AI ENGINEERING — ACTIVE CONCEPTS & PRACTICES | #008
Tool Calling: Connecting AI Models to Real-World Actions
Chapter 2: Engineering AI Applications and Agents
AIYING — Accomplishing with AI
The Big Idea: A language model can generate a proposed action, but an application must execute that action through an authorized tool.
Tool calling connects language-model reasoning and interpretation with APIs, databases, enterprise software, and operational workflows.
Engineering question: How do we allow AI systems to use external capabilities without surrendering control over what they can do?
Contents
- Why Tool Calling Matters
- UNDERSTAND — The Concept
- CONNECT — The AI Engineering Ecosystem
- The Tool Calling Lifecycle
- APPLY — Enterprise Procurement Assistant
- Worked Example: Purchase Order Status
- Engineering Decisions and Trade-offs
- Active Industry Practices
- ACCOMPLISH — Practical Exercise
- Student and Practitioner Project
- Check Your Understanding
- Active Connections
- References and Further Reading
1. Why Tool Calling Matters
Imagine a procurement manager asking an AI assistant:
A conventional chatbot might explain how to check a purchase order manually.
A tool-enabled AI application can retrieve current order information from an authorized enterprise system and prepare a follow-up based on the result.
However, generating a tool call is not the same as executing it.
The application must validate the request, enforce permissions, invoke the tool, inspect the result, and decide whether further action is appropriate.
2. UNDERSTAND — The Concept
What is tool calling?
Tool calling is a mechanism through which an AI model produces a structured request for an external capability made available by an application.
A tool might be a function, API endpoint, database query, search service, calculator, or enterprise workflow operation.
The application typically executes the requested operation and returns the result to the model or workflow controller.
Three essential components
| Component | Responsibility |
|---|---|
| AI model | Interprets the request and proposes a tool call with arguments |
| Application or orchestrator | Validates, authorizes, executes, and monitors tool operations |
| External tool | Performs the actual lookup, computation, or authorized action |
Common categories of tools
- Information retrieval: Search knowledge bases or enterprise records.
- Computation: Calculate values or transform data.
- Read-only operations: Retrieve order status or inventory levels.
- Write operations: Create tickets, update records, or schedule tasks.
- Communication: Prepare or send messages through approved services.
- Workflow operations: Initiate controlled business processes.
Tool calling versus structured outputs
Structured outputs define the format of model-generated data.
Tool calling uses structured arguments to request a specific external operation.
The two concepts are related, but tool calling introduces additional requirements involving execution, permissions, errors, and external side effects.
Tool calling versus an AI agent
Tool calling is a capability. An AI agent is an application architecture that may use tools, state, planning, and repeated decisions to pursue a task.
A single tool call does not automatically make an application an autonomous agent.
3. CONNECT — The AI Engineering Ecosystem
| Connected Concept | Relationship |
|---|---|
| Structured Outputs | Defines machine-readable tool arguments |
| JSON Schema | Specifies required parameters and permitted types |
| Context Engineering | Provides the tool descriptions and task context |
| APIs | Expose external software capabilities |
| AI Agents | Coordinate tool use across multiple steps |
| Workflow State | Records completed actions and pending operations |
| MCP | Standardizes ways for applications to discover and use external tools and context |
| Observability | Records execution outcomes, latency, and failures |
| Evaluation | Tests tool selection, argument accuracy, and task completion |
| Security and Governance | Enforce permissions, approval requirements, and accountability |
Active connection: Tool calling brings together model capabilities and conventional software engineering disciplines.
4. The Tool Calling Lifecycle
↓
Model Receives Available Tool Definitions↓
Model Proposes Tool and Arguments↓
Application Validates and Authorizes↓
Tool Executes↓
Application Receives Result↓
Model or Workflow Processes Result↓
Verified Response or Next Authorized ActionStep 1 — Register tool definitions
The application describes the available tools, including their names, purposes, and input schemas.
Step 2 — Interpret the user request
The model determines whether a tool is useful and, where supported, produces structured arguments.
Step 3 — Validate and authorize
The application checks argument types, user permissions, allowed operations, and business constraints.
