Tool Calling

The model asks; your code does it

Given a description of the tools available, a model can respond with a structured request to use one: a name and some arguments, as JSON.

It does not execute anything. Your code receives that request, decides whether to honor it, runs it, and feeds the result back into the conversation as another message.

That boundary is the whole security model, and it is easy to lose sight of once a framework is doing the plumbing. The model proposes; your code disposes. Every question about what an agent is permitted to do is answered on your side of that line, not by anything in the prompt.