A model’s output is text. When an application turns that text into an action, the application, not the model, is responsible for what happens. The model may produce malformed JSON, call a tool that does not exist, pass a number that is out of range, or follow instructions it found in a document.
You will decide which checks a guard needs, write the validator that applies the schema, and execute calls against a safety policy that remembers the robot’s state.