Here is a sentence you will read in an agent’s reply one day: I have sent the revised quote to the client. Before you feel relieved, ask one question. Sent it with what?
Everything an agent does, it does through a tool: one named action that the code around the model has agreed to perform on request. Fetch this document. Ask Finance. Send this message. The list of tools is the whole account of what the agent can do in your company. Anything not on it, the agent cannot do, whatever its reply says. Which leaves the question this paper is about: what happens when the model wants something the list does not offer?
A tool is a promise the code keeps
An agent has two halves. There is the model, which reads and decides and writes. And there is the surrounding code, the part the Cabinet calls the room, which holds the tools and performs them. The model never touches your email, your files or your bank. It writes a request, naming a tool and what to pass it, and the room either does the thing and hands back the result or declines. The model asks; the code acts.
Seen this way, a tool is a promise the code has made: if you ask for this, by this name, I will do it and tell you what happened. The tool list handed to the Chair at the start of every meeting, as part of the Brief it reads before every turn, is the full set of promises in force. Nothing a message says during the meeting can add to it. A supplier’s email can change what the model wants; it cannot change what the room will do, because the list was written before the meeting began.
That is the useful half of the mechanism. The dangerous half is what happens at the edge of the list, and it depends entirely on one design choice.
What happens at the edge of the list
Suppose the renewal again, with the company invented for the exercise. The Chair has held the list price and offered the volume tier, and the reply is about to leave through the Door, the rules that govern what may be sent and to whom. The Chair now wants to attach the updated rate card, and there is no tool in this room that attaches a file. Two rooms, two outcomes.
| Moment | The reference design | A room without the rule |
|---|---|---|
| The Chair requests a tool called attach-file | The room finds no such promise and returns a refusal: no tool by that name; here are the tools you have | Nothing comes back, or an error the model cannot read |
| The Chair reads the reply | It learns the limit and uses a tool it does have: the reply says the rate card will follow from a named colleague, and the gap is noted in the Record | Silence. The Chair fills it with prose: “I have attached the updated rate card” |
| What the client receives | A true sentence and a follow-up from a person | A false sentence and no attachment |
| What you can find afterwards | A line in the Record, the ledger of every action and its reason: the request, the refusal, the correction | Nothing. No tool ran, so nothing was written |
Exhibit 2. Illustrative. The Chair asks for a tool that is not on the list; one room answers, the other stays silent.
In the imagined second room the model did not gain a power it was not given; the list held in both. What differed is what the model was told. In the first room it received a refusal it could act on, with the list of what it might do instead, and it corrected course. In the second it received nothing, and a model that has asked for an action and heard nothing back has only its own intention to report. So it reports the intention, in the past tense. Nobody built a dishonest agent. Somebody left an honest one to guess.
The rule the reference design adds is small and specific, and the Register records it: an unknown tool is answered, never ignored. The reply names the failure and restates the list. The Door follows the same habit when it refuses a send, which the fourth paper takes up: the reason comes back to the Chair, so it can do something sensible rather than try again blind.
There is a second, quieter benefit. Every refusal is written down. When a reader later asks why the client was told a colleague would follow up, the Record shows the request, the refusal and the correction in order. An agent whose limits never appear in its own transcript is one you cannot fully audit, because the moments it fell short are exactly the moments it left no trace.
What this arms you to ask
Ask the vendor, in the demonstration, to make the agent want something adjacent to what it can do. If it can send an email, ask it to attach a file. If it can read a calendar, ask it to move a meeting. Then watch the reply and the transcript together.
A good answer is a visible refusal in the transcript, the tool list restated, and a reply that says plainly what the agent could not do and what it did instead. The answer you will more often see is a reply that says the thing was done, because most systems were never taught to say otherwise. Do not argue about whether the model is capable; the list decides that. Ask instead why the model was allowed to describe an action that no tool performed, and whether anyone would have known.
Next paper: Four kinds of tool, and the one kind that cannot be undone.
Asked plainly
What is a tool, in an AI agent?
A tool is one named action the surrounding code has agreed to perform on the model's behalf: fetch a document, consult a specialist, send a message, write a record. The model does not perform tools; it requests them by name, and the code performs them or refuses. The list of tools is the complete list of things the agent can do.
Can an AI agent do something it was not given a tool for?
No. An agent has no path to any action outside its tool list. What can go wrong is different: the model may describe having done the thing, in prose, without any tool having run. The defence is a refusal returned to the model, with the reason, so it corrects course instead of narrating.
What happens when an AI agent asks for a tool it does not have?
In the reference design the surrounding code returns a refusal that names the missing tool and restates the list it does have, and the refusal is written to the audit log. The model then uses a tool it does have, or says plainly what it could not do. Where the request meets silence instead, the model is left to guess what happened.
Ask the vendor
The questions this part arms, each with the good answer and the answer that arrives instead.