Spring AI provides building blocks for production agents, not a complete safety policy. In Spring AI 2.0.1, ChatClient can run a tool-calling loop through advisors, while your application remains responsible for which tools are available, whether a user is authorized to invoke them, when a person must approve an action, and how you test and monitor behavior.
How do I build an AI agent with Spring AI?
For the usual tool-using agent, supply application-defined tools to ChatClient and use its advisor chain to manage the tool-calling loop. Spring AI’s Tool Calling reference identifies version 2.0.1 and describes this division of work: the model can request a tool call, but the application-side ToolCallingManager locates and executes the corresponding callback. The result is added to the conversation, then returned to the model. The loop ends when the model responds without another tool request.
As an Amazon Associate I earn from qualifying purchases.
As the Spring AI documentation puts it, “The model never receives direct access to the APIs behind your tools — a critical security consideration.” That boundary is useful, but it does not authorize a requested action. Your application still decides which tools to expose and whether each request is valid and permitted.
Choose the loop that fits your application
| Approach | What it gives you | What your application must own |
|---|---|---|
ChatClient with the advisor loop |
A composable Spring AI path in which ToolCallingAdvisor drives the loop and ToolCallingManager executes application-defined tools. |
Tool design, authorization, validation, approval policy, failure handling, and operational controls. |
Manually driven ChatModel loop |
Explicit control over the orchestration. | The application must detect tool requests, execute them, add results to the conversation, and continue or stop the loop. A direct ChatModel call does not automatically execute a returned tool request. |
Use the manual route when a custom orchestrator needs to own that control. Otherwise, the advisor loop provides the ordinary composable path. In either case, tool callbacks should do narrowly scoped work through trusted application services rather than treating model-generated arguments as proof of permission.
#1 Best Overall
Place advisors deliberately
Advisor order affects whether behavior wraps the request once or runs again on each tool-loop iteration. This matters for custom approval checks, budget enforcement, event recording, retries, and memory. Spring AI’s default memory placement is outside the loop: it sees the final user and assistant messages, not the intermediate tool request and response messages. If the application needs the full tool transcript, put memory inside the loop and use a repository that can serialize tool messages. The Spring AI 2.0 documentation lists in-memory, Redis, and Neo4j repositories as supporting the full message set.
Decide what belongs in memory before selecting the repository. Retaining intermediate tool content can help reconstruct an interaction, but it also increases the amount of potentially sensitive data stored.
How do I let an agent call tools safely?
Build safety around the application-controlled execution boundary. A tool call is a request for your application to perform an operation; the model’s selection of a tool or its arguments does not establish identity, entitlement, or policy approval.
- Expose the smallest useful tool set. Prefer request-scoped tools where possible, and keep each tool limited to a specific operation.
- Validate every argument. Check types, ranges, required fields, resource identifiers, and business invariants before calling a service.
- Authorize at a trusted boundary. Verify the current user’s permissions in the tool implementation or the service it calls. Do not rely on instructions in the prompt as an authorization control.
- Set explicit execution limits. Spring AI 2.0.1 documents defaults of 40 calls per tool and 150 tool calls total per turn. These are framework defaults, not performance targets; the
spring.ai.tools.limits.*properties configure them, and limits can be disabled. Choose and review production values deliberately. - Choose failure behavior by risk. Spring AI’s tool documentation describes handling errors by returning them to the model or throwing them for the caller to handle. Decide which behavior is appropriate for each tool. A model should not automatically reinterpret every operational failure as permission to try something else.
Review dynamic tool resolution carefully
Spring AI’s resolver fallback is disabled by default. Enabling it broadens access: tools exposed through resolvers may become executable when the model names them. That can include destructive or otherwise high-risk operations. Keep fallback disabled unless the application needs it, and restrict resolver contents to tools appropriate for the current request and user.
How can I require human approval before a tool runs?
Spring AI identifies a custom ToolCallingAdvisor hook as a place to pause before executing a destructive tool. The hook provides an extension point; the application must implement the approval policy and workflow.
- Let the model propose an action. Treat its tool name and arguments as an untrusted request.
- Validate the request and the current user’s authorization. Reject malformed arguments or actions the user is not allowed to perform before asking for approval.
- Pause when policy requires review. Present a human reviewer with enough context to make a decision, without exposing unnecessary data.
