A team building a travel-booking agent wants it to be able to search flights and book a specific flight, but not to do anything else (such as issuing refunds or changing account settings). They implement this by giving the model only two tool definitions -- `search_flights` and `book_flight` -- each with a description and a schema describing its expected arguments, and no others. What does this achieve?
- It guarantees the model will never attempt to request an action outside the two defined tools, since a model literally cannot generate text describing an unlisted operation
- It scopes what the agent can be asked to do at the request-generation level: the model can only choose among the specific named, schema-defined tools it has been given, so issuing a refund or changing settings was never exposed as an option for it to request in the first place
- It removes the need for the calling application to check whether an incoming tool request actually matches one of the two defined tools before executing it
- It has no effect on what the agent can request, since a model can request any operation whether or not that operation was described to it
Why B? And why not the others?
Correct answer: B. It scopes what the agent can be asked to do at the request-generation level: the model can only choose among the specific named, schema-defined tools it has been given, so issuing a refund or changing settings was never exposed as an option for it to request in the first place
Exposing only a fixed set of named tools, each with its own description and input schema, is how an agent's available actions are scoped at the request level -- the model chooses from whatever list of tools it was given, so an operation like issuing a refund, which was never defined or described to it, was never presented as something it could ask for. This is a design-time restriction on what gets offered, not a guarantee about what the model will output. The option claiming the model literally cannot generate text describing an unlisted operation is wrong, because a model can still produce free-form text or even attempt a malformed request referencing something outside the defined set; scoping the tool list reduces the chance of this but the calling application still has to check what comes back. The option claiming the calling application no longer needs to verify incoming requests is wrong for the same reason -- a smaller tool list lowers risk but does not remove the need to validate that a request actually matches a defined tool before running anything. The option claiming the tool list has no effect on what the agent can request is wrong because restricting the exposed tools is precisely what constrains the space of actions the model is prompted to choose among.
Source: Anthropic, 'Tool use with Claude' documentation (platform.claude.com/docs/en/agents-and-tools/tool-use/overview), 'Define tools' entry: 'Specify tool schemas, write descriptions, and control when Claude calls your tools'