Function calling lets an LLM request a tool using a structured name and arguments. For an application-defined tool, your application receives that request, decides whether to execute it, and returns the result for the model to use.
A complete call without magic
Imagine a delivery assistant with a tool named get_order_status, which accepts an order_id. A customer asks where order A123 is.
- The application supplies the conversation and the tool’s description and parameter schema to the model.
- The model requests
get_order_statuswithorder_idset toA123. - The application validates the request and checks that the signed-in customer may access that order.
- The application queries the order system and returns its result as a tool response.
- The model uses that response to explain the status to the customer.
These are separate operations. Generating well-formed arguments does not itself run your function or prove that its input is authorized. Some providers also offer hosted tools whose execution they manage; that is a different execution arrangement.
What the schema can and cannot do
A schema can describe required fields, types, and allowed values. Depending on the API and mode, constrained generation can help enforce that structure. It cannot establish that an order belongs to the current user, that a quoted price is still valid, or that a payment should be approved. Those checks require application state and policy.
Tool descriptions should make the available operations and their limits clear. Separate reading an order from changing it. Give errors a form the model can understand, and avoid retrying an action blindly if it might already have succeeded.
Why this becomes an agent loop
One result may lead to another request: look up an order, then look up its shipment. Repeating the model-request-execution-result cycle forms an agent loop. The application still needs limits, permissions, and a stopping condition.
Tool output is evidence to interpret, not automatic authority over the rest of the system. Retrieved text can be wrong or contain instructions that the assistant should not follow.
Read further: Anthropic’s tool-use overview. For a different calling pattern, see programmatic tool calling.