The Common Kinds of Tools
Most agents, whatever their job, are assembled from the same handful of tool families. Tripmate uses nearly all of them: it searches the web for festival dates, calls a railway API, queries its own bookings database, runs a little code to compare fares, saves a PDF itinerary, and messages Asha. Knowing the families — and how risky each is — lets you design a toolset quickly and safely.
The rule
Sort every tool by what it can change: nothing, your data, or the world.
The common families:
- Web search — finds fresh public information the model was not trained on. Results can be wrong or even contain hostile instructions, so treat them as untrusted text.
- Code execution (a REPL) — lets the model write and run code for exact arithmetic, data wrangling or charts. Powerful, so it must run in a sandbox with no access to secrets.
- Database queries — read (and sometimes write) structured records. Prefer read-only access and fixed, parameterised queries over letting the model write free-form SQL against production.
- API requests — call other services: timetables, weather, payments. Each carries that service's permissions and costs.
- Messaging (email, Slack, SMS) — reach people. Once a message is sent it cannot be unsent.
- File system access — read and write files. Limit it to one working folder.
Now sort them by consequence:
reads only web search, get_weather, read-only DB query, read file
changes yours write file in a work folder, save a draft, update a record
changes world send_email, send_sms, book_ticket, payments, deleting dataThe shortcut
For each tool ask: "If the model called this by mistake, what would it cost to undo?" Nothing → let it run freely. Some cleanup → log it and limit it. Impossible or expensive → require a human confirmation.
Reads only
web_search,search_trains,get_weather,read_calendar. Mistakes cost only tokens: run freely.
The trap is giving an agent one broad tool — "run any shell command" or "execute any SQL" — because it is quick to build. Broad tools make every mistake, and every attack, as damaging as possible. Narrow tools make the risk visible and controllable.
Drills
Answer fast — trust the rule.
Which tool changes the world outside the agent's own data?
Why is a code-execution tool usually run in a sandbox?
Which database access is safest for Tripmate's "show my bookings" feature?
How should Tripmate treat text returned by a web search?
Remember
- Sort every tool by what it can change: nothing, your data, or the world.
- Shortcut: "What would a mistaken call cost to undo?" — that sets the level of control.
- Trap: one broad tool (any shell command, any SQL) instead of narrow, specific ones.