Make a Form's schema authoritative with Strict mode
Strict mode is off by default, so the schema guides generation instead of policing answers. Turn it on per Form and an undeclared field becomes a refusal, with File fields authoritative either way.
Strict mode is a switch on one Form, and it is off when the Form is created. Off is not an oversight: most Forms start there, because a Form that has never received a Submission does not yet know its own shape. What the switch changes is who the schema is for.
What changes when you turn it on
With Strict mode off, the schema guides generation. It decides which fields the builder previews and what the Generated component renders, and it is what FormFlow learns against when it offers to adopt a field it has seen arrive. It does not police the answers. An extra key is not a breach: it arrives as an answer.
With Strict mode on, the schema becomes the contract in both directions. A declared field that does not arrive, or does not satisfy its rules, is refused. An undeclared key that does arrive is refused too — same gate, same field-keyed error, with a message saying the field was not declared. That symmetry is the whole point: a Strict Form cannot quietly accumulate answers it never asked for. Strict mode shipped with v1.0.0, and the API reference describes the refusal it returns.
Field rules come from a closed vocabulary
Strict mode is also the only mode in which Field rules are enforced. A Field rule is an extra constraint on one field, beyond what its type already implies, and it is chosen from a list FormFlow ships and scopes to that type. You pick from the list; you never write a rule. A Form cannot ask FormFlow to run a check FormFlow did not write.
Field type | Rules you can choose | Bounds |
|---|---|---|
Text | Letters only; Letters and numbers; Letters, numbers, dashes and underscores; Plain ASCII; Lowercase; Uppercase; A UUID; A ULID; An IP address; A MAC address; A hex colour | min and max length |
Textarea | Plain ASCII; Valid JSON | min and max length |
Number | A whole number | min and max value |
Email, Phone | none | min and max length |
Select, Radio | none | none |
Two things about that table. A bound is a whole number, up to six digits. And an option-list type takes no rules at all: its list of options already is the constraint, and Strict mode judges each answer against it.
Where Strict mode is not yours to choose
A declared File field is authoritative on every Form, Strict or not. It is judged for type, size and count every time, and it hard-rejects. That is deliberate: an upload is bytes on disk, so it cannot be left to a setting that defaults to off. The other exception is a Graded Form — a Form with an Answer key is always in Strict mode and can only be a Hosted page, because Embedded markup cannot fairly expose or grade it.
Decide with evidence, not nerves
Before you switch it on, replay the candidate configuration against the Form's own history. FormFlow keeps both the Submissions a Form accepted and the Refused submissions it turned away, so the replay can show what the change would cost before anyone pays it. That is the reason Strict mode can be turned on late, after a Form already has traffic.
The other reason to be calm: a refusal is not an invisible loss. A refused Submission is kept as a record you can act on, is not delivered, does not become a Counted Submission, and can be recovered once the setting is fixed. Strict mode raises the stakes of getting the schema right; it does not make a mistake permanent.
Limits worth knowing
Off by default. If you cannot remember switching it on, it is off.
It judges answers only. The Origin allowlist and the shape of the request are judged on every Form, Strict or not.
Declared File fields are judged either way, so a Strict-mode test that passes without an upload proves nothing about the file.
Field rules apply in Strict mode alone. Moving a Form out of Strict mode silently stops enforcing every rule you chose for it.
A Graded Form cannot leave Strict mode and cannot be embedded, so plan its schema before it takes its first Submission.