CHOICE
选对工具 Choose the right tool
同一目标可能需要读信息或改状态；工具能力必须与任务匹配。 A goal may require reading information or changing state. Capability must match the task.
01 · 查询与发送不是同一种“会做”
01 · Reading and sending are different kinds of action
搜索网页、读取数据库、给客户发消息，都叫“用工具”，风险会一样吗？ Search the web, read a database, send a customer message: all are tools, but do they carry the same risk?
02 工具坞：切换工具，执行门随之改变 Tool Dock: Switch Tools, Watch the Gate Change
执行前可见 visible before action
权限
Permission
GRANTED
最小权限集
least-privilege scope
执行门
Execution gate
READY
read-only tool
已产生副作用
Side effects made
0
外部改变
external changes
03 一次工具调用要看 4 个零件 Four Parts of a Tool Call
动作不是文本 action is not textPERMISSION
核验权限 Verify permission
模型提出调用不等于获得权限，应用必须按真实身份和范围判定。 A model requesting a call does not grant permission. The application checks identity and scope.
SIDE EFFECT
标明副作用 Expose side effects
搜索与读库不改变外部状态；发信、付款、删除会影响真实对象。 Search and database read do not change external state; sending, paying, or deleting does.
RESULT
读回真实结果 Read the real result
HTTP 200 或函数返回只是调用状态，还要校验业务目标是否真的完成。 HTTP 200 or a function return shows call status; the business outcome must still be checked.
04 最小机制：三道门共同放行才执行 Minimal Mechanism: Three Gates Must Agree
execute = schema ∧ permission ∧ confirm
run = valid ∧ allowed ∧ confirmedif side effect
切到“发消息”后确认门变为必需。未勾选时执行按钮会被拒绝，而不是由模型自行决定绕过。
For “send message,” confirmation becomes mandatory. Without
it, execution is denied rather than left to the model to
bypass.
结构有效
Valid structure
工具名与参数明确
tool name and arguments defined
权限允许
Permission allows
限定真实能力范围
real capability is scoped
副作用已确认
Side effect confirmed
再交给执行环境
then hand to execution
05 边界实验：绕过发消息确认门 Boundary Test: Bypass Message Confirmation
主动制造失败 Create a failure让草稿直接变成客户收到的消息 Turn a draft directly into a customer message
模拟错误 Harness 无视确认状态，直接调用 send_message。语言错误立即变成不可撤回的外部副作用。 This toy failure makes the Harness ignore confirmation and call send_message directly. A language error becomes an external side effect.
尚未执行。外部副作用计数为 0。
Not run yet. External side effects remain at zero.
✗ 模型能写函数名，就有权调用。
If the model can name a function, it may call it.
→ ✓ 能力发现与真实授权是两道不同的门。
Capability discovery and real authorization are separate
gates.
✗ 工具返回成功，业务目标就完成。
A successful tool return means the business goal is
complete.
→ ✓ 还要读回环境并核验实际结果。
Read the environment and verify the actual outcome.
✗ 所有工具只是“查询”，没有风险。
All tools are harmless queries.
→ ✓ 发信、删除、付款都会改变真实世界。
Sending, deleting, and paying change the real world.
06 · 一句话带走
06 · One line to keep