The tool layer is where most agent failures actually happen, so it gets the most rigor:
- Typed schemas
- every tool call is validated against a strict schema before it executes, so malformed calls are rejected, not guessed at
- Idempotency
- retries and webhook redelivery can't double-process the same action, a common source of duplicate charges or duplicate records
- Sandboxed execution
- tools run with least-privilege credentials scoped to the specific task, not a blanket admin key
- Observability
- every tool call is logged with its input, output, and latency, so a bad outcome is traceable to the exact call that caused it