The first article in this series made a pair of claims. One: an AI-native product is an MCP server that lets an agent do things, not a chat widget that talks about them. Two: every write an agent can invoke needs idempotency and typed, recoverable errors, because agents retry and fan out by default.

Both took typed schemas for granted. Of course you validate your inputs — zod on the way in, reject the malformed call. That's table stakes. This article is about the failure mode that survives input validation: misuse.

An agent almost never sends you malformed JSON. It sends you well-formed wrong. The payload passes every schema check and still does the wrong thing, because a language model is a probabilistic caller reasoning from your tool descriptions, not a developer who read your docs. Typing the inputs stops garbage. It does nothing about a valid call that shouldn't have been made. Designing against that is a different job.

Four ways a well-typed call still goes wrong

Watch a model drive a real tool catalog and the same four failures recur: