Why It Matters

OpenAI strict mode works best when every declared property is actually covered by required. Otherwise the schema says the contract is strict while still leaving declared keys optional in ways that can surprise tool callers.

What Triggers

SEC317 applies to OpenAI-style strict tool schemas and triggers when declared properties are not all represented in the required list.

Example that triggers:

[
  {
    "type": "function",
    "function": {
      "name": "weather",
      "strict": true,
      "parameters": {
        "type": "object",
        "properties": {
          "city": { "type": "string" },
          "units": { "type": "string" }
        },
        "required": ["city"],
        "additionalProperties": false
      }
    }
  }
]

False Positives

This is a deterministic structural comparison between declared properties and the required set for strict schemas.

Remediation

Include every declared property in required when strict mode is enabled.