Let agents act without double-charging anyone
Tool calls turn a language model into software that does things. We make them safe: validated inputs, idempotent actions, least privilege and a record of everything done.
How we approach it
Every action an agent can take is an API surface. We define each tool with a strict schema, validate arguments before execution and return structured results the model can act on.
Because models retry, repeat and misread, actions that change state carry idempotency keys and confirmations, so a repeated call does not create a second order or send a second email.
Read access first
Many agents deliver most of their value with read-only tools. We add write tools deliberately and one at a time.
- Tool errors returned in a form the agent can recover from.
- Rate limits and circuit breakers on external APIs.
- A test suite that exercises tools without calling a model.
Step by step
Define tools
Schemas with clear names, types and descriptions.
Authorise
Per-tool permissions tied to the user and the task.
Execute safely
Validation, idempotency and timeouts.
Record
An audit trail of calls and outcomes.
What you receive
Schema-first tools
Typed inputs and outputs, validated before running.
Idempotent writes
Keys and checks so retries are harmless.
Least privilege
Scoped credentials, never broad service accounts.
Approval steps
Human confirmation for high-impact actions.
Common questions
Which systems can agents connect to?
Anything with an API or a database interface: CRMs, ERPs, ticketing, payment and internal services.
What stops an agent calling the wrong tool?
Schema validation, per-tool permissions, and tests that cover tool selection on representative requests.
Can you use MCP?
Yes, where it fits. We can expose tools through the Model Context Protocol or direct function calling.
Scope your agent system with an engineer
Bring the process you want to automate. We will talk through the architecture, the risks and a realistic first release.