Abstract
Research question
How can an application accept useful model-proposed parameters without weakening trusted resource and execution boundaries?
Context
Strict validation can make conversational actions brittle, but permissive execution can turn model interpretation into authority. The useful middle is explicit provenance plus a confirmation contract.
Proposed approach
- Parse natural-language values into a typed proposal.
- Treat configurable business validation as warn or block policy.
- Always block untrusted hidden or system-owned resource identifiers.
- Require application execution to repeat final authorization.
Implementation
- Configurable confirmation validation mode
- Parameter provenance in action results
- A live synthetic subscription-resolution workflow
Observations
- 01
Warnings preserve useful user intent while keeping uncertainty visible at confirmation.
- 02
Trusted identifiers require a stronger rule because the user cannot safely validate hidden targets.
- 03
Confirmation is a workflow state, not an LLM call.
Limitations
This work reports an implementation-linked investigation. It is not a
peer-reviewed paper, certification or customer case study.
- The demo does not connect to a real billing provider.
- High-risk financial or irreversible actions need additional policy controls.
Reproduce or inspect
Revision note and next questions
Last revised 2026-07-25 against AI Fabric 0.4.0 and the linked public artifacts.
- How should policy services contribute signed validation evidence?
- Which actions require dual control or delayed execution?
