Tool calling and AI agents
How a model asks software to take actions, how an agent loops through planning, acting and checking, when an agent is worth it versus a simple workflow, and how to keep agents safe.
🎯 By the end of this lesson you will be able to:
- Explain tool calling: the model requests an action and the application performs it
- Describe the agent loop and the difference between a workflow and an agent
- Apply guardrails: limited tools, step limits, human approval and logging
In this lesson
From answering to doing
Everything so far has been about models producing text. Many useful tasks need actions: look up an order, check a calendar, run a database query, create a ticket or send an email. Language models cannot do these things by themselves. Tool calling (also called function calling) is how they ask your software to do them.
How tool calling works
- The application tells the model which tools exist, with a name, a description and the inputs each needs, for example
get_order_status(order_id). - When the user asks something that needs a tool, the model replies with a structured request instead of an answer: "call get_order_status with order_id 78213".
- The application, not the model, checks the request and runs the tool, then sends the result back to the model.
- The model uses the result to write its answer, or asks for another tool.
One question, one tool
User: Where is my order 78213?
Model → tool request: get_order_status(order_id: "78213")
Application → result: {"status": "shipped", "carrier": "DHL", "eta": "Thursday"}Model → user: Your order 78213 has shipped with DHL and should arrive on Thursday.
Agents: tools in a loop
An AI agent is a system where the model works towards a goal over several steps, choosing which tool to use next based on what it has learned so far. It plans, acts, observes the result and decides again, until the goal is reached or it needs a person.
A multi-step task
Goal: "Find all customer tickets about failed payments this week, group them by cause, and draft a summary for the payments team."
1. search_tickets(query: "payment failed", since: Monday) → 42 tickets 2. read_ticket × 42 → extracts error details 3. Groups into: expired cards (19), 3-D Secure timeouts (15), bank declines (8) 4. draft_document(…) → summary with counts and example ticket links 5. Stops and asks a human to review before sending
Workflow or agent?
Not every AI feature should be an agent. In a workflow, your code fixes the steps and the model fills in parts, such as classify, then summarise. In an agent, the model chooses the steps. Workflows are more predictable, cheaper and easier to test; agents are more flexible.
| Use a workflow when… | Consider an agent when… |
|---|---|
| The steps are known and always the same | The steps depend on what is found along the way |
| Predictability and audit matter most | Flexibility matters and mistakes are cheap to catch |
| Volume is high and cost must be low | Tasks are complex but less frequent |
Keeping agents safe
- Least privilege: give only the tools and permissions needed. Read-only tools where possible.
- Human approval for anything irreversible or costly, such as payments, deletions or emails to customers.
- Step and cost limits so a confused agent cannot loop forever.
- Treat tool results as data, not orders: content an agent reads can contain prompt injection (Lesson 6).
- Log every step so you can see what the agent did and why.
To connect agents to tools and data in a standard way, many products support the Model Context Protocol (MCP), an open standard introduced by Anthropic in 2024. The AI Engineer track covers it in practice.
What this means for your role
Developer
Design small, well-described tools with strict input validation. Enforce permissions in your code, not in the prompt, and add step limits, timeouts and full logging.
Tester / QA
Test the paths, not just the final answer: wrong tool chosen, bad tool results, loops, prompt injection in retrieved content, and whether approval steps can be skipped.
Business Analyst / PO
Map which actions an agent may take, which need approval and who approves. Write these as explicit rules in the requirements.
Tech Lead / Architect
Prefer workflows for core processes; use agents where flexibility pays off. Own the security model: identities, scopes and audit trails for every tool.
Project / Delivery Manager
Agents raise both value and risk. Plan a pilot with a narrow goal, a human checkpoint, clear success measures and a way to switch it off.
Scrum Master / Agile
Help the team agree where agents can act on their own and where a person must approve, and revisit this as trust grows.
Try it: design an agent on paper
- Pick a repetitive multi-step task from your work, such as preparing a weekly status update.
- List the tools an agent would need, and mark each read-only or able to change things.
- Mark the step where a human must approve, and write the step limit. Then decide: does this really need an agent, or would a fixed workflow do?
Key takeaways
- Tool calling lets a model request actions; your application decides and executes them.
- An agent loops through deciding, acting and observing until the goal is met or a limit is reached.
- Use workflows when steps are known; use agents when steps depend on what is found.
- Keep agents safe with least privilege, human approval, limits, logging and suspicion of injected content.
Key terms
- Tool calling
- A model producing a structured request for the application to run a function or API.
- AI agent
- A system where a model works towards a goal over several steps, choosing tools as it goes.
- Workflow
- A fixed sequence of steps defined in code, where a model handles some steps.
- MCP
- Model Context Protocol: an open standard for connecting AI applications to tools and data.
Check your understanding
Answer all 5 questions. Score 3 or more to complete the lesson.
1. In tool calling, who actually runs the tool?
2. What makes a system an agent rather than a single tool call?
3. Your process always follows the same three steps at high volume. What fits best?
4. Which action should normally require human approval in an agent?
5. Why add a step limit to an agent?