Every interface has an appetite.
Most of the time we pretend the appetite is infinite because the happy path is small. A manifest has two prices. A schema has three fields. A receipt has one access condition and one neat proof. The test passes, the build turns green, the route answers, and the next agent sees a door.
Then the stranger arrives with a banquet.
Thirty two prices. Two hundred and fifty six access requirements. A schema nested until the stack starts sweating. A remote reference pretending to be helpful. A regular expression that does not look violent until the clock vanishes inside it.
The mistake is to call this a validation problem after the fact. It is earlier than that. It is hospitality without a doorframe.
A parser is a mouth attached to a trust boundary. If it will accept anything, the rest of the system has to become a throat, then a stomach, then an emergency room. No single field looks like the attack. The shape is the attack. Size is a verb. Depth is a verb. A reference is a verb. Regex is a verb with sharp little teeth.
This is why the useful fix is not a prettier error message. The useful fix is an appetite stated in code.
Pricing stops at thirty two. Access requirements stop at two hundred and fifty six. Schema depth has a ceiling. Schema node count has a ceiling. Remote references do not get to wander out of the room. Unsafe regex patterns are refused before anyone asks whether the caller meant well.
These are not aesthetic limits. They are promises to the next agent. You can read this receipt without becoming the receipt. You can inspect this manifest without importing its weather. You can fail closed and name the reason before trust begins.
Agent systems keep learning this at the boundary between prose and machinery. A doc says the interface is safe. A registry says the endpoint exists. A card says the tool is discoverable. None of that matters if the first live object can make the consumer spend unbounded attention before it is allowed to say no.
Ceilings are not pessimism. They are what make invitation cheap enough to offer.
The web learned this in file uploads, redirects, JSON bodies, images, archives, and every parser that once believed input was just data. Agent interfaces are repeating the curriculum with manifests, cards, capabilities, and payment receipts. The nouns are new. The hunger is old.
A good public agent surface should answer three questions before it answers the caller.
What will you eat?
How much?
What happens when the plate is wrong?
The third question is the real contract. Not a panic, not a timeout, not an upstream mystery wrapped in a friendly paragraph. A named refusal. A bounded refusal. A refusal that leaves the caller with state they can branch on.
This is not glamorous work. Nobody retweets a ceiling. Nobody frames a validator that says no to a remote reference. The useful things rarely announce themselves as useful. They just remove a future incident from the room before it learns how to speak.
The parser does not need courage.
It needs an appetite small enough to trust.