How to Give an AI Agent Tools with Function Calling
You give an AI agent tools through function calling: you describe each capability as a function with a name, a short purpose, and a typed schema of its inputs, and you make that list available to the model. The model never runs anything itself. When a task needs a tool, it responds not with prose but with a structured request naming the function and the arguments to use. Your code validates that request, executes the real function (a database query, an API call, a calculation), and returns the result back into the conversation. The model reads the result and decides the next step. That loop, describe, let the model request, execute, return, repeats until the job is done. Tools are what turn a chatbot that can only talk into an agent that can act.
I'm Mahmoud Zalt, an AI architect. Through Sista AI I help teams wire agents into real systems so they can act, not just talk.
The Function-Calling Loop, Step by Step
Under the hood, every tool-using agent runs the same cycle. Seeing it explicitly is the fastest way to demystify agents.
- Declare the tools. Send the model a list of available functions, each with a name, a plain description of when to use it, and a schema describing its parameters and their types.
- Send the task. The user request goes to the model alongside those tool declarations.
- Model requests a call. Instead of answering, the model returns a structured object that says 'call this function with these arguments.' This is a request, not an execution.
- You execute. Your code parses the request, validates the arguments, and runs the actual function on your side, where your keys, permissions, and data live.
- Return the result. You append the function's output to the conversation and call the model again.
- Model continues or finishes. It reads the result and either requests another tool, or writes the final answer.
The single most important thing to internalize: the model only ever asks. Nothing runs unless your code chooses to run it. That boundary is where all of your control and all of your safety live.
Designing Tools the Model Can Actually Use
Tool quality decides agent reliability far more than model choice. A model calls tools well when the tools are described well. A few principles that consistently pay off:
- Name and describe by intent. The description is a prompt. 'Look up a customer by email and return their plan and status' beats a terse 'getCustomer.' The model chooses tools from these words.
- Make the schema strict. Mark required fields, constrain types, and use enumerations for fixed choices. A tight schema turns a class of bad calls into impossible calls.
- Keep each tool focused. Prefer a few clear tools over one giant tool with a mode flag. Narrow tools are easier for the model to pick correctly and easier for you to secure.
- Return clean, structured results. Hand back concise, predictable output. If a call fails, return a clear error message the model can reason about rather than a raw stack trace.
- Mind the token budget. Every tool declaration sits in the context window. Expose the tools a task needs, not your entire API surface.
A reliable rule of thumb: if a new engineer could not use your tool correctly from its description and schema alone, the model will struggle too.
Errors, Safety, and the Human in the Loop
The moment an agent can act, tools become your security boundary, because a tool call is real code touching real systems. Treat every argument the model produces as untrusted input, the same way you would treat input from a user.
- Validate before executing. Re-check arguments against your schema and your business rules in code. Never pass model output straight into a shell, a query, or a file path.
- Enforce permissions on your side. Scope what each tool can reach. The model requesting a delete does not mean the delete should happen; authorization is your job, not the model's.
- Gate irreversible actions. For anything costly or hard to undo, sending money, deleting data, emailing customers, require an explicit human approval step before the tool runs.
- Handle failure as normal. Tools time out and APIs error. Return a clean failure the model can respond to, and cap retries so a confused agent cannot loop forever.
Frequently Asked Questions
What is function calling in AI agents?
Function calling is the mechanism that lets a model request a specific function with structured arguments instead of replying in prose. Your code then runs that function and feeds the result back. It is how an agent connects to real actions like database queries, API calls, and calculations.
Does the AI model run my code itself?
No. The model only produces a structured request that names a function and its arguments. Your code decides whether and how to execute it. That separation is what keeps you in control of permissions, validation, and anything irreversible.
How many tools should an agent have?
As few as the task needs. Every tool declaration consumes context and gives the model one more thing to choose wrong. Expose a focused set per task rather than your whole API, and split large tools into narrow, well-described ones.
How do I stop an agent from calling a tool incorrectly?
Write intent-rich descriptions, use strict schemas with required fields and enumerations, and validate every argument in your own code before executing. For risky actions, add a human approval step so a wrong call is caught before it does anything.
Turn a Model Into an Agent That Acts
Adding tools is the step that changes a language model into something that does real work, and it is mostly an exercise in disciplined engineering: clear tool descriptions, strict schemas, honest error handling, and a firm boundary where your code, not the model, decides what actually runs.
If you want to build a tool-using agent end to end, with function calling, validation, and human-in-the-loop approval wired to your own systems, that is hands-on ground in my AI Agents for Engineers masterclass, along with agent architecture, memory and retrieval, orchestration, and evals. Sessions are always private, one-on-one or with your team, starting at $120 for a single technical session, $420 for a four-session Engineering track, or $780 for a private team workshop.
Build a tool-using agent in the AI Agents for Engineers masterclass
