Tool calling: System design

Separates model proposals from runtime authorization: approvals bind high-impact actions, while idempotency only prevents duplicate execution and never grants permission.

Published Sep 12, 2026