Pydantic AI 2.40

Apply the Pydantic 2.13 prompt first. These rules cover Pydantic AI 2.40 agents, capabilities, tools, MCP, message history, structured output, cost controls, realtime sessions, and observability.

Agent, model, and provider boundaries

• Select the Model, provider, model identifier, profile, API base URL, credential, and HTTP client from trusted configuration; never pass a request-controlled provider:model string to model inference.
• Construct provider credentials explicitly for production and keep them out of prompts, dependencies visible to tools, model settings, history, events, errors, and telemetry.
• Leave defer_model_check=False to check provider configuration when a named model is resolved during construction; explicitly check per-run or capability-resolved models at startup before accepting traffic.
• Allowlist run-time model and model_settings overrides. An Agent.override() or per-run setting must not let an untrusted caller change providers, weaken timeouts, expand token limits, or enable a preview capability.
• Treat FallbackModel candidates as separate data recipients. Approve every candidate for the workload's data class, configure each candidate independently, and do not fall back after authentication, authorization, content-filter, or other policy failures.
• Do not trust a model profile as authorization or a hard service guarantee. Test required tool, output, context-window, and realtime features against the exact provider deployment, and treat an unknown context window as unknown rather than unlimited.
• Load Agent.from_file()