What validations are mandatory for a prompt-only backend contract?