Halloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsWindows FixRecommendedWindows errors stealing your time? Find the fix fastScan stability, cleanup and performance issues.Fix NowHalloween DealsAmazon USOctober picks are moving - compare before checkoutAmazon US: current deals, useful picks and tech finds.See Picks×
FREEDOM251

Freedom251 › Blog › AI architecture

LLM Tool Calling: A Practical Three-Part Pattern for Decision Agents

By Freedom251 Team · · 10 min read

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.

For reliable decision agents, let the language model interpret the request and choose a next step, let ordinary application code perform calculations and side effects, then return the result to the model to explain or continue. The model can propose a tool call; it does not itself execute the function. Your application validates that request, checks permissions, runs the operation, and decides what happens next.

This division preserves natural-language flexibility without asking generated text to serve as a calculator, authorization system, or database transaction. It also gives the application a place to enforce limits, record decisions, and require human approval when an action could have a serious or irreversible effect.

As an Amazon Associate I earn from qualifying purchases.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What does “let the LLM talk, let a script do the math” mean?

It means assigning different jobs to the model and the software around it. The model interprets a user’s words, selects a suitable available tool, and prepares a structured request. Application code checks that request and performs the calculation, data lookup, or action. The result goes back to the model, which can explain it, request missing details, choose another tool, or finish.

Microsoft Learn describes the boundary directly: “LLMs can only generate tokens — they can’t browse the web, query a database, or call an API on their own.” A tool call is therefore an instruction for the application to act, not proof that the action has occurred. OpenAI’s Help Center similarly describes function calling as a way to connect models to external tools and systems.

#1 Best Overall
Sale
Nicpro Mechanical Carpenter Pencils for Construction (Black, Red) With Case | Deep Hole Marker Pencil Set Includes Sharpener and 26 Refills, Comfortable Grip, Heavy Duty Woodworking Tools for Architect
  • Valued Carpenter Pencil Set: You will get 2 pcs solid carpenter pencils with 26 piece 2.8 mm refills, 1 replaceable sharpener, 1 plastic storage box.The complete carpenter pencils combination allows you to finish your work faster and more easily
  • Deep Hole Marker Pencil: The deep-hole construction pencils adopts 45mm elongated tip design, which is more convenient to mark in the small hole or in other tight areas that other carpenter markers cannot reach
  • Carpenter Pencils with Sharpener: The sharpener is screwed into the top of the work pencil, which won't get lost either. Built-in pencil sharpener that keep the lead with pointed and smooth to Improves line of sight in fine work
  • Stronger Solid Lead: This work pencil is matched with a 2.8 mm thick lead , which is much thicker and stronger during the drawing process of construction work, it will not break or damage easily
  • Marks on Various Surfaces: 3 colors solid construction pencil can marks on various surfaces,such as metal, plastic, wood, paper etc. Ideals for woodworkers, contractors, craftsmen, builders, merchants and masons

The practical rule is simple: use the model where interpretation is valuable, and use deterministic code where correctness, authorization, or a real-world effect matters. For example, a model may interpret “How much would three items at 12 each cost?” as a request to calculate a total. Code should calculate 3 × 12 = 36; the model can then phrase the answer naturally. For an account change, the model may identify the requested operation, but code must verify the account, permissions, and action before changing anything.

How does the three-part pattern work?

The pattern is a controlled loop: interpret, execute, and respond. The application—not the model—owns the boundary between an intended action and an action that actually happens.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

1. The LLM interprets and proposes

The application provides the model with the user’s request and descriptions of the tools it may use. The model can produce a structured request with a tool name and arguments. That request is a proposal: it may be incomplete, malformed, outside the user’s authority, or simply the wrong choice.

For instance, a user might ask to find an order and then check whether it can be cancelled. The model can decide that it needs an order lookup first. It should not be trusted to invent a valid order identifier, assume cancellation is allowed, or claim it has completed a cancellation before the application reports that result.

2. Application code validates and executes

The application receives the proposed call and decides whether it is valid to run. It can verify that the tool exists, arguments match the expected types and allowed ranges, the user is authorized, and any required approval has been obtained. Only after those checks should it call the database, perform arithmetic, invoke an external API, or make another change.

