The model never runs anything itself

When an AI model "uses a tool", it doesn't execute code or touch your database. It writes a structured request: the name of a tool and some arguments, like search with a query, or query_db with an order number. Your code receives that request, decides whether to run it, runs it, and hands the result back.

That separation is the most important safety property of any agent. Everything the model can do goes through code you wrote and control.

The loop

After each result is added to the conversation, the model reads everything again and decides the next move: another tool, or a final answer. In the figure it searches, queries the database, uses the calculator, and then answers, four steps. The context stack grows with every step, from 600 tokens to just over 1,100, because each call and each result stays in it.

That growth is why long agent runs get slower and more expensive, and why trimming or summarising old results matters in real systems.

Check every call before running it

Models sometimes produce a call with a missing field, a wrong type, or an argument that makes no sense. The fix is a gate: validate each call against the tool's schema before running anything. In the figure, a bad call is stopped at the gate, an error card goes back into the context instead of a result, and the model gets a chance to correct itself.

The same gate is where permissions belong: which tools this agent may call at all, and which arguments are allowed.

Every loop needs a limit

A model that keeps calling tools without converging will happily run until it hits a cost or time wall. A step limit stops it. In the figure, a run with one rejected call uses up its four steps without reaching an answer, and the limiter trips. That's a feature: a stopped agent is a problem you can see, a runaway one is a bill you find later.

What I build into every agent

  • Tools with strict schemas, validated before execution, with clear error messages back to the model.
  • A small set of well-described tools per task, not everything the system can do.
  • A step limit and a cost limit on every run.
  • A trace of every call, argument, result and token count, so any run can be replayed.
  • Human approval on anything that writes, sends or spends, on top of the loop shown here.