Function-Calling Failure Modes: Schema Errors, Retries and Side-Effect Safety. This dated guide separates the actual model or API mechanism from promotional comparisons, endpoint aliases and features added by later releases. It focuses on implementable choices, documented limits and evidence a project should collect before deployment.
Cutoff: 25 October 2026 · Scope: publisher sources and editorial methods; account-specific features not independently verified.
What was released and when
A function call emitted by a language model is a proposal to use an external capability, not authorization to execute it. Models can choose the wrong tool, omit required fields, invent arguments, call twice after a retry, or cite a tool result that never arrived. JSON shape validation addresses only one part of this problem; the application must enforce business rules and permissions.
Architecture, interface and the important distinction
Design tool contracts with strict argument schemas, server-side tenant scoping, explicit idempotency keys and narrow effects. Separate read-only lookup tools from payment, deletion or messaging actions. A human approval should bind the exact operation and parameters, not a vague summary. Every tool outcome should be returned to the model as untrusted data with a request ID and a bounded error structure.
A useful real-world implementation
For an expense workflow, let the model propose a purchase-category update and attach the receipt ID. The server verifies that the receipt belongs to the current user and the category is valid. Before any irreversible action, show the proposed target, old/new value and consequence; on a network timeout, query prior operation status before retrying.
Limitations, licensing and evidence quality
Never assume that a strict schema guarantees truth or that model evaluation on a provider demo proves protection against prompt injection. Tool-output text can contain hostile instructions. Streaming responses can be interrupted mid-call, and retrying a non-idempotent action can duplicate side effects even if the original response was lost.
Alternatives and the selection rule
If an application only needs information lookup, choose retrieval without write tools. Add executable tools only where the value exceeds the security and audit burden. AI07 covers full orchestration; the present guidance concerns model-to-tool interface correctness.
Evaluation protocol worth running
Test malformed argument types, unknown tools, expired credentials, repeated calls, timeout-after-success and prompt injection in tool output. Count both model errors and preventions by the external policy layer.
Deployment and provenance checklist
Deployment record to preserve: canonical editorial ID wai-ai02-function-call-tool-errors, exact endpoint or checkpoint revision when verified, request date and region, model and tokenizer version, allowed tools, input modality, prompt template, output budget and actual measured usage. For current currency costs use the AI10 price snapshot matched by version, billing unit, region, tier and effective date. Unknown access entitlements must remain explicitly unknown.
Editorial evidence boundary
This is a 2026-10-25 editorial snapshot. A product or service may have changed after that date; the linked official pages can be edited without preserving every prior state. No independent model performance testing or live customer-account entitlement check was conducted for this article.
Sources & Further Reading
- platform.claude.com — documentation/reference (supplier-provided reference; not independently checked in this pass)
- developers.openai.com — documentation/reference (supplier-provided reference; not independently checked in this pass)
Source documentation establishes vendor-published facts, not independently measured model quality, tenant access, contractual rights or current prices. Use a dated pricing ledger and an account-specific entitlement check for deployment decisions.