What this is
Sometimes reading is not enough. The need is rooms that are free on Tuesday, a live total from a system of record, or a form filled from a real row. Then the model has to stop talking, call a function that runs somewhere else, wait, and use the result in the next sentence. That is a tool call.
The same capability has been shipped as plugins, function calling, and custom APIs. The names differ. The job is the same: the model emits a call, something else runs, a result comes back.
Tool use is the model emitting a structured call to an external function, receiving a result, and continuing generation.
The capability predates any one protocol. Vendors shipped it as plugins, function calling, and bespoke APIs, each with a different schema.
Easy to mix up
This is easy to mix up with retrieval. A read-only tool — “what is on the calendar Tuesday?” — looks a lot like handing the model a fresh page. The difference is a function boundary: live data, permissions, a return value. Still no mutation.
A write tool uses the same interface. Send the email. Book the room. File the form. Treating a look-up and a write as the same thing is the usual mix-up.
A read-only tool is retrieval with a function boundary. Many demos stop here because the result looks like competence while remaining reversible.
Write tools have side effects. The call signature may look identical to a read. The difference is whether the callee mutates state. The interface does not advertise the difference; the authorization model has to.
From work
A scheduling assistant is asked to find an hour next week when three people are free. It calls the calendar, gets busy/free, and proposes two slots. That is a look. The calendar did not change.
The same assistant, with a different tool, can create the meeting. Same calm sentence in the chat. One of those sentences left an object on three calendars. Undoing it is a cancel, not a refresh.
Busy/free is a read. Event creation is a write. The utterances in the transcript can be similar; the authorization and the audit trail should not be.
Least privilege belongs on each tool, not on “the model.” A demo that only reads is a deliberate limit, not a reduced version of the same product.
What to ask next time
Which tools can it call, and which of those can change something? If the tool list is not available, the transcript is all there is to inspect.
Ask for the tool names, whether each is read or write, and where confirmation sits on irreversible calls. The transcript is not the authorization model.