Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsReliable AI agents do not execute tools by themselves: a model produces a structured request, and an application or provider runs it, checks the result, and decides what happens next. Production design depends on making that execution boundary explicit, choosing between direct calls and code-driven orchestration, and putting authorization and approval controls close to actions that can change data or affect people.
How does an AI agent use a tool?
A tool call is a structured request, not an action the model carries out on its own. The application or provider describes available operations and their input shapes; the model requests an operation; a runtime executes it and returns a result. Anthropic’s documentation puts it plainly: “The model never executes anything on its own.” Anthropic’s tool-use documentation describes this contract.
As an Amazon Associate I earn from qualifying purchases.
That division of work gives you a design decision with operational consequences: who owns execution and the continuation loop? In a client-executed design, your application receives the request, runs the tool, returns its result, and decides whether the model should continue. In a server-executed design, a provider may run tools and multiple iterations within one request. Anthropic documents both client and server patterns; exact modes vary by platform. Its documentation describes the pattern, not a universal protocol.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Make the boundary concrete in your architecture. Decide which component authorizes a call, validates arguments and results, handles timeouts and retries, records what happened, and resumes after an interruption. If these responsibilities are implicit, a tool may run successfully while the surrounding agent still behaves unreliably—for example, by continuing after an invalid result or losing track of a pending action.
When should you use direct calls or programmatic tool use?
Choose based on the work between tool calls, not on a blanket assumption that one mode is faster or more accurate. The available documentation gives selection guidance, not a general comparative benchmark.
| Pattern | Best fit | What to plan for |
|---|---|---|
| Direct tool calls | A lookup or action is sufficient, or the next step should depend on fresh model judgment. | Keep approval and citation-sensitive decisions visible in the flow. The model may need another turn to interpret a result and choose what to do next. |
| Programmatic tool calling | The control flow is predictable and ordinary code can filter, join, rank, deduplicate, aggregate, or validate structured results. | Define eligible tools and their schemas, specify bounded stages, and decide what happens when a stage fails. Return the model a compact, useful result rather than unnecessary raw data. |
OpenAI’s Programmatic Tool Calling guide describes the code-orchestration option. It is useful when deterministic processing can reduce or organize results before the model reasons over them. Keep direct calls where the next decision genuinely needs the model’s interpretation, especially when a human must review a sensitive action or when preserving the origin of information matters.
These patterns can be combined: code can perform bounded data processing, while a model handles decisions that require judgment. Specify which work belongs to each stage and what output crosses the boundary. That keeps orchestration from becoming an opaque block and makes it easier to inspect a surprising result.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Who should execute tools and own the loop?
Execution ownership is separate from the choice between direct and programmatic control flow. A user-defined client tool can connect to application-specific logic or internal APIs; a provider-defined or server-side tool can shift some execution responsibility to the provider. Compare the options against the responsibilities your product must retain.
| Decision | Client-executed tools | Provider or server-executed tools |
|---|---|---|
| Who runs the operation? | Your application or its services. | The provider may execute the tool and, in some patterns, multiple iterations. |
| Who continues after a result? | Your application interprets the result and controls the next turn. | The provider may own continuation for the server-side flow; confirm the behavior for the platform and tool in use. |
| Where do application-specific controls belong? | At the application’s execution and authorization boundary. | Wherever the platform exposes controls, while retaining any product-side checks needed before sensitive effects. |
The provider-side behavior in this comparison is documented as a platform pattern, not a promise that every provider offers the same execution modes. Confirm the actual contract for the API and tools you deploy. The key design test is whether you can identify, inspect, and recover the component that owns each consequential step.
Where should validation and human approval happen?
Separate automatic checks from decisions that require a person. Validate inputs before they reach a tool, validate arguments and returned data at the tool boundary, and inspect final output where appropriate. For an action with a sensitive side effect, put an approval pause before execution—not merely after the agent has already acted.
OpenAI’s guardrails and human review documentation describes an approval flow in which the run records an interruption and returns resumable state; a person can approve or reject the pending item, and the same run can then continue. This is a documented OpenAI Agents SDK pattern, not a universal interface. Use the equivalent mechanism available in your stack, or build an explicit pause-and-resume boundary if you own the loop.
