Tool calling
A model’s structured request, usually JSON that matches a declared schema, asking the application to run a named function with arguments. The application executes it, so it must validate the arguments and authorize the action as the user rather than trusting the model’s choice.
- Also called
- tool call · function calling
Covered in
Authorize agent tools outside the model
Bind each proposed action to the user, resource and approved arguments before allowing a tool to cause a side effect.
Red-team LLM applications and agents by their effects
A red-teaming method for LLM features and agents: scope the whole system, map attacks to OWASP and MITRE ATLAS identifiers, score trials from observed effects, report rates with confidence intervals and retest on every model or provider change.
Worked threat model: an LLM agent with tools
A complete worked threat model for an LLM agent with tools: the data-flow diagram, the threats from prompt injection, excessive agency, data exfiltration, confused-deputy and memory poisoning, and the mitigations, mapped to the OWASP Top 10 for LLM Applications 2026 and the OWASP Top 10 for Agentic Applications 2026.
Contain LLM misinformation (OWASP LLM07:2026)
Stop plausible but wrong model output from driving decisions and actions: ground answers in sources, verify every citation, separate generation from execution with a claim-check-act pattern, gate consequential actions on a human, and evaluate factuality on your own domain.
Practice: Excessive agency lab: Bind an agent’s action to the approved arguments · Local project: Enforce retrieval and tool boundaries across crashes · Local project: Gate model and provider changes on a versioned red-team corpus