diff --git a/api/oss/src/core/workflows/dtos.py b/api/oss/src/core/workflows/dtos.py
index 0d8142f1c7..e59bbcc3ae 100644
--- a/api/oss/src/core/workflows/dtos.py
+++ b/api/oss/src/core/workflows/dtos.py
@@ -3,6 +3,7 @@
 
 from pydantic import (
     BaseModel,
+    ConfigDict,
     Field,
 )
 
@@ -54,9 +55,13 @@
     WorkflowServiceStreamResponse,  # noqa: F401
     #
     JsonSchemas,  # noqa: F401
-    WorkflowRevisionData,
+    WorkflowRevisionData as BaseWorkflowRevisionData,
 )
 
+
+class WorkflowRevisionData(BaseWorkflowRevisionData):
+    model_config = ConfigDict(extra="forbid")
+
 # aliases ----------------------------------------------------------------------
 
 
diff --git a/api/oss/tests/pytest/acceptance/applications/test_application_variants_and_revisions.py b/api/oss/tests/pytest/acceptance/applications/test_application_variants_and_revisions.py
index b3737b05fb..e52e9d83b0 100644
--- a/api/oss/tests/pytest/acceptance/applications/test_application_variants_and_revisions.py
+++ b/api/oss/tests/pytest/acceptance/applications/test_application_variants_and_revisions.py
@@ -177,6 +177,35 @@ def test_commit_application_revision_generates_slug_when_missing(self, authed_ap
             == body["application_revision"]["id"]
         )
 
+    def test_commit_application_revision_rejects_unknown_data_field(self, authed_api):
+        """Issue #4315: before fix unknown data was dropped silently; now 422 on ag_config."""
+        application, variant = _create_application_with_variant(
+            authed_api, marker=uuid4().hex[:8]
+        )
+
+        response = authed_api(
+            "POST",
+            "/applications/revisions/commit",
+            json={
+                "application_revision_commit": {
+                    "application_id": application["id"],
+                    "application_variant_id": variant["id"],
+                    "data": {
+                        "ag_config": {
+                            "prompt": {
+                                "messages": [
+                                    {"role": "system", "content": "hi"}
+                                ]
+                            }
+                        }
+                    },
+                }
+            },
+        )
+
+        assert response.status_code == 422
+        assert "ag_config" in str(response.json()["detail"])
+
     def test_query_applications_excludes_evaluators_by_default(self, authed_api):
         marker = uuid4().hex[:8]
         application, _variant = _create_application_with_variant(
diff --git a/sdks/python/agenta/sdk/models/workflows.py b/sdks/python/agenta/sdk/models/workflows.py
index 67dfc3ac21..086c4ece93 100644
--- a/sdks/python/agenta/sdk/models/workflows.py
+++ b/sdks/python/agenta/sdk/models/workflows.py
@@ -119,6 +119,8 @@ class WorkflowQueryFlags(BaseModel):
 
 
 class WorkflowRevisionData(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
     uri: Optional[str] = None
 
     url: Optional[str] = None