Tool calling basics

The model asks, your code decides

A tool is a name, a description, and an input schema. The model can request a call with arguments; your application decides whether to run it, runs it, and passes the result back for the next turn.

That boundary is the entire safety story. The model produces a request, not an execution, so every check you need — authorisation, validation, rate limiting — belongs on your side of it.

The description is the prompt for the tool. A tool that is called at the wrong time almost always has a description that does not say when it applies.