The model proposes. Your application decides.

Responsible execution and tool permissions

Rules for any tool your application exposes.

The gateway never executes tools

Tool calls are returned to your application as untrusted data. Neither the gateway nor the SDKs can run them, and the runtime's built-in tools are switched off.

Your application decides

Only your code can run a tool, and only after its own permission checks.

Allow-lists

Expose only the tools a task needs, and reject any call to a tool that is not on the list.

Schema validation

Validate every argument against the tool's schema before use; reject malformed or unexpected arguments rather than repairing them.

User confirmation

Ask the user to confirm any action that changes data, spends money, sends a message or cannot be undone.

Least privilege

Run tools with the narrowest permissions and data access that the task requires.

Payments, refunds, access control and safety-critical actions must never be authorised by generated output alone.

WEATHER_SCHEMA = {"type": "object", "properties": {"city": {"type": "string"}},
                  "required": ["city"], "additionalProperties": False}
weather = Tool("get_weather", "Current weather for a city", WEATHER_SCHEMA)
ALLOWED = {"get_weather"}                        # your allow-list

r = client.chat(history, tools=[weather])
for call in r.tool_calls:                        # model output: untrusted
    if call.name not in ALLOWED:
        continue                                 # reject tools not on the list
    args = call.parse_arguments()                # invalid JSON raises ValueError
    validate(args, WEATHER_SCHEMA)               # your schema check
    if not user_confirms(call.name, args):       # your confirmation step
        continue
    result = my_weather_lookup(args["city"])     # YOUR code runs the tool