Use tools with a permission boundary

Some local models can request tools.

You describe a function and its parameters. The model may return a tool call instead of a final answer. Your application decides whether to execute it.

That last sentence is the security boundary.

The model does not gain permission because it produced valid JSON. Validate the tool name and arguments, authorize the operation for the current user, apply limits, and ask for confirmation before an irreversible action.

A safe loop looks like this:

model proposes call
       |
       v
validate -> authorize -> confirm if needed -> execute
       |
       v
return narrow result to model

Start with read-only tools. A function that returns today’s activity is easier to contain than one that deletes files or sends messages.

Tool output is also untrusted data. A document or web result cannot grant itself new permissions by telling the model to ignore your rules.