How can AI tool calling be made reliable?

Reliable tool calling requires the model to **propose** an action while deterministic application code validates, authorises, executes, and records it.\n\nThe core controls are:\n\n- a small, clearly named tool set;\n- precise descriptions of when each tool should and should not be used;\n- strict JSON Schema inputs and structured outputs;\n- local type and business-rule validation;\n- explicit identity and permission checks;\n- idempotency keys for retried writes;\n- timeouts, rate limits, and bounded retries;\n- approval for consequential calls;\n- structured error results the model can act on;\n- complete traces and task-specific evaluations.\n\nA schema-valid tool call is not necessarily safe or correct. It only proves that the arguments match the declared shape.

Function calling allows a model to return a structured request for an application-defined function rather than ordinary prose. The application—not the model—is responsible for executing that function and returning the result.\n\nReliable tool design begins with narrow interfaces. A tool named `manage_account` with a free-form instruction is difficult to validate and authorise. Separate tools such as `read_account_balance`, `prepare_refund`, and `execute_approved_refund` create clearer risk and permission boundaries.\n\n### Schema design\n\nUse JSON Schema with:\n\n- explicit object types;\n- required fields;\n- enumerations for closed choices;\n- formats or patterns where supported;\n- minimum and maximum values;\n- `additionalProperties: false` where appropriate;\n- structured output schemas.\n\nThe MCP specification requires a valid JSON Schema input object and optionally supports a structured output schema.\n\n### Semantic validation\n\nAfter schema validation, application code must confirm:\n\n- the referenced resource exists;\n- the caller may access it;\n- the value is within policy limits;\n- dates, currencies, identifiers, and units are consistent;\n- the operation is permitted in the current state;\n- no approval or prerequisite has expired;\n- the call does not violate tenant or data boundaries.\n\n### Execution safety\n\nRead operations and write operations should be distinguishable. Destructive and external actions should be separately permissioned. Use transactional execution where possible, idempotency keys for retried actions, and dry-run or prepare/commit patterns for high-impact changes.\n\n### Error handling\n\nReturn structured, bounded errors such as `not_found`, `permission_denied`, `validation_failed`, `conflict`, `rate_limited`, or `approval_required`. Do not return stack traces, secrets, or uncontrolled internal text. The agent may revise an invalid request, but retries need a fixed limit.\n\n### Tool selection\n\nGiving a model hundreds of poorly differentiated tools increases selection errors and context cost. Filter tools by the user's permissions, current workflow state, and task. Use deterministic routing when the required tool is known.\n\n### Validation and evaluation\n\nTest more than whether the model emits valid JSON. Evaluate correct tool selection, correct arguments, refusal to call when unnecessary, behaviour after failures, resistance to malicious tool descriptions, and final task outcome. Replay traces when models, prompts, or schemas change.

- [Google — Function calling with the Gemini API](https://ai.google.dev/gemini-api/docs/function-calling) — defines function declarations, structured arguments, tool-selection modes, parallel calls, and application-controlled execution. - [Google — Using tools](https://ai.google.dev/gemini-api/docs/tools) — distinguishes function calling for intermediate actions from structured outputs for schema-constrained final responses. - [Model Context Protocol — Tools](https://modelcontextprotocol.io/specification/2025-11-25/server/tools) — defines tool names, descriptions, JSON Schema inputs, optional output schemas, and structured results. - [OpenAI Agents SDK — Human in the loop](https://openai.github.io/openai-agents-python/human_in_the_loop/) — demonstrates approval gates bound to individual tool calls and arguments. - [OpenAI Agents SDK — Guardrails](https://openai.github.io/openai-agents-python/guardrails/) — documents validation tripwires for agent inputs and outputs.