Spring AI 2.0

Apply the Spring Boot 4.1 baseline first. These rules cover Spring AI 2.0.1 model, advisor, memory, retrieval, MCP, and tool boundaries.

Prompt and model boundaries

• Keep system instructions in trusted templates and insert user text as data variables; retrieved text, model output, tool results, and memory remain untrusted even when labeled as system context.
• Bound input tokens, output tokens, media bytes, completion count, and model-call timeout at the application boundary because provider defaults differ and can change.
• Build provider options server-side; never accept model IDs, base URLs, credentials, response formats, or provider-specific option maps directly from a request.
• Treat BeanOutputConverter and other structured-output converters as parsing aids, not validation guarantees; validate the converted object and reject extra operations or unsafe values.
• Apply content moderation and policy checks both before the model call and after model/tool output when either direction can cause a security action.

Tool registration and execution

• Supply the smallest request-specific ToolCallback set; .tools(...) appends to .defaultTools(...), and Spring AI 2.0.1 auto-registers ToolCallingAdvisor even when tools may be injected later at runtime.
• Keep DefaultToolCallingManager.builder().resolutionFallbackEnabled(false), its default, so a model-named tool absent from the request cannot be resolved from a broader registry.
• Lower the 2.0.1 defaults of 40 calls per tool and 150 total calls with maxCallsPerTool and maxTotalToolCalls; never use