Pydantic AI 2.36

Apply the Pydantic 2.13 and Python 3 prompts first. These rules cover Pydantic AI 2.36 agents, dependencies, output types, tools, retries, model providers, durable execution, MCP, evaluation, and observability.

Agents and dependencies

• Construct agent instructions, models, tools, output types, and settings in trusted application code.
• Put authenticated identity, tenant, and service handles in typed dependencies rather than prompt text.
• Give dependencies the minimum credentials and operations required for the run.
• Keep user, retrieved, memory, and tool content separate from trusted system instructions.
• Pass UsageLimits on every run: only request_limit=50 is bounded by default, while tool-call, token, and cost limits default to None.
• Set count_tokens_before_request=True with per-request and cumulative input-token limits when oversized prompts must be rejected before they are sent and billed; this requires model support for token counting and cannot reserve future output tokens.
• Do not rely on cost_limit as a hard spending cap: when no cost is calculated it only emits CostNotFoundWarning, and response costs can exceed the limit before accounting stops the run.

Output validation

• Define a narrow Pydantic output type with forbidden extras, bounds, and closed variants.
• Validate StructuredDict results locally against the intended schema; the helper validates a string-keyed dictionary, not the supplied schema's field constraints.
• Use output validators for domain invariants and external verification, not just structural parsing.
• Treat