Definition
Tool Calling
Tool calling is the capability that lets a language model invoke external functions — query a database, search the web, create a record — by emitting a structured request the surrounding system executes. Instead of only producing text, the model can take actions and pull in live data, turning it from a text generator into the reasoning core of an agent.
Key takeaways
- Tool calling lets a model invoke external functions — querying data, taking actions — by emitting a structured request the system executes.
- It turns a text generator into the reasoning core of an agent, able to fetch live data and effect change in real systems.
- The typed tool interface is what makes it reliable: the model produces validated structured arguments instead of guessing at an API.
- Because a model can call destructive functions, tool calling demands least-privilege scoping, a tenant boundary, and approval gates.
On its own a model can only output text from what it already knows. Tool calling extends it with hands. The developer describes a set of tools — each a typed function with a name, purpose, and parameters — and the model, when it determines a tool would help, emits a structured call naming the tool and its arguments. The application runs the real function and feeds the result back, and the model continues with that new information in hand.
This is the mechanism behind agents and most live AI features. It lets a model fetch current data it was never trained on, perform precise operations it is bad at doing in its head, and effect change in real systems. The typed interface is what makes it reliable: the model produces validated structured arguments rather than guessing at an API from prose.
Tool calling is also where safety becomes concrete. A model that can call functions can call destructive ones, so a tool-calling agent must be scoped to a least-privilege set of allowed tools, kept inside the tenant boundary, and made to route dangerous operations through approval — with every call recorded. The model proposing a tool call must never be the same thing as the call being executed.
In Planoda, agents are clamped to an explicitly allowed set of tools inside the RLS tenant boundary, and destructive tool calls go through propose/approve and into the audit trail.
Related terms
- AI AgentAn AI agent is a software system that uses a large language model to pursue a goal across multiple steps — reading context, choosing tools, and taking actions — rather than answering a single prompt. In a work platform, agents triage issues, draft updates, and execute multi-step tasks as autonomous teammates, bounded by the permissions and approvals their operators set.
- MCP ServerAn MCP server implements the Model Context Protocol, an open standard that lets AI assistants connect to external tools and data through a uniform interface. Rather than building a bespoke integration per assistant, a tool exposes one MCP server describing its available actions and resources, and any MCP-capable AI can discover and use them safely.
- GuardrailsGuardrails are the controls that constrain what an AI system is allowed to do or say, enforced around the model rather than left to the model's judgment. They validate inputs and outputs, block unsafe or off-policy actions, scope which tools an agent may use, and route risky operations through approval — turning a probabilistic model into a system safe to deploy.
- Propose / Approve (AI Governance)Propose/approve is a governance pattern for autonomous software: instead of executing a consequential action directly, an AI agent emits it as a proposal that a human or policy must approve before it runs. It keeps fast, read-only work autonomous while gating destructive or irreversible operations — the practical way to give agents real power without surrendering control.
- System PromptA system prompt is a set of instructions given to a language model before any user input, defining its role, behavior, tone, constraints, and the tools or knowledge it should use. It frames every response in the conversation that follows. Unlike a user message, it sets the persistent ground rules the model is meant to honor throughout an interaction.