Key Takeaways
- Tool calling lets an LLM request external actions (SQL, search, APIs, memory writes) through a structured interface.
- An agent harness is the deterministic runtime around the model: it assembles context, validates and authorizes tool calls, executes them, logs evidence, and enforces stop conditions.
- Most production failures happen at the tool boundary, not inside the model weights.
- A reliable harness treats every tool call as a governed event: principal, grant, resource, capability, and audit trail.
- For live business data, the harness keeps credentials out of prompts, scopes tools tightly, and leaves database-native evidence of what actually ran.
Introduction
A demo agent that “can call tools” often looks impressive. A production agent that is allowed to touch live business data must be constrained, observed, and stoppable. The gap between those two is where most real systems fail.
This article defines tool calling (what the model requests) and the agent harness (the runtime that actually validates, authorizes, executes, logs, and stops those requests). The concrete anchor is a live-business-data agent that answers questions over governed enterprise data in the same shape that Article 10 develops with Select AI. Protocols such as MCP appear as one useful way to expose controlled tool surfaces; they are not the full security story.
1. What Tool Calling Actually Is
In a typical turn:
- The model emits a structured tool request (name + arguments).
- The runtime executes the tool and returns an observation.
- The observation is appended to context and the loop continues until a terminal response or a stop condition.
Structured tools beat free-form “just paste SQL into the prompt” for three practical reasons:
- The interface is typed and discoverable.
- Arguments can be validated before anything runs.
- The call becomes a discrete, loggable event.
Discovery (for example a tools/list-style inventory) lets the model reason about what is available instead of relying only on a hard-coded function list. Hard-coded lists still work for small, stable surfaces; discovery becomes more valuable as the tool set grows or changes.
2. What Is an Agent Harness?
The agent harness is the scaffolding that turns a language model into a reliable agent. The model reasons; the harness decides what that reasoning is allowed to touch, how results are observed, and when the run must stop.
This is the same model-vs-harness boundary introduced in Article 4:
- Model: Inference, planning, tool selection.
- Harness: Context assembly, tool registry, validation, authorization, execution, logging, stop conditions, retries and failure handling.
The harness does not own the model’s internal chain of thought. It owns everything that turns a proposed action into a governed, observable outcome.
3. Anatomy of a Production Tool Call
Treat every tool call as a governed event:
- Propose: Model emits tool name + arguments.
- Validate: Harness checks schema, types, and allowed ranges.
- Authorize: Harness checks principal + grant + resource + capability.
- Execute: Call runs under scoped credentials (never secrets from the prompt).
- Log: Principal, tool, arguments (as policy allows), outcome, correlation IDs.
- Observe: Structured result returns to the loop.
- Decide: Continue, stop, or recover.
This sequence is where demos usually omit steps. Skipping validation, authorization, or logging is the most common path from a working prototype to an un-auditable production incident.
4. Common Tool-Calling Failures in Production
Common failure modes at the tool boundary:
- Credentials or connection strings appear in prompts or tool arguments.
- Tools are over-privileged or unscoped (any SQL, any table, any user).
- No durable audit trail of what actually executed.
- Missing stop conditions (runaway loops, repeated identical calls).
- Treating the protocol (MCP, REST, etc.) as the complete security model.
A protocol can make tools discoverable and typed. It does not, by itself, decide who may call which tool under what policy, or guarantee that evidence lands in a place a DBA can query later.
5. Concrete Anchor: Live-Business-Data Agent
Consider an agent that answers natural-language questions over trusted enterprise data (the pattern Article 10 develops with Select AI). The harness must guarantee at least the following:
- Tools are named and discoverable, not free-form SQL pasted into the model.
- Connections use saved / scoped identities; secrets never travel in the context window.
- The tool surface starts narrow (restrict / least-privilege by default; only a small, approved set of operations is allowed until you deliberately open more) and widens only deliberately.
- Session tagging and database-side logs provide verifiable evidence of what ran.
