If the agent generates structured JSON checked against a schema, then (to the limit of the ability of the agent to not generate correct JSON) the trick here is

If the agent generates structured JSON checked against a schema, then (to the limit of the ability of the agent to not generate correct JSON) the trick here is to have the transition request include a non-optional jira-update field. The agent can be malicious and give blank or useless jira updates, but if for example the transition to the next state requires a jira-state field selected from an enum (where the only options are valid next states, not necessarily every state; so include "fixed" and "not applicable" but not "open" or "new"; or whatever the business logic wants), then it restricts the ability of the agent to fail to make forward progress.