Function calling lets an AI application turn a natural-language request into a structured request for a defined function. The model returns JSON containing a function name and arguments; your application parses that JSON, validates it, and performs the actual work. This creates a practical bridge between an AI assistant and databases, files, services, or other application logic. section 13.0 section 13.1
A typical function-calling workflow looks like this:
- Define functions with names, descriptions, parameters, and expected data types. section 13.2.1
- Send the user request and function definitions to the AI API. section 13.2.1
- Parse the returned JSON and check its schema, values, permissions, and safety. section 13.4.2
- Run the approved function in application code, then send its result back so the assistant can respond naturally. section 13.2 section 13.3.2
A database assistant
A user asks, “How many orders were placed in 1996?” The assistant selects get_sql_query, which returns a SQL query in JSON. The application passes that query to examine_sql, which checks validity, performance concerns, and security risks. After approval, the application runs the query and reports: “There were 152 orders placed in 1996.” A request to delete data is rejected instead of being executed. section 13.1.3
The model is not the tool executor. Your code remains responsible for implementation, input validation, error handling, access control, and deciding whether execution is allowed. Use strict types and schemas, parameterized SQL, read-only database accounts, restricted file locations, generic error messages, rate limits, and logs. Test with adversarial prompts before production. section 13.1 section 13.4.2
Table 13.1 Example functions
|
Function name
|
Description
|
|---|---|
get_sql_query
|
Creates SQL queries based on user questions and the database schema. Returns a JSON object with the SQL string.
|
examine_sql
|
Checks SQL queries for validity and security risks. Returns a JSON object showing whether the query is valid and safe, with notes about any risks found.
|
Use the example-functions table to compare a function that generates SQL with one that checks SQL validity and security. section 13.1.3
The same pattern supports currency conversion, typed data-entry validation, image-label extraction, meeting-note action items, SharePoint workflows, and HR data cleanup. Start with a clear business need, test with sample data, and verify results rather than treating generated output as automatically correct. section 12.3.1 section 13.4 section 13.4.1
