Keep model planning separate from application actions.
1. Tool declarations
Describe an operation with a narrow name, argument schema and purpose. Prefer a read-only lookup before an action that changes state. The model suggests a call; your executor decides whether it is permitted.
2. Argument and identity checks
Validate arguments and derive identity from the authenticated session. Never trust a model-supplied user ID for authorization. Apply ownership checks again at the data service.
3. Tool result loop
Return a bounded result to the model and limit call count and runtime. Handle unknown tools and repeated calls. Require confirmation for consequential actions and use idempotency keys for writes.
Worked scenario
A model asks to save the same itinerary twice after a timeout. A stable operation ID prevents duplicate records.
Apply it
Add a destination lookup tool and a separately confirmed save tool. Test a fabricated tool name and a forged account argument.
Check your understanding
A model-generated tool request cannot bypass your normal application permissions. Explain the decision and show evidence from your implementation or design. If you cannot demonstrate it yet, revisit the relevant section before continuing.