Tool Calling

The model does not execute anything. It emits a structured request naming a tool and its arguments; the application validates and runs it, and feeds the result back. That separation is the entire security boundary, and treating it as one is what distinguishes a safe integration from an unsafe one.

Design guidance that consistently improves reliability: few, well-named tools rather than many overlapping ones; descriptions written for the model as the reader, since they are effectively the prompt; narrow parameters — get_order_status(order_id) rather than run_query(sql) — because the arguments will eventually be attacker-influenced; and results that are compact, since every tool result consumes context.

Every tool needs its own authorisation, its own input validation and its own audit entry. The model must be assumed to be able to call any tool with any arguments, because with indirect prompt injection, it can be made to.