Separate a Proposed Action From an Executed One
“Prepare a refund” and “issue a refund” are different operations. Your tool interface should make that distinction visible.
In a practice workflow, let the model propose the order, amount and reason. Have application code validate the proposal and present the required confirmation before any consequential execution. Use a sandbox or synthetic service for the exercise.
Check that an unconfirmed proposal cannot reach the execution path, including after a retry. Keep the confirmation bound to the specific proposal so changed amounts need a fresh decision. The model can help assemble the information, but it should not manufacture its own authority to perform the external action. Inspect the recorded transition, not just the final conversational reply.
