"Tool use without trust: the model requests, your code decides"
Giving a model tools does not mean giving it authority. Every tool call is a request from an untrusted client, and the layer that decides whether to honour it is ordinary code you write. Here is how I build that permission boundary — allowlists, argument validation, and deciding in code, not in the prompt.
There is a moment in every agent project where someone wires a model up to a function that does something real — sends an email, writes to a database, calls an API that costs money — and the demo works, and everyone relaxes. That is precisely the wrong moment to relax. What just happened is that a probabilistic text generator gained the ability to trigger side effects in your systems, and the only thing standing between its output and those side effects is whatever code sits in the middle. That code is the most important part of the system, and in most demos it barely exists.
Have an AI feature stuck between demo and production?
The gap — reliability, evals, cost control, the plumbing that keeps it running unattended — is exactly the work I do. If that sounds familiar, a short conversation is usually enough to point you the right way.
Book a free consultation