Step 4 — Execute the operation
The application invokes the tool using appropriate credentials and error handling.
Step 5 — Process the result
The result is checked and returned to the model or orchestration logic.
Step 6 — Respond or continue
The system reports the outcome or requests another authorized operation.
Tool results are external data, not automatically trusted instructions.
5. APPLY — Enterprise Procurement Assistant
Scenario: Purchase Order Follow-Up
A manufacturing company manages hundreds of purchase orders across suppliers.
Procurement teams need to identify delays and coordinate follow-up actions.
A user asks:
Approach A — Conversational assistant
The AI explains how to check an ERP system and create a follow-up task.
The user must complete the steps manually.
Approach B — Tool-enabled assistant
The application exposes two authorized tools:
- get_purchase_order: Retrieves current purchase-order information.
- create_followup_task: Creates a procurement task after validation and required approval.
The assistant retrieves the order status, checks whether a delay is indicated, and prepares a task request.
The application determines whether the task may be created automatically or requires human confirmation.
Engineering outcome
Tool calling can reduce manual navigation between systems and support more responsive workflows.
But reliable implementation requires accurate records, access control, approval policies, and confirmation of actual tool execution.
6. Worked Example: Purchase Order Status
The following is a fictional demonstration. No real ERP system is accessed.
Tool definition
{
"name": "get_purchase_order",
"description": "Retrieve an authorized purchase order",
"parameters": {
"type": "object",
"properties": {
"po_id": {"type": "string"}
},
"required": ["po_id"],
"additionalProperties": false
}
}
This is a conceptual tool definition. Provider-specific APIs may require a different wrapper or additional fields.
Model-generated tool request
{
"name": "get_purchase_order",
"arguments": {
"po_id": "PO-1048"
}
}
Illustrative tool response
{
"po_id": "PO-1048",
"supplier": "Example Components Ltd",
"status": "delayed",
"expected_delivery": "2026-11-18",
"revised_delivery": "2026-11-23"
}
Next proposed action
The application may prepare a follow-up task based on the confirmed order status.
{
"name": "create_followup_task",
"arguments": {
"po_id": "PO-1048",
"reason": "Delivery delayed",
"assigned_team": "procurement"
}
}
The application must verify authorization and any approval requirement before executing this write operation.
Possible final response
Important distinction: The assistant must not claim that a task was created unless the external system confirms successful creation.
7. Engineering Decisions and Trade-offs
| Decision | Potential Benefit | Risk or Trade-off |
|---|---|---|
| Expose more tools | Broader functionality | Greater selection complexity and attack surface |
| Read-only tools | Lower operational risk | Limited ability to complete workflows |
| Write-enabled tools | Greater automation | Possibility of unintended changes |
| Automatic execution | Lower latency | Reduced opportunity for human intervention |
| Approval gates | Stronger control | Additional workflow time |
| Parallel tool calls | Faster independent operations | Concurrency and dependency complexity |
| Retries | Recovery from transient failures | Duplicate side effects without safeguards |
| Detailed logging | Auditability and debugging | Storage and sensitive-data exposure risks |
Important failure modes
- Incorrect tool selection
- Invalid or invented arguments
- Unauthorized access to external data
- Prompt injection through tool results
- Duplicate write operations after retries
- Partial completion of multi-step workflows
- Stale or inconsistent external information
- False claims of successful execution
Recommended controls
- Least-privilege credentials and user-scoped authorization
- Schema and business-rule validation
- Human approval for consequential actions
- Timeouts, bounded retries, and rate limits
- Idempotency keys where supported for write operations
- Audit logs with appropriate sensitive-data protection
- Verification of actual execution results
- Clear separation between untrusted tool content and instructions
8. Active Industry Practices
Established practices
- Function and tool calling through model APIs
- JSON-schema-based argument definitions
- Integration with enterprise APIs
- Application-side validation and execution
- Tool error handling and execution logging
- Human approval for sensitive operations
Evolving practices
- MCP-based tool integration
- Dynamic tool discovery and selection
- Multi-step agent orchestration
- Tool execution sandboxing
- Fine-grained policy enforcement
- Tool-use evaluation and trace analysis
Industry applications
Tool calling is used in customer support, software development, financial operations, procurement, enterprise search, data analysis, scheduling, and workflow automation.