This is where exact work belongs. A model can write a plausible number while making an arithmetic error; a deterministic function can compute a result from explicit inputs. Similarly, a model can suggest an operation, but code can enforce access rules and record whether the operation succeeded. AWS identifies computation, database lookups, and external APIs among the capabilities tools can provide.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

3. The result returns to the LLM

After execution, the application sends the model the result or a machine-readable error. The model can translate the result into a useful response, ask the user for a missing value, or request another tool if the task needs more than one step. If the goal is complete, it can stop.

This return step matters because a tool result is not the same thing as a user-facing explanation. The model can summarize what code found, but it should not alter the underlying result or describe an action as successful when the tool returned a failure. The application should preserve the distinction between a confirmed result, an error, and an operation that still needs approval.

Rank #2
Sale
DEWALT 20V MAX Drill and Impact Driver (DCK240C2) | Includes 2 Batteries, Charger and Bag (
  • Ergonomically Designed: Work in tight areas with a compact design that gets into tough spots
  • Both tools are designed to fit into difficult to reach spaces
  • Complete a wide range of applications with a high-performance motor that delivers up to 300 UWO, and an impact driver delivering up to 1,400 in-lbs of torque
  • Both the DEWALT impact driver and drill driver feature integrated LED work lights with a convenient 20-second delay, ensuring enhanced visibility in dimly lit or challenging work areas
  • One-Handed Loading - Keep one hand free with a 1/4 in. hex chuck that accepts 1 in. bit tips

Should an LLM calculate, or should it call a function?

Use a function for arithmetic or any transformation where an exact, repeatable answer matters. Let the model identify what calculation the user means and explain the returned result; let code perform the calculation using validated inputs.

Suppose a user asks for the total of four charges: 18, 27, 35, and 40. The model can extract the requested operation and provide the values to a calculation function. Code adds the values and returns 120. The model can report that total, but should not independently generate a competing total from prose. For a more consequential calculation, the function can also validate units, permitted ranges, rounding rules, and required inputs.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Not every conversational judgment can be reduced to arithmetic. The model can help interpret an ambiguous request or choose between tools based on their descriptions. But once the operation depends on exact data, defined rules, or a state change, deterministic code should establish what happened. If interpretation is uncertain, the safer next step is often to ask the user a clarifying question rather than silently guess.

Keep these jobs in code

  • Arithmetic and other exact transformations, including any required rounding rules.
  • Database lookups and external API requests.
  • Schema and argument validation, including required fields and allowed ranges.
  • Authorization checks and decisions about whether an operation is permitted.
  • State changes, such as creating, updating, or deleting a record.
  • Idempotency and duplicate-action protection where repeated requests could have effects.

How do I stop an agent from hallucinating numbers or claiming an action succeeded?

Do not rely on the model’s confidence or wording as a correctness check. Make important numbers and action outcomes come from validated tool results, then constrain what the model can do with those results.

For numbers, have code compute from explicit inputs and return the result in a defined format. Keep the inputs and the calculation’s meaning clear—for example, distinguish a quantity from a price, or specify whether a result is rounded. The model can communicate the returned value, but the application should not accept an unsupported number merely because it sounds plausible.

For actions, return an explicit status from the execution layer. A successful response, a rejected request, a pending approval, and a timeout are not interchangeable. If the action failed, the model should explain that failure or ask what to do next rather than narrating the intended action as completed. A tool result also should not grant authority that the user or application has not granted.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Structured schemas help prevent malformed requests, but they do not prove that an argument is factually correct or that a user has permission to use it. Microsoft warns that models can select the wrong tool or provide wrong arguments, which is why validation and guardrails remain necessary. OpenAI documents strict schema enforcement as a way to improve adherence to supplied schemas; schema adherence is one control, not a substitute for application-side checks.

How should I define and validate tools?

Give each tool a narrow purpose and a schema that describes the arguments it accepts. A focused tool is easier to validate and audit than a broad tool that can make many unrelated decisions. For example, a read-only lookup and a record-changing operation should be treated as different capabilities with different checks.

