# Tool calling

A model-mediated interface in which the system selects a named function and proposes structured arguments for software to validate and execute.

technical-term · Harness & runtime · maturing · Reviewed 2026-08-09

## Definition

Tool calling lets a model request information or action through declared interfaces. The request remains a proposal until trusted software validates identity, standing, policy, arguments, limits, approvals, and expected effects before execution.

Tool-call interfaces are widely available; authorization, semantic safety, and cross-tool composition remain active risk areas.

## Why it matters

Tools convert language output into environmental effects.

The security boundary belongs at the executor and policy enforcement point, not in a tool description or model instruction alone.

## System anatomy

- **Tool contract:** A narrow name, purpose, typed input, and typed result.
- **Policy check:** An external allow, deny, hold, or escalation decision.
- **Executor:** Code that performs the validated operation.
- **Evidence:** Recorded request, decision, effect, and result.



## Important distinctions

- **Authority:** The ability to form a tool call does not grant permission to execute it.
- **Model Context Protocol:** Tool calling is an interaction pattern; MCP is one protocol for exposing capabilities.



## Implementation signals

- Use narrow schemas and least privilege
- Validate arguments and postconditions outside the model
- Make high-impact tools reversible or approval-gated

## Failure modes

- A broad shell or database tool with borrowed credentials
- Tool output injected back as trusted instructions



## Related knowledge

- [AI agent](https://aisdlc.ai/agentic-engineering/ai-agent) — A goal-directed software system in which a model dynamically chooses steps and tools, observes results, updates working state, and continues until an exit condition or human handoff.
- [Tools, skills & protocols](https://aisdlc.ai/agentic-engineering/tools-and-protocols) — The action and knowledge interfaces through which agents use tools, load procedural skills, access enterprise context, and collaborate with other agents.
- [Runtime policy enforcement](https://aisdlc.ai/agentic-engineering/runtime-policy-enforcement) — The pre-action decision and enforcement layer that evaluates identity, purpose, risk tier, tool, resource, data class, limits, approval state, and current evidence before allowing an agent action.
- [Model Context Protocol](https://aisdlc.ai/agentic-engineering/model-context-protocol) — An open protocol for connecting AI applications to servers that expose context, tools, prompts, and related capabilities.

## Sources and further study

- [OpenAI — A practical guide to building agents](https://openai.com/business/guides-and-resources/a-practical-guide-to-building-ai-agents/) — Defines a practical agent around a model, tools, instructions, and a run loop that continues until an exit condition is reached. **Use:** Primary definition. **Limitation:** The guide is first-party product guidance and a simplified starting architecture, not a complete regulated-enterprise control model.
- [Model Context Protocol — Model Context Protocol architecture overview](https://modelcontextprotocol.io/docs/2026-07-28/learn/architecture) — Documents the host, client, server, capability-negotiation, and message layers used to connect AI applications with context and tools. **Use:** Standard or protocol. **Limitation:** Protocol connectivity and capability discovery do not confer business authority, validate tool output, or make a server trustworthy.
- [OWASP GenAI Security Project — OWASP Top 10 for Agentic Applications 2026](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/) — A threat-oriented reference for goal hijacking, tool misuse, identity abuse, memory poisoning, and cascading agent failures. **Use:** Official guidance. **Limitation:** Guidance describes recommended practice; citation does not prove that a control is implemented or effective in a particular environment.

---

This library synthesizes cited research, standards, official documentation, and clearly attributed practitioner perspectives. Maturity describes the state of a concept—not vendor endorsement, production readiness, or permission to deploy. Benchmarks and demonstrations do not replace use-case evaluation, governed controls, independent verification, or named human release authority.