The moment Maya asks, "How much leave do I have?", the document assistant reaches its limit. The policy can explain the rule. Today's balance lives in the HR system. That is where a tool becomes useful: the model can propose a structured call, while the application decides whether that call is allowed.
Expose get_my_leave_balance() rather than a general database query. The backend should derive the employee identifier from trusted identity, not from a name supplied by the model. If managers need team access, expose a separately authorized operation and verify the employee-manager relationship when the operation executes.
An HR interaction. Maya asks for one day off on 18 September 2026. The mock HR service returns 4.5 available days with an as-of timestamp. The application checks the working calendar, notice requirement, overlapping requests and policy version. If the date is ambiguous, it resolves that ambiguity before preparing an action.
The review screen should state the employee, date, leave type, amount and intended operation: submit a request for manager approval. Maya confirms those details. The server checks permission and relevant state again, then performs the write. The response includes a request identifier and “pending manager approval.” Submission succeeded, but approval did not.
| Control | What it prevents |
|---|---|
| Server-side identity and record authorization | A model-supplied employee ID accessing someone else's record |
| Typed arguments and allowed values | Invalid dates, unexpected fields or a different operation |
| Approval bound to the exact action | A changed date or recipient being executed under an earlier confirmation |
| Idempotency key and status lookup | A timeout followed by a retry creating duplicate requests |
| Execution receipt and audit record | A generated success message being mistaken for a completed write |
Authorization and approval answer different questions. Authorization asks whether the actor may perform the operation at all. Approval asks whether this particular permitted action is intended. A production design needs both where the consequence requires them.
Read tools deserve the same scrutiny as write tools. A bulk export can expose more than a small write can change. Classify a tool by the data it can reveal and the business impact it can create. Keep credentials outside model context and give the tool service only the authority it needs.