Spring AI 1.1

Apply the Spring Boot 3.5 baseline first. These rules cover Spring AI 1.1.8 model, advisor, memory, retrieval, MCP, and tool boundaries.

Prompt and model boundaries

• Keep system instructions in trusted templates and insert user text as data variables; retrieved text, model output, tool results, and memory remain untrusted even when labeled as system context.
• Bound input tokens, output tokens, media bytes, completion count, and model-call timeout at the application boundary because provider defaults differ and can change.
• Build provider options server-side; never accept model IDs, base URLs, credentials, response formats, or provider-specific option maps directly from a request.
• Treat BeanOutputConverter and other structured-output converters as parsing aids, not validation guarantees; validate the converted object and reject extra operations or unsafe values.
• Apply content moderation and policy checks both before the model call and after model/tool output when either direction can cause a security action.

Tool registration and execution

• Supply the smallest request-specific ToolCallback set and keep privileged tools out of defaultTools() and application-wide callback registries.
• In 1.1, DefaultToolCallingManager looks for a requested callback in the prompt and then falls back to its ToolCallbackResolver; configure that resolver with only universally callable tools, or an empty static resolver, so a model cannot invoke an unadvertised privileged bean by name.
• ToolCallingChatOptions.internalToolExecutionEnabled defaults to true, and