18.4 The external programme may carry out an action

Content and key concepts

On the previous page, what the model actually saw.
The model may offer a challenge, but the application checks the name and arguments. The document does not have the right to allow new actions.
The search selects fragments; the beilder adds them to the question. The memory, history and tool results have different sources. The right of action checks the program, and the cycle has to have a reason for stopping.
Для изменения рисунка включитеJavaScript; расчёт и теория доступны далее.
Model offers data, exec makes the decision.
Tool call is a structured proposal to call for a called operation. Exector checks allowlist, schema, types, ranges, autochorization, timeout and output size
up to
Side effect. JSON, generated by the model, remains untrustworthy input. F14.
For pure tool
add(a,b)
The contract can be written down as a partial function: only an object with precise keys and final numbers transitions to result.
bool
is subtype
int
so the validator must reject it separately if the schema requires a number, but not a boolean.
E
(
n
a
m
e
,
a
r
g
s
)
=
{
a
r
g
s
.
a
+
a
r
g
s
.
b
,
n
a
m
e
=
add
∧
a
r
g
s
⊨
s
c
h
e
m
a
e
r
r
o
r
,
иначе
.
E(name,args)=
\begin{cases}
args.a+args.b,&name=\texttt{add}\land args\models schema\\
error,&\text{иначе}.
\end{cases}
E
(
nam
e
,
a
r
g
s
)
=
{
a
r
g
s
.
a
+
a
r
g
s
.
b
,
error
,
​
nam
e
=
add
∧
a
r
g
s
⊨
sc
h
e
ma
other
.
​
That's what the model shows.
Trace divides the model output, parser, validator, authorization, excultion and observation. The error tool returns as a typed result, rather than masked by a fictional success. Recording operations receive idempotency key, conference and audit; read-only and writ missions do not mix.
Scope of applicability.
Schema validation does not prevent a harmful but technically correct command. Tools can return prompt injection or secrets. You cannot give the Shell/network/filesystem models by default; sandbox, past priority, rate limit and human improv are defined by the system's model.
call_18d={'name':'add','arguments':{'a':2,'b':3}}
args_18d=call_18d.get('arguments',{})
valid_18d=(call_18d.get('name')=='add' and set(args_18d)=={'a','b'} and
all(isinstance(args_18d[k],(int,float)) and not isinstance(args_18d[k],bool) for k in ('a','b')))
result_18d=args_18d['a']+args_18d['b'] if valid_18d else None
assert valid_18d and result_18d==5
The code repeats the operations just taken care of.
Completely checked Python-example Chapter
Available with a separate file; the short piece shown does not replace its implementation.
The text may offer an action, but authority is runtime.
Recording an application is not equal to the weight of the model. How does this question continue?
Python examples of Chapter 18
Academic base