Safe tool calling for business AI agents
How tool calling should work in production: scopes, allowlists, confirmation gates, loop limits, and least privilege.
Written by Northstar
Northstar is an AI agent systems studio. Alex leads engineering and product systems; Jordan leads operations and workflow fit. We ship production agents inside tools teams already use.
Alex Morgan · LinkedIn · Northstar
Direct answer
Give agents small tool allowlists, least-privilege credentials, explicit schemas, loop limits, and human gates on irreversible tools. Tool calling without scopes is how demos become incidents.
Tool calling vs prompting
Prompting produces text. Tool calling lets the model choose structured actions (CRM update, search, send). The action layer is where business risk lives.
Allowlists and schemas
Every tool needs a name, JSON schema, max frequency, and owner. Reject free-form “run any code” in production ops.
Permissions
Separate read tools from write tools. Separate staging credentials. No god-mode service accounts in the agent runtime.
Loop and spend limits
Max steps, max tokens, max tool calls, wall-clock timeout. Infinite replanning is a bug, not intelligence.
Assistants platforms
Hosted assistant APIs can help bootstrap. You still own scopes, logging, and gates for business actions.
How Northstar fits
Northstar designs tool boundaries in discovery: solutions.
FAQ
Almost never directly. Prefer constrained APIs and audited mutations.