FUNCTION TOOLS · APPROVAL AND EFFECT WORKBENCH
Tool design: separate schema, authority and effect
Edit real JSON arguments, inspect policy gates and watch an approved local function change a synthetic ledger.
Scroll the gateway horizontally to inspect all gates and ledger counters. The caption and JSON below give the same outcomes as text.
Request being reviewed
Your experiment
Compare malformed arguments, a viewer role and an unapproved mutation. Each fails at a different gate; none may add a message to the synthetic outbox.
Each gate takes eight inspection seconds, or use Next gate. Only reaching the final stage applies the planned local effect. Restart preserves the ledger; Reset synthetic ledger clears this page’s fictional state.
Returned output
Inspect the synthetic ledger
This browser-only gateway uses six handcrafted functions, not an ADK/Gemini service implementation. No emails, calendar invitations, network requests, real files, database queries or arbitrary code are executed. Email recipients are restricted to example.test; virtual files are two allowlisted map keys; arithmetic uses named operators, never eval. Calendar intervals use one synthetic day and no time zones or recurrence. Search is literal matching over three fixture sentences. Approval, role rules, hooks and receipt storage are illustrative application policies, not production security controls. Redaction changes two output fields only and is not a privacy or compliance guarantee. The ledger is held in page memory and is lost on reload. Function-tool concepts · Action-confirmation concepts.
Design a contract before allowing an effect
Function selects one of six local functions. JSON arguments are the contract: documented field names, bounded values and explicit operations. Example loads a valid request, malformed JSON or a tool-specific boundary. Start with Mock email and Viewer. Malformed JSON stops at Input schema; a valid email stops at Role policy. Choose Operator and run again: Approval now blocks the effect. Approve exact payload, then inspect all seven gates. Exactly one email appears in the synthetic outbox. A valid schema describes a request; it does not grant authority or express consent. The preview reveals the planned outcome, but the ledger changes only when the last gate is reached. This page deliberately runs application policy code rather than invoking an LLM or ADK service.
Bind consent and retry identity to a concrete request
Approve exact payload binds the selected function and parsed arguments; Revoke approval withdraws it. Editing JSON, Role, Hook policy, Operation key or receipt policy clears approval. After the first successful email, Restart inspection and finish with the same key: the old receipt returns and the outbox stays at one. Change the subject, approve again, and the used key is rejected because it describes a different intent. Enter intent-2 and approve to create the second message. Reuse receipts for repeated intent becomes available after a successful mutation. Uncheck it, approve and finish to create a third message. This deliberate comparison demonstrates why permission checks and retry protection solve different problems. Keys are 1–40 letters, digits, dots, underscores or hyphens. Receipts are page-memory records; there is no durable exactly-once guarantee, shared transaction, concurrent requester or external delivery system.
Find the stopping gate and inspect both representations
Hook policy can block mutations before Role policy or redact recipient/file content after execution. With an operator-approved email and the block hook, no email is added. With the redact hook, returned output hides the recipient while the internal ledger still contains it. A stored receipt also retains the original output. Redaction here is presentation behavior, not a storage privacy guarantee. Change to Fixture calendar: the valid 540–600 interval ends exactly at the reserved 600–660 interval and is allowed. A new 630–700 interval passes schema validation but fails Tool execution because it overlaps. No later hook runs after a rejection. These distinct stopping gates let you separate malformed input, missing authority, missing consent, conflicting retry identity and a function-level domain error.
Exercise the other narrow contracts
Virtual files accepts only /workspace/notes.txt and /workspace/report.txt. A read uses operation and path, omitting content, and works as Viewer. A write requires nonempty content, Operator and approval. Traversal paths are rejected as names; this map does not model a real disk or symlinks. Synthetic key/value store accepts status values draft/ready and integer batch_size values 1–100. Set batch_size to 16, then get it as Viewer without a value field. Local fixture search ranks three sentences by matched query terms; retry returns F1, while an unmatched term returns no matches. It is not web retrieval or semantic search. Bounded arithmetic accepts finite operands from −1000 to 1000 and add, subtract, multiply or divide. Twelve divided by three returns four; division by zero passes schema validation but fails execution. Unknown fields, arrays and null are rejected. Inputs use JavaScript character limits, not byte quotas. JSON parsing keeps the last duplicate key.
Control the inspection and preserve observations
Play run advances seven gates over fifty-six inspection seconds at normal speed. Pause freezes progress; Play resumes, or starts another inspection after completion. Next gate pauses and advances once, discarding the partial gate interval. Restart inspection preserves the ledger and current approval. Reset synthetic ledger restores fixture data and clears receipts and approval; it keeps your selected request. Speed offers quarter, half, normal and double rates and accounts for elapsed time before switching. Hidden tabs pause. These times are reading aids, not measured service latency. Scroll the diagram horizontally on a phone; the caption, output and ledger provide text alternatives. Capture baseline saves inputs and result for comparison; Replace baseline updates it and Clear baseline removes it. Notes persist in this browser and Export notes downloads them. Expand experiment enters full screen. Record the payload, role, approval, key, hook, stopping gate and actual ledger difference. Reload loses the synthetic ledger. The readings connect these bounded experiments to narrow tool contracts and agent-as-tool composition; delegation and model-generated arguments are outside this fixture.