Validate Tool Arguments Before Doing the Work

A model's tool call is a request for your application to act. Validate that request before passing it to a database or service.

For a synthetic order lookup, require an order identifier with the shape your system expects. Check that the authenticated user can access that order, and reject unknown arguments. A structured schema can help define the interface, but application code still owns authorization.

Test a missing identifier, a malformed value and an identifier belonging to another test user. Each should produce the intended contained response without exposing data. Keep these checks in the tool implementation rather than relying on the model to remember them. That makes the boundary survive a changed prompt or a different model choice.

OpenAI documentation.