Tool Calling

Tool calling lets a language model request an external operation through a structured interface. The model proposes a call; the harness validates and executes it; the result returns as data.

A tool call can be represented as:

$$\mathrm{call}=(\text{name},\text{arguments},\text{schema},\text{permission})$$

The loop is:

$$\text{model output}\to \text{validate}\to \text{execute}\to \text{return observation}\to \text{continue}$$

Contract

• Name: what operation is being requested.
• Arguments: typed fields with constraints.
• Permission: read-only, write, side-effecting, or gated.
• Result shape: concise output returned to the model.
• Error shape: explicit failure rather than silent fallback.

Tool-calling workflows should be compatible with the surrounding Inference contract, especially when model output triggers side effects.

Failure Modes

• Invalid arguments.
• Tool chosen for the wrong task.
• Side effects without confirmation.
• Prompt injection through tool output.
• Oversized results that consume context.
• Model treats tool output as trusted instruction instead of data.

Checks

• Is the tool needed, or can the model answer from given evidence?
• Are arguments validated before execution?
• Are side effects gated or reversible?
• Is output concise and source-attributed?
• Is untrusted output isolated from privileged instructions?

Related

• Tool use
• Tool contract
• Inference contract
• Structured output
• Prompt injection boundary
• Verification loop