Function calling expands what an LLM can do, but it also introduces more failure points and more ways for a task to go wrong. If the model selects the wrong function, extracts the wrong parameters, or generates an incorrect call, the downstream action can fail or behave unexpectedly. That is why evaluation must cover the full tool-call chain.
Why function calling changes the risk profile
function calling turns a model from a text generator into a decision point that can trigger real actions. That changes the failure mode: the issue is no longer just an incorrect answer, but an incorrect action with side effects. In agentic applications, the tool layer becomes part of the security boundary, so evaluation has to cover selection, arguments, routing, and execution behavior together.
A function call can fail in several distinct ways. The model may choose the wrong tool, send malformed or incomplete parameters, or produce a call that is syntactically valid but operationally wrong. Even when the model intent is reasonable, small extraction errors can cascade into the wrong account, record, file, ticket, or external system being touched. AI Agents: The New Attack Surface report is a useful reference point for why tool use expands the attack surface rather than just automating a prompt workflow.
What makes the tool-call chain brittle
The brittle part is the handoff between language output and executable action. Once the application translates model output into a function invocation, it has to trust several assumptions at once: that the selected function is appropriate, that the arguments match the schema, and that the target system will interpret the call as intended. If any one of those assumptions fails, the downstream behavior can be materially different from what the user requested.
That is why function calling should be assessed as an end-to-end control path, not as a single model decision. A practitioner should test the whole chain under realistic failure conditions, including ambiguous prompts, partial data, tool confusion, and unexpected argument values. The agentic AI applications guide and AI Agent Identity Security: The 2026 Deployment Guide both help frame why lifecycle, authorization, and tool access need to be evaluated together.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 address the attack and risk surface, while NIST AI RMF, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A1 — Agentic Tool Misuse | Function calling creates tool-selection and execution risk in agentic applications. |
| A3 — Prompt Injection | Malicious or malformed prompts can steer the model into unsafe function calls. | |
| A4 — Identity and Privilege Abuse | Wrong function calls can trigger overprivileged actions through agent tools. | |
| Recommendation — Restrict tool scope and validate every tool call before execution. Harden tool mediation against prompt-driven instruction hijacking. Enforce least privilege and per-tool authorization for agent actions. | ||
| NIST AI RMF | GOVERN — AI governance | Agentic function calling requires governance over accountable, bounded AI action. |
| MAP — Map | Teams need to map function-call uses, impacts, and downstream dependencies. | |
| MEASURE — Measure | Evaluation must measure tool-call accuracy and downstream failure rates. | |
| Recommendation — Define ownership, approval, and accountability for model-triggered actions. Inventory tool-use cases and classify their operational impact. Measure tool selection, parameter accuracy, and execution success rates. | ||
| NIST CSF 2.0 | PR.AC — Access Control | Function calling should be constrained by access boundaries and authorization. |
| DE.CM — Continuous Monitoring | Tool-call chains need monitoring to detect incorrect or unexpected actions. | |
| Recommendation — Limit which functions an agent can invoke and under what conditions. Monitor agent tool activity for anomalous or unexpected calls. | ||
| CIS Controls v8 | 6 — Access Control Management | Tool access should be limited to the minimum required capabilities. |
| Recommendation — Grant only the minimum function-level privileges needed for the workflow. | ||
Practitioner Guidance
What to verify: Treat every tool call as a controlled integration point, not a harmless intermediate step. Verify that each exposed function has a narrow purpose, that the model cannot select a higher-impact function through prompt ambiguity, and that the receiving service validates every parameter independently of the model.
Decision rule: If a function can move money, change data, send messages, or invoke another system, require explicit approval or policy checks for that class of action rather than relying on model confidence. For lower-impact functions, focus on tight schemas, clear defaults, and rejection of unexpected arguments.
What good looks like: A good design produces observable, attributable, and bounded tool use. The model may propose actions, but the application still enforces function-level authorization, validates inputs, and logs the exact call that was made so failures can be traced back to the model, the router, or the downstream system.
Practitioner takeaway: The main risk is not that the model is “wrong” in the abstract, it is that a wrong or incomplete call can become a real operational event, so the control objective is to constrain and verify the action layer as carefully as the model layer.
Related resources from NHI Mgmt Group
- Why do valid tool calls still create risk in agentic applications?
- Why do agentic coding assistants create new governance risk for NHI teams?
- Why do agentic AI workflows create new IAM risk compared with traditional automation?
- Why do disconnected applications create more risk when automation becomes agentic?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 20, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
