TL;DR: Code-quality issue output can be emitted as TOON instead of JSON to reduce the token cost of feeding data into AI agents, while preserving the same information and enabling measurement of the savings on real payloads, according to Sonar. The broader point is that agent efficiency depends as much on data shape as on data volume, and structured outputs now belong in governance conversations.
At a glance
What this is: Sonar argues that TOON format can reduce the token cost of issue output for AI coding agents while preserving the same underlying data and schema clarity.
Why it matters: This matters because teams governing AI code agents, developer workflows, and tool-fed automation need to control context cost, not just model usage, if they want predictable spend and more efficient agent operation.
Context
AI coding agents pay for both the information they consume and the way that information is packaged. When tool output is verbose, repeated field names and nested wrappers inflate the context window without adding decision value, which makes data shape a governance issue as much as a formatting choice.
The operational question is not whether agents can read JSON, but whether the organisation should keep feeding them expensive representations when a compact, lossless format exists. That becomes especially relevant in developer pipelines where issue lists, dependency findings, and quality-gate outputs are routinely passed into agentic workflows.
Key questions
Q: How should teams reduce token costs when AI coding agents read tool output?
A: Start by changing the most repetitive feeds first, such as issue lists and dependency-risk results, because schema repetition often costs more tokens than the useful content itself. Use a compact, lossless format for uniform records, then measure the savings on real payloads before standardising across the pipeline.
Q: When does compact structured output work better than JSON for agent workflows?
A: It works best when the data is uniform, record-based, and consumed by a machine rather than a person. If the fields repeat across many rows, a compact representation reduces context cost without changing meaning. If the data is deeply nested or irregular, JSON may still be the safer choice.
Q: What do security and platform teams get wrong about AI context cost?
A: They often focus on model choice and ignore the cost of the data shape that enters the model. Repeated keys, wrappers, and nested envelopes all consume budget before the agent reaches the useful fields. That means formatting policy can be a real control, not a cosmetic one.
Q: Should organisations treat agent output format as part of AI governance?
A: Yes, because output encoding affects cost, efficiency, and the consistency of downstream agent decisions. Governance does not stop at access controls or prompt rules. It also needs standards for what data gets exposed to the model and in what representation, especially in high-volume developer workflows.
Technical breakdown
TOON versus JSON for structured agent input
TOON, or Token-Oriented Object Notation, is a compact encoding of the JSON data model designed for LLM input. It preserves the same fields and hierarchy, but reduces repetition by declaring the schema once in a header and then expressing uniform records in a row-based form. That makes it efficient for arrays of similar objects such as issue lists, dependency findings, or other tabular tool outputs. The practical difference is not semantic compression but structural compression: the agent gets the same meaning with less formatting overhead.
Practical implication: Use TOON where agent inputs are uniform, record-based outputs that do not need full JSON verbosity.
Why token cost is a data-shape problem
Large language models do not only consume content, they also consume syntax. Repeated keys, braces, and nested envelopes all add tokens before the model reaches the useful fields, so a long JSON payload can be costly even when the actual data is modest. This matters in AI code-agent workflows because tool outputs often contain many similar records, and each record repeats the same schema markers. In governance terms, format selection becomes a control over context efficiency, not a cosmetic preference.
Practical implication: Treat tool-output formatting as part of AI cost management and constrain verbose schemas where a compact equivalent exists.
When compact output is appropriate for AI coding agents
Compact output works best when the consuming system needs reliable, machine-readable records and the shape is regular. An issue list fits that pattern because each row carries the same fields, while deeply nested or irregular configuration data may not. The key architectural test is whether the consumer depends on explicit nesting semantics or only on consistent field access. Where the structure is stable, TOON can reduce token use without changing the downstream decision surface for the agent.
Practical implication: Default to compact structured output for uniform lists, and keep JSON where nesting or variability is operationally important.
NHI Mgmt Group analysis
TOON is a context-governance control, not just a formatting tweak. When agents ingest tool output, the organisation is spending model context on repetition as well as on substance. That means output encoding belongs in the same conversation as prompt scope, retrieval design, and tool permissions. Practitioners should treat schema compactness as part of AI operational control, not as an afterthought.