Place checks at the component that can actually prevent the effect. OpenAI’s documentation cautions that input guardrails run only for the first agent, output guardrails only for the final-output agent, and tool guardrails only for tools to which they are attached. In a nested or manager-style workflow, a check on the outer agent is not a substitute for a check on the tool that changes a record, sends a message, or otherwise commits an action.
- Automatic validation: reject malformed inputs, enforce argument constraints, and check that tool results have the expected shape before they influence another step.
- Policy checks: verify that the requested operation is permitted for the user, resource, and context at the point of execution.
- Human review: pause before sensitive or consequential actions and make the pending operation clear enough to approve or reject.
- Recovery: record enough state to identify what was awaiting review and continue or stop deliberately after the decision.
As OpenAI’s documentation summarizes it, “Use guardrails for automatic checks and human review for approval decisions.” The distinction matters: a guardrail can detect or block conditions automatically, but it does not make an approval decision on a person’s behalf.
How do you handle prompt injection in tool workflows?
User messages and retrieved content can contain instructions designed to override the agent’s intended behavior. If that content flows into a later tool call, the result could expose private data or trigger an unintended action. Treat external and retrieved text as untrusted input, even when it appears inside a normal document or search result.
OpenAI’s agent safety guidance recommends keeping untrusted variables out of developer instructions, using structured outputs to constrain data flow, providing clear policy guidance and examples, enabling approvals for MCP actions, using input guardrails, and evaluating traces. These controls reduce risk; they do not guarantee an agent will never make a mistake or be tricked.
A practical defense-in-depth design combines those documented controls with least-privilege credentials and narrowly scoped tools. Least privilege is an implementation principle: give an agent only the access its task needs, and avoid broad credentials or operations when a limited capability will do. Then validate inputs and outputs, enforce policy at the side-effect boundary, require review for sensitive calls, and monitor traces so failures and unexpected behavior can be investigated.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should you measure before increasing autonomy?
Autonomy is not only a model setting. It also reflects the workload, the actions available to the agent, the amount of review users choose, and the safeguards around those actions. Start by distinguishing reversible, low-impact operations from calls that disclose data, alter important records, or affect another person. The appropriate approval policy depends on those consequences, not just on how capable a model appears.
In an analysis published February 18, 2026, Anthropic examined millions of human-agent interactions across Claude Code and its public API using the company’s privacy-preserving measurement approach. The findings describe Anthropic products and methodology; they are not universal adoption rates, performance benchmarks, or a forecast for other deployments. Anthropic’s autonomy analysis reports:
- Longest-running Claude Code sessions increased from under 25 minutes to over 45 minutes in three months.
- Roughly 20% of new-user sessions used full auto-approval, rising to over 40% among experienced users.
- Software engineering accounted for nearly 50% of agentic activity on Anthropic’s public API.
- On the most complex tasks, Claude Code asked for clarification more than twice as often as humans interrupted it.
Anthropic also wrote that “Most agent actions on our public API are low-risk and reversible.” That observation is specific to the company’s February 2026 analysis; it should not be generalized to another organization’s tools or risk profile. The article itself notes that defining and measuring agents is difficult and describes the analysis as an early step.
Use these findings as context for asking what your own traces show: which operations run without review, where the agent pauses to clarify, which failures require recovery, and whether users can understand what an approval would authorize. Measure those outcomes in your environment before broadening an agent’s access or removing review steps. The cited sources do not establish a universal cost, latency, or reliability threshold for doing so.
Quick Recap
A production checklist for tool-using agents
- Define the contract. Document each tool’s purpose, input shape, result shape, and which component executes it.
- Assign ownership. Decide who authorizes calls, validates results, handles retries and timeouts, records traces, and controls continuation.
- Choose the control-flow pattern. Use direct calls when fresh model judgment is needed; use bounded code orchestration for predictable processing and compact structured results.
- Put enforcement beside effects. Validate arguments and policy at the tool boundary, and pause for human review before sensitive operations execute.
- Constrain untrusted data. Keep retrieved content separate from developer instructions, use structured boundaries, and avoid granting tools broader access than the task needs.
- Design for interruption. Make pending work identifiable and ensure your execution model can stop, resume, reject, or recover intentionally.
- Review traces and adjust. Evaluate actual calls, approvals, errors, and recoveries in your workload before changing the agent’s autonomy.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