Practice status: Established AI application capability with rapidly evolving protocols and orchestration practices.
Reviewed: November 2026.
9. ACCOMPLISH — Practical Exercise
Exercise: Design a Tool-Enabled Procurement Assistant
Use the following fictional purchase-order information:
PO: PO-2056
Supplier: Example Industrial Supplies
Status: Delayed
Original delivery: 20 November 2026
Revised delivery: 26 November 2026
Your tasks
- Define a read-only tool to retrieve purchase-order information.
- Specify its required input arguments.
- Design an illustrative tool response.
- Define a second tool for preparing follow-up tasks.
- Identify which operation requires authorization or approval.
- Describe how the application handles a failed tool call.
- Explain how duplicate task creation should be prevented.
- Prepare a final user response that accurately reflects the execution status.
Reusable AI-assisted prompt
Act as an AI application engineer. Design a tool-calling workflow for an enterprise procurement assistant. The user wants to check a purchase order and prepare a follow-up if delivery is delayed. Provide: 1. Required tools and descriptions. 2. JSON input schemas. 3. Example tool requests and responses. 4. Validation and authorization checks. 5. Human approval requirements. 6. Failure and retry handling. 7. Audit information to capture. 8. A safe final user response. Use fictional data. Do not claim that any external action has actually been executed.
Accomplishment: Design a controlled tool-calling workflow that separates model decisions from authorized software execution.
10. Student and Practitioner Project
Mini Project: Tool-Enabled Procurement Assistant
Objective: Prototype an AI application that retrieves purchase-order data and prepares follow-up tasks using simulated tools.
Project requirements
- Create a fictional purchase-order dataset.
- Define two or three tools with input schemas.
- Implement a read-only purchase-order lookup.
- Implement a simulated task-creation operation.
- Validate tool arguments before execution.
- Introduce approval checks for write operations.
- Simulate timeouts and invalid arguments.
- Prevent duplicate task creation during retries.
- Record tool calls, outcomes, and execution status.
- Evaluate the system using representative user requests.
Suggested evaluation measures
| Metric | What It Measures |
|---|---|
| Tool selection accuracy | Whether the appropriate tool is chosen |
| Argument accuracy | Whether tool parameters match the request |
| Authorization compliance | Whether prohibited operations are blocked |
| Task completion rate | Whether authorized tasks finish successfully |
| Duplicate action rate | Whether retries cause repeated side effects |
| Execution latency | Time spent invoking and processing tools |
| Outcome reporting accuracy | Whether responses match actual tool results |
Deliverable: A working prototype or design, tool definitions, sample execution traces, test results, and a short engineering recommendation.
11. Check Your Understanding
- What is tool calling in an AI application?
- Who actually executes a model-proposed tool call?
- How is tool calling different from structured outputs?
- Why does a tool-enabled application need authorization checks?
- What is the difference between read-only and write-enabled tools?
- Why are retries risky for operations with side effects?
- How does MCP relate to tool integration?
- How would you evaluate tool-calling reliability?
Reflection: If an AI assistant correctly identifies a delayed order but the task-creation API fails, what should the assistant tell the user?
12. Active Connections
- #001: Context Engineering
- #002: Token Economics
- #003: Embeddings in Practice
- #004: Retrieval Engineering
- #005: Chunking and Reranking
- #006: Context Management
- #007: Structured Outputs — Making AI Responses Machine-Readable and Reliable
Coming next — #009: Model Context Protocol (MCP): Standardizing AI Connections to Tools and Data.
13. References and Further Reading
- OpenAI — Function Calling
- OpenAI — Structured Outputs
- Model Context Protocol — Introduction
- Anthropic — Tool Use
- OWASP — Security Risks for LLM Applications
Tool-calling APIs, provider-specific schemas, and integration protocols evolve. Verify current documentation before production implementation.
Final Takeaway
AI Engineering — Active Concepts & Practices
Active Concept #008 — Tool Calling
AIYING — Accomplishing with AI
Understand → Connect → Apply → Accomplish
