Tool Use

Tool use is the capability that lets a model act rather than just describe. You supply a set of functions with names, descriptions and parameter schemas; the model decides when one is needed and emits a structured call; your code runs it and returns the result; the model incorporates it and continues.

The model never executes anything itself. It only requests, and your code decides whether to comply — which is the whole security boundary. Everything about what an AI system is permitted to do is enforced at that step, not inside the model.

Tool descriptions matter more than people expect. The model chooses based on the text you write, so a vague description produces a tool that is called at the wrong times or not at all.

Tool use is the dividing line between a chatbot and an agent, and it is where AI stops being advisory and starts having consequences. It's also the point where prompt injection becomes dangerous rather than embarrassing, because injected instructions can now trigger real actions.

Grant the narrowest tools that do the job — a read-only query function rather than raw database access. Log every call. And treat the tool layer as your security perimeter, because it is the only one there is.