When to reach for it
- External actions or data sources must be integrated in a controlled manner.
- Arguments need strict validation.
- Tool usage should be observable and bounded.
Function Calling.
Structured JSON in, typed function call out.
The model emits a structured call — a named function with typed, schema-validated arguments — that the harness executes, feeding the result back into the model's context; the model decides which function to call, when, and with what arguments.
In practiceA calendar assistant uses function calling to invoke a `create_event(title, start, end, attendees)` function with validated arguments, rather than generating a free-text API call the harness must parse.
When it backfires
- The task can be solved without external actions.
- The tool schema is unstable.
- Free text interaction is more appropriate.
The tradeoff
Structured control is gained at the expense of schema definition and integration effort.
What it actually does.
The model calls a typed function and reads its result.
Two ways this pattern will hurt you.
Schema drift breaks the contract silently
A tool's argument shape changes; the model keeps emitting the old shape; calls succeed parsing but execute with stale parameters.
Fix · Validate every argument payload against the current schema at the harness, before dispatch. Reject and surface the mismatch — never coerce.
Arguments that pass the schema but are fabricated
The model invents a plausible id, path, or amount that matches the type and validates cleanly — then the call executes against a record that never existed or the wrong one.
Fix · Validate arguments against real referents (existence and ownership checks), not just types; have the tool reject unknown ids rather than acting on a well-typed guess.
Threat exposure
What this pattern exposes
Adopting this pattern opens these attack surfaces. Each links to its entry in the threat model.
Full threat model →Where Function Calling is native.
Microsoft Agent Frameworkfunction toolsNative
Keep going