Default-deny by shape

Last reviewed: July 2026.

Fuaran's decoder refuses anything malformed rather than guessing at it. Undeclared keys are rejected, not ignored. Unknown cases in a closed vocabulary are errors, not fallbacks. Every refusal is a typed error with a stable code and a path – and the spec pins the order in which failures are reported, so every conformant host surfaces the same first error for the same bad input.

That sounds austere. It is the single most practical design decision in the language, for two reasons.

It is the quality mechanism for AI emission

When a language model emits UI, the interesting question is not "does it usually get it right?" but "what happens when it doesn't?" With a lenient decoder, a wrong emission renders as something – subtly broken, silently missing fields, wrong but plausible. Nobody notices until a user does.

With a strict decoder, a wrong emission is a refusal carrying the exact code, path and message – machine-readable feedback the model can act on. The reference agent loop feeds these refusals straight back: emit → refused with MISSING_FIELD at $.kind.source → look up the kind's schema → re-emit correctly. Model-quality differences stop being subtle degradation and become visible, countable events. (This is also why weaker models are a poor fit for Fuaran emission: the gate converts their error rate into repair-loop cost you can see, rather than broken UI you can't.)

It is the safety mechanism for everything else

The same strictness gates what an interface is allowed to do. Actions, bindings, and state writes are closed, typed vocabularies – there is no "eval", no arbitrary handler smuggled through a string, no undeclared side channel. An emitted tree can only request what the shape admits, and a host can inspect exactly what that is before rendering, because the artefact is data. The whole class of "the model injected something the schema never sanctioned" fails at decode time, with a code, uniformly across hosts.

This page is the design argument. The security page is the audit view of the same ground: each claim against the public artefact that backs it, which host enforces which property today, and what the host still owns.

The trade, honestly

Strictness costs friendliness. Hand-authoring wire JSON against a default-deny decoder is unforgiving, which is why the ecosystem pairs it with typed authoring surfaces in each host language, schema lookup for models, and deterministic error ordering so tooling can rely on refusals. Leniency exists in exactly one sanctioned place – a small set of documented input shorthands that every host must normalise identically to canonical form, proven by the conformance corpus. Convenience at the edge, one truth underneath.