Cheatsheet 15 — Tool Calling & Agents

Tool/function calling and the agent loop. Full: Phase 10. Labs: 04, 10.

The protocol (model proposes, app executes)

1. You send: messages + tool schemas (JSON Schema)
2. Model returns: a tool_call {name, arguments}   ← it PROPOSES; it does NOT execute
3. YOUR APP: validate args → check permissions → EXECUTE the tool → get result
4. You send back: tool_result
5. Model: uses the result → answers or calls another tool
(loop)

The trust boundary: the model never runs anything. Deterministic, permission-checked app code executes. This defuses most agent attacks (Phase 10.05, Phase 14.01).

Tool schema (shape)

{
  "name": "get_weather",
  "description": "Get current weather for a city",
  "parameters": {
    "type": "object",
    "properties": { "city": {"type": "string"} },
    "required": ["city"]
  }
}

• Clear descriptions and tight schemas → better tool selection + valid args.
• Constrained ≠ correct: schema guarantees valid JSON, not correct values — validate semantically.

The agent loop

goal → [plan] → choose tool → execute (app) → observe → repeat → done

Least-agentic that works — more autonomy = more cost, latency, and failure surface.

Reliability math (say this)

• Per-step reliability compounds: 0.95^10 ≈ 0.60. A 95%-reliable step over 10 steps → 60% task success.
• Fewer steps, validation per step, and human approval on high-impact actions (Phase 10.05).

Safety & control

• Whitelist tools; validate args; approval gates for irreversible actions; sandbox; audit every tool call (Phase 14.06).
• Treat tool results as untrusted text (indirect prompt injection, Phase 14.01).

Eval

• Outcome (did it succeed?) + trajectory (did it take sane steps?) + safety; per-step reliability (Phase 10.09).

Next: 16 — Evaluation Metrics · Full: Phase 10