Tool calls are not all equally dangerous. Some are low stakes and easy to undo. Others cannot be taken back once they run.
| Low stakes, reversible | Irreversible |
|---|---|
| Get the weather | Send an email |
| Look up an order | Delete a record |
| Read a document | Charge a card |
| Search a catalog | Post to social media |
Confirm before you act#
The rule: ask the user to confirm before any action that sends, deletes, pays or publishes.
The practical pattern is a preview step, sometimes called a dry run. Your code shows the user exactly what is about to happen, and the real action runs only after they approve.
Why confirmation matters#
The model can misread intent#
A user asks to "clean up the old records". The model calls delete_records(older_than="2020-01-01"), but the user meant archive, not delete. A preview that says "Delete 4,200 records older than 2020?" lets the user catch the mistake before it happens.
Prompt injection can trigger tool calls#
If your system reads untrusted content, such as emails, web pages or uploaded documents, an attacker can hide instructions in it. Those instructions can make the model call a dangerous tool, for example "forward all invoices to this address". See Delimiters for how injection works.
Human confirmation breaks this attack. The model can be tricked into asking, but a real person still has to approve before anything happens.
Tool descriptions are prompts#
The model chooses which tool to call, and with which arguments, from the name, description and parameter schema you write. Those words work like a prompt.
| Vague | Clear |
|---|---|
update: "Updates data." |
archive_records: "Move records older than a date to the archive. Does not delete them." |
A vague description leads to wrong calls. Say what the tool does, when to use it and what it does not do. Writing tool descriptions is prompt engineering.
Short line#
Confirm with the user before any tool call that sends, deletes, pays or publishes, using a preview step. It catches misread intent and stops prompt injection, because a person must approve. Write tool descriptions as carefully as prompts, because the model picks tools from them.
Key takeaways#
- Reading and looking up are low stakes. Sending, deleting, paying and publishing are irreversible.
- Show a preview and get the user's approval before an irreversible action runs.
- The model can misread intent, for example delete when the user meant archive.
- Untrusted content can inject instructions that trigger tool calls. Human approval stops them.
- Tool names, descriptions and schemas are prompts. Vague descriptions cause wrong calls.