WHAT TOOLS ARE

READ-ONLY TOOLS VERSUS ACTION TOOLS All tools are not equally dangerous. A read-only tool only retrieves information and changes nothing in the world. Looking up a stock price, searching a database, or reading a file are read-only. An action tool changes something: it sends, writes, deletes, buys, or modifies. Imagine a library. Reading a book on the shelf harms nothing. Tearing pages out of it, or returning it to the wrong shelf, is a change that affects everyone. Why does the distinction matter so much for safety? Read-only tools generally have a mild worst case. If the agent searches for the wrong thing, you lose a little time and money. Action tools can have a severe worst case. If the agent deletes the wrong record, sends the wrong email, or pays the wrong invoice, the result may be permanent and public. So harnesses treat the two classes differently. Read-only tools can often run freely, with ordinary logging. Action tools usually need extra measures, such as a permission check, a human approval step, a rate limit (a cap on how often the tool may be used), an audit log (a permanent record of every use), and an idempotency check, which you will meet in Chapter 15. Careful teams go one step further and classify tools into more levels, such as read-only, reversible action, and irreversible action, with stricter controls as the risk rises. One caution: a tool that looks read-only can sometimes cause effects, for instance a search tool that hits a web address which triggers an action on the other side, or a read tool that leaks sensitive data to the model. So read-only does not mean risk-free, and the permission and data-protection topics of Part Nine still apply.