Context / Tools / Evals / Safety / 04
Retrieval, tools, and agents
Ground answers, constrain actions, design permissions, and separate planning from consequential execution.
Before you begin
By the end, you can…
- Separate retrieval from generation
- Constrain tool authority
- Require confirmation for consequential actions
01 / Understand
Grounding and action are different systems
Retrieval selects evidence; generation synthesizes an answer. Evaluate both: did retrieval find the right sources, and did the answer stay faithful to them? A fluent answer cannot repair missing evidence.
Tools let a model read data or perform actions. Each tool needs a narrow purpose, schema, permission check, timeout, error policy, and observable trace.
02 / Apply
Design the authority boundary
Use least privilege and separate read from write tools. Show a preview before sending, deleting, purchasing, or publishing. Confirmation must describe the exact action and target.
Treat tool results as untrusted data. Prevent retrieved text from changing permissions or bypassing confirmation. Idempotency and undo reduce damage from retries.
03 / Make
Your studio task
Make — Design one tool call with a narrow schema, permission boundary, preview, and confirmation step.
- Draw retrieval, generation, tool, permission, and confirmation boundaries.
- Define one narrow tool schema and validation rules.
- Add preview and explicit confirmation for writes.
- Test prompt injection, duplicate calls, timeout, partial failure, and undo.
Untrusted content cannot silently expand authority or trigger an irreversible action.
04 / Check