Give chat agents tools, not unrestricted access.

Tool-call contract

Describe each tool with a name, purpose and validated parameters. Keep credentials in application infrastructure, never in a prompt or browser-delivered source.

{
  "name": "lookup_order",
  "description": "Read the status of an authorized order",
  "parameters": {
    "order_id": "string"
  },
  "side_effects": false
}

Illustrative application-side tool definition; not a provider-specific API schema.

The authorization boundary

Check that the requesting user may access the specified record. Restrict which tools may run, cap invocation count and time, sanitize inputs and escape outputs. Require confirmation before spending money, deleting data or changing external systems.

Tool outputs are untrusted

A webpage, search result or database field may contain malicious instructions. Treat these as data for the user's request, not higher-priority commands that can change your system rules.

Evaluate tool behavior

Tests should cover missing parameters, invalid identifiers, permission denials, malformed tool responses, timeouts and correct refusal to act. Log the tool name and result category without exposing unnecessary secrets.

Continue with the chat agent overview and reliable assistant design.