Tool Calling
The model proposes; the host disposes
A model does not directly call your payment API or database. The application sends tool definitions with the prompt, the model emits a structured request, and the host application decides whether and how to execute it. The result becomes another message, and the model is called again to continue or answer.
That distinction is the safety boundary. Model output is untrusted input even when it conforms to a schema. The host validates types and bounds, authenticates the user, authorises the specific action, applies rate limits, asks for approval where required, executes with least privilege, and records what happened.
A tool call therefore adds at least one model round trip plus the tool's own latency. A simple request that needs one tool usually means: model selects the tool, tool executes, model reads the result and synthesises the answer.
user request
│
▼
model ── structured tool request ──▶ host
▲ │ validate / authorize / approve
│ ▼
└──────────── tool result ◀──── external API
│
▼
final model responseSchema-valid does not mean authorised, harmless, or semantically correct. Validation narrows the shape of an action; policy decides whether that action may occur.