.