Expose narrow tools with typed arguments, clear descriptions, and limited authority. The model can choose a tool, but application code must validate input and enforce permissions.
Separate read-only actions from consequential writes. Require confirmation for messages, purchases, or deletion. Trace tool choice, errors, and retries so evaluation can inspect the whole run rather than only the final sentence.