Safe tool calling for business AI agents
How tool calling should work in production: scopes, allowlists, confirmation gates, loop limits, and least privilege.
Written by Dali
Dali is an AI agent systems studio. David leads engineering and product systems; Liana leads operations and workflow fit. We ship production agents inside tools teams already use.
David Hakobyan · Dali
Direct answer
Give agents small tool allowlists, least-privilege credentials, explicit schemas, loop limits, and human gates on irreversible tools. Tool calling without scopes is how demos become incidents.
Tool calling vs prompting
Prompting produces text. Tool calling lets the model choose structured actions (CRM update, search, send). The action layer is where business risk lives.
Allowlists and schemas
Every tool needs a name, JSON schema, max frequency, and owner. Reject free-form “run any code” in production ops.
Permissions
Separate read tools from write tools. Separate staging credentials. No god-mode service accounts in the agent runtime.
Loop and spend limits
Max steps, max tokens, max tool calls, wall-clock timeout. Infinite replanning is a bug, not intelligence.
Assistants platforms
Hosted assistant APIs can help bootstrap. You still own scopes, logging, and gates for business actions.
How Dali fits
Dali designs tool boundaries in discovery: solutions.
FAQ
Almost never directly. Prefer constrained APIs and audited mutations.