Keep tool calls observable and predictable.
1. Argument validation
Validate types, bounds and allowed operations before dispatch. A model-generated argument object is untrusted input even if it matches a discovered tool name.
2. Result limits
Bound result size and include provenance needed for citations. Avoid passing entire datasets into model context when a small filtered result satisfies the task.
3. Error semantics
Separate protocol errors, tool errors and application denials. Expose a useful user message while preserving diagnostic categories for operators.
Worked scenario
A search tool returns a thousand documents. The host selects a bounded authorized subset and reports the limitation instead of flooding the model context.
Apply it
Create a tool executor with success, forbidden, timeout and oversize-result cases.
Check your understanding
A trace explains which operation ran, under whose authority and with what outcome. Explain the decision and show evidence from your implementation or design. If you cannot demonstrate it yet, revisit the relevant section before continuing.