Classify execution ownership
The official overview separates built-in server-side tools from custom function calling. Built-in tools can search, execute supported code, or query configured collections on xAI infrastructure. Custom functions return a request to your application, which decides whether and how to execute it.
Represent that distinction in code. A tool registry should declare owner, input schema, timeout, side-effect level, and whether human approval is required.
Constrain the research envelope
Give the model only the tools needed for the current task. Configure search filters where supported, cap tool iterations, and preserve returned citations with the final answer.
A polished answer without inspectable evidence is not a completed research task. Show sources, tool errors, and partial completion rather than hiding them.
- Set an invocation and cost budget.
- Allow-list domains or data collections when the task permits.
- Log tool names and outcomes, not secrets.
Treat side effects as a separate phase
Searching and calculating are different from sending, purchasing, deleting, or changing production data. Put side-effecting functions behind validation, authorization, idempotency, and—when consequences are meaningful—human confirmation.
The final application, not the model, owns permissions. A requested tool call is structured input to policy, never automatic authority.