Rank #3
Sale
Push to Unlock,Katerk 6pcs 1/4 inch Hex Shank Aluminum Alloy Screwdriver Bit Holder Light-Weight Quick-Change Extension Bar Keychain Drill Screw Adapter Portable,Black Carabiner,Tool Gifts for Men
  • 【Great Compatibility】This Katerk 1/4 inch hex shank bit holder is specifically designed for 1/4 inch hex shank drill bits. It's compatible with most 1/4 fast hex handles, hex sockets, various electric screwdrivers, and handheld screwdrivers. The bit holder makes it a valuable addition for any handyman.
  • 【Secure and Safe】Built with a secure backup nut design, each drill bit holder securely locks onto your bits, ensuring they stay firmly in place. Additionally, our bit holder incorporates a high-quality steel ball rolling design that holds up to several kilograms of weight, ensuring your various drill bits don't fall off.
  • 【Easy One-Handed Operation】The bit holder for impact driver allows you to change bits single-handedly, simplifying your workflow. Its multi-color design further allows for quick identification of the drill bit you need.
  • 【Compact and Convenient】Thanks to its compact size, this 1/4 inch bit holder is easy to carry around. The bit holder allows for easy attachment to various tools, making this a convenient addition to your construction accessories. The Katerk bit holder is cast from high-quality alloy material, promising a long product lifespan. Despite its rugged strength, the bit holder remains lightweight, making it portable.
  • 【Cool Christmas Gift For Men Stocking Stuffers】 This screwdriver bit holder, driver bit holder, impact bit holder, can be given as a gift to your loved one, especially for anyone involved in construction or electrical work. It's a must-have for stocking stuffers for men and women, tools gifts for dad, tech gadgets for men, gifts for dad, gifts for him, gifts for husband, gifts for boyfriend, cool gadgets for men, and cool gifts for dad.

Before execution, validate the request in code. Check that the requested tool is available; required fields are present; values have the correct types and fall within allowed ranges; and the user is authorized for the specific operation. Where the operation can be repeated, decide how to prevent an accidental duplicate. A well-formed request can still target the wrong account, use an incorrect value, or attempt an action the user cannot perform.

Return machine-readable errors where possible. A useful error can tell the model whether a required field is missing, an argument is invalid, the user lacks permission, or the operation failed. That gives the model a chance to ask a relevant question or explain the issue. Avoid turning errors into vague success-like text, and do not expose sensitive implementation details unnecessarily.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Set explicit limits for retries, timeouts, and the maximum number of steps in a workflow. Without those bounds, an adaptive agent could keep calling tools after an error or continue a task long after the user’s goal has been met. Logging the tool name, validated arguments, result status, and approval events helps operators understand what the application actually did.

When should I use a deterministic chain, a single agent, or multiple agents?

Choose the least complex design that can handle the task. A fixed chain is easiest to predict and audit; a single agent can adapt its tool choices within a domain; multiple agents can divide a broad problem into specialties but add coordination and debugging work.

Design How it works Predictability and auditability Flexibility Operational trade-off
Deterministic chain Code fixes the sequence of model and tool calls. Highest of the three: the path is defined in advance and is easier to inspect. Lower; it is best when the task has a well-defined flow. Typically easiest to test and debug. Microsoft describes this as the most predictable and auditable option for well-defined tasks.
Single agent The model chooses among available tools and may decide whether another step is needed. Less predictable than a fixed chain; controls are needed for incorrect or repeated calls. More adaptive within a domain, without the coordination overhead of multiple agents. Requires limits and monitoring around tool use, retries, and stopping.
Multi-agent system Several specialized agents coordinate across domains or contexts. More moving parts make tracing decisions and failures harder. Can modularize a larger system across specialties. Orchestration, tracing, testing, and debugging become more complex.

Latency and cost depend on the particular models, tools, and workflow; the cited guidance does not establish a universal numeric comparison. In general, extra model turns and coordination create more work for the system, so measure the actual workflow rather than assuming that a more elaborate architecture will be faster or cheaper.

Use a chain when the path is known

A fixed chain fits tasks whose order is stable: gather required inputs, call a specified tool, validate the result, and present it. Code can make the sequence explicit and prevent the model from choosing unnecessary tools. This is useful when consistency and auditability matter more than open-ended tool selection.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Use one agent when requests vary

A single agent can select different tools or take another step based on the current result. That is useful when the user’s request varies but remains within a bounded domain. The application still needs to restrict available tools, validate every call, and set a clear stopping condition.

Use multiple agents only when specialization warrants it

Several agents may help organize work across distinct domains or contexts. The trade-off is more coordination: it can become harder to see which component made a decision, where a failure began, and whether two agents are acting on conflicting assumptions. Keep each role and its allowed actions explicit, and test the end-to-end workflow rather than only the individual agents.

