The model requests, your code executes
It's easy to talk about an agent 'using a tool' as if the model reaches out and does something in the world. It doesn't. A model has no hands. When a model decides it wants to check a database or send an email, all it actually does is output structured text, typically JSON, naming a function and filling in arguments, exactly the way it would output any other token sequence. It is still just predicting text. The gap between that structured request and anything real happening is entirely bridged by your code: your program parses the request, decides whether to honor it, and if so, calls the actual API, database, or system function. Only then does anything happen in the world.
This distinction matters because it reframes what 'tool use' really is engineering-wise. You aren't granting the model capabilities, you're building an interpreter that reads the model's requests and chooses how to act on them. The model's output is a proposal, not a command. That means every tool call passes through code you wrote and control, which is exactly where the next two responsibilities, precise tool descriptions and argument validation, live.