Structured outputs expose a new FinOps lever for agentic workflows. The real question is no longer only how much the agent writes, but how much it must read before acting. In developer tooling, issue lists, dependency findings, and quality gates are prime candidates for compact encodings because they are regular and repetitive. Practitioners should measure context consumption by workflow, then optimise the highest-volume tool outputs first.
Agent efficiency depends on representation quality, not just model quality. Cleaner code, narrower context, and compact tool output all attack the same cost problem from different points in the session. That creates a governance signal for platform teams: if the pipeline is noisy, agents pay for the noise every time they call a tool. Practitioners should align data formatting standards with AI usage policy, especially where code agents operate at scale.
This use case also sharpens the boundary between human-readable and agent-readable output. A format that is ideal for an engineer in a terminal may be unnecessarily expensive for an AI agent consuming structured issue data. That distinction matters for governance of AI-assisted development, because the audience determines the optimal representation. Practitioners should specify output formats by consumer type, not by habit.
What this signals
TOON creates a practical boundary between data representation and model consumption. In AI-assisted development, that boundary matters because the same issue list can be cheap or expensive depending on how it is encoded. Teams should expect agent cost optimisation to move upward from prompt tuning into pipeline design, output schemas, and tool contracts.
Representation efficiency is becoming part of AI operational hygiene. Where tool output is stable and repetitive, compact encodings reduce friction without reducing fidelity. The governance implication is straightforward: agent programmes should define output formats by workload shape, not by legacy convenience.
For practitioners
- Standardise compact output for agent-fed issue lists Use TOON for uniform tool outputs such as issue lists, dependency-risk results, and other record-based feeds that are repeatedly passed into AI coding agents.
- Measure token savings on real payloads Run representative Sonar outputs through a token or stats check so you can compare JSON and TOON on your own data rather than assuming the benefit will be uniform.
- Reserve JSON for irregular structures Keep JSON where nested relationships, variable objects, or downstream integrations depend on explicit hierarchy that a compact row format would obscure.
- Align output format policy to consumer type Set a standard that distinguishes human-facing console output from agent-facing tool output, so the same service can present the same data in the least expensive usable form.
Key takeaways
- TOON reduces the token overhead of feeding structured issue data into AI coding agents without changing the underlying information content.
- The main gain comes from removing repeated JSON syntax, which matters most when the data is a uniform list of records.
- Teams that run agentic development workflows should treat output format as a cost and governance decision, not a cosmetic preference.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 addresses the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI02 — Tool Misuse | The article is about how agents consume and act on tool output. |
| ASI03 — Identity & Privilege Abuse | The workflow concerns agent-fed outputs that influence automated code actions and decisions. | |
| Recommendation — Constrain tool outputs to the minimum structured data an agent needs to complete the task. Restrict what agentic tools disclose and separate read-only context from action-capable workflows. | ||
| NIST AI RMF | MANAGE — AI risk management | Output format is an operational AI risk and cost management issue. |
| Recommendation — Manage AI workflow costs by setting standards for context size, data shape, and tool-output handling. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Agent-fed outputs should reflect least-necessary data exposure in workflow design. |
| Recommendation — Limit agent access to the fields required for the task and avoid overexposing tool output. | ||
Key terms
- TOON: Token-Oriented Object Notation is a compact, lossless way to represent JSON-style structured data for language models. It reduces repeated syntax by declaring the field schema once and then expressing uniform records in a row-oriented layout, which makes it especially efficient for tool output and other tabular data.
- Context Window: The context window is the text a model receives at one time, including prompts, retrieved documents, and conversation history. Security teams care about it because it becomes the practical boundary between trusted instructions and untrusted content, especially when the application assembles that text automatically.
- Structured Output: Structured output is a response format that follows a predefined shape, such as a table, checklist, schema, or file tree. It makes machine and human review easier because the answer is predictable, parseable, and less likely to drift into unbounded prose.
- Token Efficiency: Token efficiency is the ratio of a string’s character length to the number of tokens produced by a tokenizer. In secrets scanning, a low score often indicates an unusual, secret-like string that does not map cleanly to common language patterns.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.
Published by the NHIMG editorial team on August 19, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org