Rank #4
Sale
2 Pack Carpenter Pencils Mechanical Pencils with 12 Refills, (2 Colors) | Construction Pencils with Built-in Sharpener, Long Nib Deep Hole Pencil Marker, Heavy Duty Woodworking Pencil for Architect
  • Long Nib and Deep Hole Marker: Our mechanical carpenter pencil with 45mm nib is designed for easy marking of deep holes or narrow areas. These construction pencils are the great choice for woodworking tools, construction tools, carpenter tools, contractor tools, wood carpentry tools and architect tools
  • Extra Refills in 2 Colors for Versatile Marking: The construction mechanical pencil comes with 12 extra 2.8mm refills, including 6 red and 6 black refills. The black refill is suitable for light surfaces, while the red wax is perfect for dark surfaces. Our carpenter mechanical pencil makes sure that you'll have an ample supply for extended use
  • Built-in Sharpener: Our construction pencil comes with a built-in sharpener to ensure the mechanical pencil tip is always sharp and ready for use. Never buy an extra pencil sharpener again. A great tool for any woodworker pencil, contractor pencils. The refill can easily be extended or retracted with a simple click of the pencils mechanical, allowing you to work more efficiently and accurately
  • Portable Clip Design: Our deep hole construction pencil features a portable clip design, easy to carry and attach to your pocket or tool box, so that you can keep the carpenter pencils mechanical close at hand, making it a convenient tool to have on the go. Great gifts choice for carpenters
  • Stronger Pencil Lead: The black refills are made of lead, sturdy and smooth. The red refills are made of wax, clear and light. These marking pencils are much thicker and stronger than normal pencils during the marking process of construction work, suitable for various surfaces, such as glasses, metal, boards, floors, walls, furniture, etc. The written marks can be easily wiped with a wet paper towel when needed
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

How do I make an LLM workflow auditable and safer?

Make the application’s decisions observable: record what was proposed, what passed validation, what actually ran, and whether approval was required. An audit trail should describe execution, not merely repeat the model’s final explanation.

  • Keep tool permissions narrow. Expose only the capabilities needed for the task, and check authorization in code for each operation.
  • Separate reading from changing data. A lookup should not silently carry the power to modify or delete the information it returns.
  • Require approval for consequential actions. Put a human confirmation step before irreversible or high-impact operations.
  • Bound the loop. Set timeouts, retry limits, and a maximum number of steps, with a defined outcome when a limit is reached.
  • Log execution evidence. Capture the tool name, validated arguments, result status, and approval events in a way that supports review.
  • Test failure cases. Check malformed arguments, missing information, denied permissions, tool failures, repeated calls, and approval-required actions—not just the happy path.

Strict schema enforcement, when supported, can make tool arguments conform more reliably to a supplied structure. It cannot establish that the model chose the right tool, that a value is true, or that the user is authorized. Those checks belong in the application and operational controls around it.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What is the safest way to choose an architecture?

Start with a deterministic chain for a stable, well-defined task. Move to a single agent only when useful variation in tool choice or workflow justifies the added control burden. Consider multiple agents when there is a real need to divide distinct domains or contexts—not simply because the system can be made more elaborate.

Whichever design you choose, keep the core division intact: the model interprets and communicates; code validates and executes. That boundary is what makes flexible language interaction compatible with exact calculations, governed access, and reviewable actions.

Frequently Asked Questions

Can an LLM use a calculator without a tool call?

A model can generate arithmetic in its text, but that is not the same as executing a calculator function or guaranteeing the answer. If the result must be exact, have the application run a calculation and return its output.

Does strict function calling make an agent safe?

No. A schema can constrain the shape of arguments, but it does not decide whether a request is authorized, appropriate, or based on correct information. Keep permission checks and action controls in application code.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Should tool errors be shown directly to the user?

Return an error in a form the workflow can interpret, then present a clear explanation suited to the user. Avoid exposing secrets or internal implementation details in the user-facing response.

What should I test before putting an agent into production?

Test cases where arguments are missing or invalid, access is denied, a tool times out, a call might be repeated, or approval is required. Also verify that the system stops at its configured step limit and does not report a failed action as successful.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

AI architecturefunction callingLLM agentssoftware engineeringtool calling

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Recommended PC Tool
Recommended PC Tool
Outdated Drivers Are Slowing You DownFree scan - exact matches
PC Slower Than It Used to Be?Free scan - under a minute

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.