One production pattern is an MCP-style tool surface (for example, controlled SQL, vector search, memory read/write). SQLcl MCP illustrates the posture clearly: connect by saved connection name, default to a restrictive level, tag the session, and leave database-native traces. The same principles apply whether the transport is MCP, a custom runtime, or another protocol; the harness still owns validation, authorization, execution, logging, and stop conditions.
6. Core Harness Responsibilities
| Responsibility | What “good” looks like |
|---|---|
| Validate | Schema, types, allowed argument ranges checked before any side effect |
| Authorize | Identity, scope, and policy evaluated before execution |
| Execute | Least-privilege credentials; sandbox where appropriate |
| Log | Principal, tool, arguments (as policy allows), outcome, correlation IDs |
| Stop | Max iterations, timeouts, repetition detection, goal-completion checks |
| Recover | Clear error observations returned to the model; no silent failure |
Start with the minimum that matches your risk. Expand the surface only when measurement and audit show it is warranted.
7. Protocols vs Harness
- MCP, A2A, REST, and message queues solve different jobs (tool access, peer coordination, system integration). The harness sits above the protocol: it decides whether, and under what policy, a call proceeds.
- Protocol choice can evolve. The memory and audit substrate should stay stable so that evidence and durable state remain queryable even if the tool-access layer changes. That separation is one reason a governed database is a natural place for both agent memory and tool evidence.
8. Where This Fits
- Builds on the agent loop (Article 4) and context engineering (Article 7).
- Memory tools are simply another class of governed tools the harness can expose.
- Next: how to evaluate the harness (Article 9) and how Select AI provides a governed natural-language path to enterprise data (Article 10).
- MCP appears here as a concrete tool-surface pattern; a deeper discovery treatment remains available as a later topic.
Most Asked Questions
Is the harness the same as the agent framework (LangChain, etc.)?
Frameworks often include harness-like pieces. The harness is the specific set of responsibilities (validate, authorize, execute, log, stop) that must exist regardless of which library you use.
Do I need MCP to have a harness?
No. MCP is one way to expose discoverable, typed tools. A custom runtime can implement the same harness responsibilities.
Where should authorization live — model, prompt, or runtime?
In the runtime (harness). Prompts and model weights are not reliable enforcement points.
How does this relate to agent memory?
Memory read/write operations are tools. The harness applies the same validation, authorization, and logging rules to them.
What is the difference between tool calling and function calling?
In practice the terms are often used interchangeably. “Tool calling” emphasizes external actions and observations; “function calling” is the common API name for the structured request format.
How do I start small without over-building?
Begin with a small, typed tool surface, saved/scoped credentials, basic validation, iteration/time limits, and a log you can query. Widen only when you have evidence and need.
Resources
- Article 4: The AI Agent Loop: How Agents Reason, Act, and Observe
- Article 7: What Is Context Engineering for AI Agents?
- The Agent Communication Matrix: When MCP, A2A, and Plain REST Each Win
- Controlled Oracle Actions with SQLcl MCP
- Oracle AI Developer Hub — tool-surface and memory-backed agent examples
- Oracle AI Database Free / FreeSQL
- Forward: Article 9 (Evals), Article 10 (Select AI)
Latest Release
- oracleagentmemory 26.8 on PyPI
- Oracle AI Agent Memory 26.8 documentation
- What’s New in Oracle AI Agent Memory: Graph-Aware Retrieval, Image Memory, and Enterprise Controls
Conclusion
Tool calling is the request. The agent harness is the governed runtime that makes the request safe, observable, and stoppable. Once that runtime exists, the next practical question is how you know it is working under real traffic the evals layer covered in the next article.
Try Yourself: Start small. Define a minimal typed tool surface (one read-only SQL or memory-search tool), keep credentials in the runtime (never in the prompt), add basic validation + iteration limits, and write a queryable log of every call. You can exercise the pattern today against Oracle AI Database Free / FreeSQL and the tool-surface examples in the Oracle AI Developer Hub.
