Without tools a model can only produce text. With them it can search a library, queue a render, read a brief from the system it lives in and write the result back. Everything called agentic rests on this one mechanism.
The design work is in the tool definitions rather than the prompt. A tool with a vague name and three optional parameters gets called wrongly and inconsistently; one that describes exactly when it should be used gets called correctly far more often.
Every tool is a permission. A model with a delete tool will eventually call it, so the ones that matter belong behind a human gate rather than behind a well-worded description.
Why does a model call the wrong tool?
Usually the definition rather than the prompt. Vague names, unclear descriptions and too many optional parameters produce inconsistent calls; precise definitions fix most of it.
Which tools should sit behind a human gate?
Anything that moves money, grants access, publishes, or deletes. A model with the capability will eventually use it, and a description is not a control.