How does something that only outputs text change a file on your machine? It doesn't. It asks.
Tool call
Also called Function calling
Structured output asking for a named action with arguments, such as read_file on config.json. The model runs nothing. The program around it, which the next chapter calls the harness, decides whether to run it and sends back the result as text.
All real power sits in that program, so that is where the safety controls go, as the next chapter shows. It also means the model works from whatever comes back, including instructions hidden in a file it read.
“Expose read_file and run_tests as tools, not a general shell. Set strict: true on each one, return failures as a tool_result with is_error: true, and log every call with its arguments.”