Tool use: typed proposals, deterministic authorization, reconciled effects

A language model can propose a tool name and arguments, but generated structure is still untrusted input. The application must resolve a known tool, validate schema and semantics, authorize the exact caller and target, and handle side effects under ordinary distributed-systems failure modes.

Mental model

• Toolformer studies models learning when, which, and how to call APIs under specific tasks and training. Treat generated tool selection as a proposal, not authorization.
• The Model Context Protocol specification defines capability negotiation, tools, requests, and results as protocol contracts. Version capabilities and treat server-provided descriptions and results as untrusted.
• JSON Schema defines machine-readable structural validation vocabularies. Use schema validation as one boundary, followed by semantic and authorization checks.
• OWASP lists excessive agency, prompt injection, improper output handling, and unbounded consumption risks. Apply least privilege, sandboxing, output handling, and budgets.

Guarantees and boundaries

• Only registered tool and schema versions can be dispatched.
• Approval binds to one canonical argument fingerprint.
• Every mutation has PENDING, SUCCEEDED, FAILED, or UNKNOWN state.

Diagram scenarios

Resolve, validate, authorize. A generated call becomes executable only after registry, schema, semantic, and policy checks.

Confirmed mutation with durable identity. The executor records intent before a side effect and accepts only approval for the same fingerprint.

Timeout and reconciliation. A network timeout can hide a completed mutation; blind retries are forbidden.

Tool result is untrusted data. A webpage, file, database row, or error can contain instructions intended to control the next model call.

Architecture decision

Publish a minimal versioned tool registry, reject unknown fields and tools, authorize every exact resource, require confirmation for configured effects, and persist an operation fingerprint before mutations. Sanitize tool results before returning them to the model and reconcile UNKNOWN outcomes before retry.

Failure modes

• Schema-valid arguments can still target the wrong tenant or dangerous resource.
• A target can commit after the client times out.
• Tool metadata and results can prompt-inject the model.

Operational checklist

• Minimize tool catalog and credential scope.
• Validate structure, semantics, resource ownership, destination, and budgets.
• Require fresh confirmation for configured high-impact effects.
• Test timeouts, duplicates, cancellation, result injection, and audit redaction.

Related concept

Primary sources

1. https://arxiv.org/abs/2302.04761
2. https://modelcontextprotocol.io/specification/latest
3. https://json-schema.org/draft/2020-12
4. https://genai.owasp.org/llm-top-10/