- Execute only after approval. Re-check any conditions that could have changed while the request was waiting, such as permissions or the target resource’s state.
- Record the decision and result. Keep an audit record appropriate to the action and your retention rules.
- Return only the necessary result to the agent. Do not pass sensitive service responses into the conversation when a minimal status or summary will suffice.
The application must also define who can approve, how identity is verified, what happens on timeout or rejection, how the request resumes, and how duplicate execution is prevented. These are implementation decisions, not guarantees supplied by the advisor hook. Human approval adds latency and review work, but provides a policy checkpoint before an action that should not run automatically.
How do I evaluate an AI agent’s answers?
Use repeatable evaluations before deployment and after changes to the model, prompt, tools, or retrieval setup. Spring AI provides an Evaluator interface whose evaluation request includes the original user text, contextual data, and generated response. Its examples include RelevancyEvaluator, which assesses alignment with the query and supplied context, and FactCheckingEvaluator, which assesses whether a claim is logically supported by that context.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchThese evaluators are aids, not proof that an answer is true. A model-based judge can miss errors or share the generator’s blind spots. For consequential decisions, include human review and do not use an evaluator pass as the only release or runtime gate.
Build an evaluation set around the real workflow
Include cases that exercise both answers and actions, not just polished successful conversations:
Rank #4
- Requests where the agent should select a particular tool, and similar requests where it should not call any tool.
- Valid, malformed, incomplete, and out-of-range tool arguments.
- Authorization denials and attempts to access resources outside the user’s permissions.
- Relevant and irrelevant retrieved context, plus questions that the context cannot answer.
- Unsupported claims, tool failures, limit exhaustion, and cases that should be escalated to a person.
- Approval, rejection, timeout, and retry cases for actions that require human review.
Track results across model, prompt, and tool changes so a previously passing case does not quietly regress. Choose pass criteria that match the impact of the task: an answer-quality score alone will not reveal an unsafe tool choice or an authorization defect.
Use an LLM judge with controls
Spring AI’s LLM-as-judge guide recommends using separate generation and evaluation models to reduce bias, deterministic evaluation settings, integer rating scales, and few-shot examples. These practices can make judgments more consistent, but they still need calibration against human review.
The guide also describes recursive evaluation with a rating threshold and retry limit. Recursive evaluation can add model calls and cost, needs a clear termination condition, and is sensitive to advisor ordering. Its experimental-feature and non-streaming notes are tied to the guide’s Spring AI 1.1.0-M4+ context; do not assume those version-specific notes describe Spring AI 2.0.1. Check the exact release in use before adopting that pattern.
Best Value
How do I trace Spring AI tool calls in production?
Spring AI builds on Spring observability and provides metrics and tracing for core operations, including ChatClient and its advisors, ChatModel, embedding and image models, and vector stores. Tool observations can include the tool name and definition metadata, execution duration, and tracing context when a tracer is available. Instrumentation details can vary by provider and release, so check the integrations used by your application.
Start with metadata and operational signals: request and tool latency, errors, limit-exceeded events, advisor behavior, escalation frequency, and model or token usage where supported. Confirm which signals your Spring AI version and provider actually emit rather than assuming every integration reports the same measurements.
Keep content capture a deliberate privacy decision
Spring AI’s Observability reference says, “The ChatClient prompt and completion data is typically big and possibly containing sensitive information.” Prompt and completion content are not exported by default; tool arguments and results are also excluded by default. Enabling content capture can expose private or sensitive information.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Keep content capture off unless an approved operational need justifies it. If you enable it, use access controls, redaction, and a retention policy appropriate to the data. Metadata and latency can support many operational investigations without placing full prompts, completions, or tool payloads in telemetry.
What does Spring AI provide—and what remains your responsibility?
Spring AI supplies mechanisms such as the tool-calling advisor loop, tool execution manager, configurable call limits, evaluator interface, and observability instrumentation. None establishes a universal definition of safe, accurate, or production-ready behavior. The application team must connect those mechanisms to its own authorization model, tool risk, human-review policy, evaluation data, and incident response.
Pin implementation details to the release you deploy. The cited tool-calling and evaluation-testing references identify Spring AI 2.0.1; documentation and APIs can change, so verify names, defaults, and provider coverage against the exact version in your build.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
