Agents
Tool Use / Function Calling
The model recognizes that it needs a tool for a step and calls it in a structured way: the weather API, the database, the calculator, the CRM. The response flows back into the context, and the model carries on working. Only tool use connects language models to the world; before that, they could only talk about it.
An example
A language model can't calculate, look anything up, or trigger anything. But it can say what should be done: “call `check_stock` with article number 4711.” The surrounding program executes the call and passes the result back. That turns a text generator into something that acts in systems, and the same mechanism turns a wrong guess into a wrong booking.
A closer look
The application describes its functions with name, purpose, and parameters. The model then responds not with text but with a structured call, which the application executes. The result goes back into the conversation.
Why it matters
This is the boundary between “says something wrong” and “does something wrong,” and that is why every tool definition belongs on the same test bench as an interface for external users. Three questions per tool: what is the maximum damage of a faulty call? Is the call reversible? Is it logged? Read-only tools are harmless, writing ones are not. The common and proven split: the agent may read freely, write only within hard limits, and anything irreversible needs human approval.
Commonly misunderstood
The model decides whether to call and with what values. It also guesses. The application has to check every call as if it came from outside, because that is exactly what it does.