# Tool Calling: Giving Models Capabilities

**Track:** Models, Tools & Agents — AI-Native Full-Stack Development — complete (30)
**Framework / surface:** web dev (function tools / schemas)
**Level:** Intermediate
**Prerequisites:** Models as Typed Capabilities, Identity, Sessions & Authorization

**In one line:** A tool turns model intent into a bounded, typed action over real application capabilities.

## Theory, aesthetics & inspiration

A language model only generates tokens; a tool is the boundary where the surrounding application converts a model's stated intent into a real, validated action. The pattern went mainstream when OpenAI shipped function calling in June 2023 — describe a function with a JSON Schema, let the model propose arguments, then let ordinary code validate and execute — and it now underlies every agent framework in production. The boundary is the point: the model does not become the database or the payment system; it requests access to capabilities you defined, described, and scoped. Tool design is therefore interface design for a probabilistic caller. Descriptions matter because the model chooses tools by reading them; schemas matter because they constrain inputs; permissions matter because a well-formed call can still be an unauthorized act. Saltzer and Schroeder's least privilege applies verbatim: `searchWorks` over `runAnySQL`, `createDraftInvoice` as a different tool from `sendInvoice` — deterministic boundaries around side effects, with the model choosing among them rather than reaching past them.

**Builder question:** Can this tool be made narrower, more descriptive, or less privileged without preventing the agent from completing its job?