Learn · Explained
What are tools for an AI agent, and which does it need?
Published 31 October 2026
Short answer. A tool is a function an AI agent can call to get its job done: read the ledger, look up a supplier, search documents, create a draft entry. The model only asks for the tool; the code around the model runs it, with the agent’s own limited access, and sends the result back. A finance agent starts with tools that read, then gets tools that draft. Posting, paying and sending stay with people until the company decides otherwise.
This guide explains what a tool looks like, how an agent uses one, which tools a finance agent starts with, and what keeps each tool within its job.
A tool is one function with one use
A function is a small piece of software that does one thing when it is called: it takes a few fields, does its work, and returns a result. A tool is a function that an agent is allowed to call. Each tool has a name, a short description of what it does, and the fields it needs, such as a supplier name or a date range (OpenAI: Function calling).
One system usually offers several tools, each with its own use:
| Tool | What it does | Reads or changes |
|---|---|---|
| Look up entries | Returns the entries on an account for a period | Reads |
| Find a supplier | Returns a supplier’s details and open invoices | Reads |
| Search documents | Finds the invoice, receipt or contract that matches a search | Reads |
| Create a draft entry | Puts a proposed entry, with its document, into the accounting system as a draft | Changes: adds a draft |
| Write a draft email | Saves an email for the operator to review and send | Changes: adds a draft |
Read more in the dictionary: Tools and Function calling.
How an agent uses a tool
Anthropic and OpenAI describe the same round trip (Anthropic: Tool use with Claude; OpenAI: Function calling):
- The application lists the tools. With each task, the code around the model tells the model which tools it may use, and what each one does.
- The model asks for a tool. When it needs data or an action, the model answers with a tool call: the tool’s name and the fields filled in.
- The code runs the tool. The application, not the model, carries out the call, using the agent’s own access.
- The result goes back. The application sends the tool’s result to the model.
- The model continues. It calls another tool, or finishes the step and answers.
The model never runs anything itself. It can only ask for the tools it was given, and the code decides what happens with each request. That is why limits placed in the code and in the agent’s access hold, whatever the model asks for.
The tools a finance agent starts with
A finance agent starts with tools that read, then gets tools that draft. A step is automated only after it has proved reliable.
| Tools that read | Tools that draft | Not given to begin with |
|---|---|---|
| Look up entries and balances | Create a draft entry, with its document | Post or book an entry |
| Find a supplier or customer | Write a draft email or reminder | Pay, approve or release a payment |
| Search invoices, receipts and contracts | Prepare a reconciliation for review | Delete or change a booked record |
| Read the company dictionary and the agent’s rules | Add a note to the agent’s own records | Change supplier bank details |
| Send anything outside the company |
The right-hand column is the agent’s guardrails, and each one is enforced outside the model. What are guardrails for an AI agent, and who enforces them?
Whether a step later moves from a draft to the agent posting it is decided step by step with the three sign-off zones: “acts alone”, “asks first”, or “the operator signs off”. When may an AI agent act on its own?
This list is a starting point; every job has its own.
Fewer, narrower tools are safer
Every tool an agent has is something it can do when it is wrong, or when text it reads has misled it. The security guidance for AI applications from OWASP therefore recommends giving an agent only the tools its job needs, giving each tool only the functions it needs, and avoiding open-ended tools (OWASP LLM06:2025 Excessive Agency).
An open-ended tool is one that can do almost anything, such as “run any database query” or “send any email”. A narrow tool does one thing, such as “find a supplier by name”. An agent that only needs to read email should get a tool that reads email, not one that can also send and delete.
A tool can reach only what the agent’s access allows
Each tool runs with the agent’s own access. The agent works under its own user in each system, never under an employee’s login, so the system knows which entries and changes are the agent’s (Who is accountable when an AI agent makes an entry?).
A tool cannot do more than that user is allowed to do. If the agent’s user in the accounting system can create drafts but not book them, no tool can book an entry, however the tool is written.
Every tool call is written to the logbook, so the operator can see what the agent read and what it changed. The company controls the access behind the tools and can narrow or withdraw it at any time. Where access must be set up, that is done with your IT, in-house or your IT partner.
Where tools come from
Tools reach an agent in three ways:
- Built for the job. A small function written for one task, such as creating a draft entry in your accounting system.
- Built into the AI platform. Providers offer some tools ready to use, such as web search (Anthropic: Tool use with Claude; OpenAI: Function calling).
- Offered through an MCP server. MCP, the Model Context Protocol, is an open standard for offering tools and data to AI applications, so one set of tools can be used from different AI tools (Model Context Protocol specification). A separate guide explains how it works with Claude Team.
Whichever way a tool arrives, the questions below still apply.
Five questions before you add a tool
Ask these before an agent gets a new tool:
- What does it read? Only the data the job needs.
- What does it change? Nothing, or a draft, to begin with.
- Whose access does it run with? The agent’s own user, with only the rights the job needs.
- Who checks the result? The step’s sign-off zone says whether the agent acts alone, asks first, or the operator signs off.
- Is every call logged? Each call, its fields and its result are written to the logbook.
If a tool fails one of the five, narrow it or leave it out.