Deterministic AI Agents: Architecture for Tool Calling Without Hallucinations

Most failures in commercial AI agent projects stem from a foundational misconception: treating Large Language Models as autonomous reasoning brains capable of making reliable decisions through conversational prose.

When an LLM is expected to decide business outcomes using natural language instructions, it inevitably hallucinates, forgets negative constraints under context pressure, and produces subtle schema drift that crashes backend pipelines.

In enterprise software, LLMs must be treated strictly as probabilistic semantic routers. The intelligence layer extracts user intent and maps it into typed arguments; execution and persistence must remain 100% deterministic code.

Here is the exact production architecture I use to build zero-hallucination agentic systems.

1. The Core Principle: LLM as a Semantic Router

User Input / Webhook
        │
        ▼
┌────────────────────────┐
│  LLM (Semantic Router)  │ ──> Emits structured tool call + typed arguments
└────────────────────────┘
        │
        ▼ (Intercepted BEFORE execution)
┌────────────────────────┐
│   Zod Schema Validator │ ──> Rejects invalid types before hitting backend
└────────────────────────┘
        │
        ▼ (If valid)
┌────────────────────────┐
│  Deterministic Engine  │ ──> Executes transactional APIs with rollbacks
└────────────────────────┘

The language model never writes directly to your database, and it never sends an external HTTP request on its own. It is restricted to selecting a tool from an allowed schema and populating typed JSON arguments.

2. Defining Strict Tool Schemas with Zod & JSON Schema

Every tool exposed to the model must declare an inviolable input schema with strict typing and closed enums:

import { z } from 'zod';

export const ProcessInvoiceToolSchema = z.object({
  invoiceNumber: z.string().regex(/^INV-\d{4}-\d{5}$/, 'Invalid invoice formatting'),
  vendorTaxId: z.string().min(8).max(15),
  totalAmountCents: z.number().int().positive(),
  currency: z.enum(['USD', 'EUR', 'PEN']),
  lineItems: z.array(
    z.object({
      description: z.string().min(3),
      unitPriceCents: z.number().int().positive(),
      quantity: z.number().int().positive(),
    })
  ).nonempty(),
  action: z.enum(['APPROVE', 'FLAG_FOR_AUDIT', 'REJECT']),
});

export type ProcessInvoiceInput = z.infer<typeof ProcessInvoiceToolSchema>;

Convert this schema into the standard tool definition consumed by models like Gemini 3.7 Flash or Claude:

export const ProcessInvoiceToolDefinition = {
  name: 'process_invoice',
  description: 'Validates and settles an incoming vendor invoice against internal ERP purchase orders.',
  parameters: zodToJsonSchema(ProcessInvoiceToolSchema),
};

3. Runtime Interception & Self-Correction Loops

If the model produces a malformed payload or violates a schema constraint, do not crash the pipeline. Intercept the error at the boundary and feed the deterministic validation feedback back to the model for a single self-correction turn:

export async function executeToolWithGuardrails(
  toolName: string,
  rawArgs: unknown,
  executor: (args: ProcessInvoiceInput) => Promise<ToolResult>
): Promise<ToolResult> {
  const parseResult = ProcessInvoiceToolSchema.safeParse(rawArgs);

  if (!parseResult.success) {
    // Format error deterministically for model re-prompt
    const errorDetails = parseResult.error.issues
      .map(i => `${i.path.join('.')}: ${i.message}`)
      .join('; ');

    return {
      status: 'VALIDATION_FAILED',
      errorMessage: `Schema validation rejected payload: ${errorDetails}. Re-extract strictly conforming to the parameter specification.`,
    };
  }

  // Execute purely deterministic business logic
  try {
    return await executor(parseResult.data);
  } catch (error) {
    return {
      status: 'EXECUTION_ERROR',
      errorMessage: error instanceof Error ? error.message : 'Unknown execution failure',
    };
  }
}

4. Idempotency and Compensating Transactions

In automated agent pipelines, networks fail and LLM requests may be re-dispatched. Every tool execution must be idempotent:

1. Idempotency Keys: Every tool execution calculates an SHA-256 fingerprint from the payload and session ID:

   const idempotencyKey = crypto
     .createHash('sha256')
     .update(`${sessionId}:${toolName}:${JSON.stringify(parseResult.data)}`)
     .digest('hex');

2. Two-Phase Commit: Before triggering external side-effects (e.g., calling Stripe, ERP, or sending emails), write an audit record with STATUS = PENDING.
3. Compensation Action: If an API call downstream fails, trigger the tool’s registered rollback function (e.g., voiding a created draft or canceling a reservation).

5. Production Case: Autonomous AI Agent & Workflow Engine

I implemented this exact architecture in the Autonomous AI Agent & Workflow Engine, orchestrating multi-step business triage across external ERPs, email webhooks, and Cloudflare Tunnels:

• 99.8% Schema Adherence: Strict Zod parsing eliminated malformed database inserts across hundreds of daily transactions.
• Zero Hallucination Incidents: Because external actions run deterministically with typed parameters, the model could not invent fictitious records or corrupt balances.
• 80% Triage Acceleration: Routine document classifications and ERP entries execute in under 3 seconds without manual human data entry.

Key Takeaway

Do not ask LLMs to perform business operations; ask them to extract facts into strict schemas, and let deterministic software do the rest.