The model never runs anything itself. It only produces text that describes what it wants to run. Your code reads that request, decides whether to act on it, and executes the function. This is the most important idea in tool calling.
The model can only ask#
The model has no direct access to your database, your filesystem, your APIs or anything else. All it can do is ask. Your code is what actually touches those systems.
Your code is the safety boundary#
Because only your code acts, your code is the safety boundary, not the model.
- If the model asks to delete a file, your code decides whether that is allowed.
- If the model asks to send an email to 10,000 people, your code is what would send it.
A request from the model is a suggestion, not a command. The model asking for something does not mean it should happen.
Never let a model's request run automatically without your code checking it first. Check the arguments, check that the user is allowed to do it, and ask the user before anything irreversible.
The next three notes cover those checks: validation, limits and risky actions.
Short line#
The model never executes a tool. It produces a request, and your code decides whether to run it. That makes your code, not the model, the safety boundary, so no request should run without a check.
Key takeaways#
- The model only produces text that describes the call it wants.
- It has no direct access to databases, files or APIs. Your code does.
- Your code decides whether a request is allowed and runs it.
- Your code is the safety boundary, not the model.
- Never let a model's request execute automatically without a check.