A model that can call a tool can do something no model without tools can do: act. An injected instruction that names a tool turns a bad answer into a side effect that cannot be undone.
About 1 min of reading
Before this new lesson, one small question about the lesson you just finished. Recall it, do not look it up.
Scope and check one tool call
Write the allowed list for this request
Before you run it, say out loud what it will print. Then open the answer.
Refuse a call outside the list
Before you run it, say out loud what it will print. Then open the answer.
Check the arguments of an allowed call
Before you run it, say out loud what it will print. Then open the answer.
A request that needs one tool should have one tool. A request with every tool available has more capability than it has a use for.
Arguments checked against a pattern before the tool runs cost one comparison and stop the whole class.
A tool that reads is risky. A tool that writes or sends is dangerous. The list of dangerous tools is the short list.
The model chooses the arguments. An injected instruction can choose them too, and the tool runs whatever it chose.
A dangerous tool that needs a person to confirm cannot be run by an injection. That is the strongest limit there is.
Each one is defined here on this site. Open the entry for the full definition and the other words it points at.