Without tools a model can only produce text. With them it can search a library, queue a render, read a brief from the system it lives in and write the result back. Everything called agentic rests on this one mechanism.
The design work sits in the tool definitions. A tool with a vague name and three optional parameters gets called wrongly and inconsistently; one that describes exactly when it should be used gets called correctly far more often.
Every tool is a permission. A model with a delete tool will eventually call it, so the ones that matter belong behind a human gate. A well-worded description is not a gate.
Why does a model call the wrong tool?
Usually the definition. Vague names, unclear descriptions and too many optional parameters produce inconsistent calls; precise definitions fix most of it.
Which tools should sit behind a human gate?
Anything that moves money, grants access, publishes, or deletes. A model with the capability will eventually use it, and a description is not a control.