FUNCTION CALLING · BEFORE THE WRITE
Function-call inspection: validate a state mutation
The model asks to change a shipping address. Choose which checks stand between its function call and the order record.
Your experiment
alice asks the agent to update her delivery address and the model emits update_shipping_address with an expected_version. Start with a call based on version 3 of an order that support already corrected in version 4, then switch on each check and try every call.
Play replays the computed run over sixty inspection seconds; Next event steps, Restart rewinds, Speed changes the pace and Inspection time scrubs. Any input change recomputes the run and rewinds it without autoplay.
Event trace
Computed data
Final metrics
Decision model of a tool gateway; nothing is written. The existence check is always on because the tool cannot load a missing order. Orders, versions and owners are fictional. A real gateway also needs authentication of the caller, idempotency keys and an audit record of every rejected call.
A valid call can still be wrong
alice asks the agent to change her delivery address. The model emits update_shipping_address for order O-17 with expected_version 3, but support already fixed the unit number and saved version 4. The arguments are well formed, so the opening schema check passes and the write goes through, silently overwriting support’s fix: UNSAFE WRITE, a lost update. Check Version precondition (expected_version matches) and the call is REJECTED CORRECTLY at the version check; the model receives the reason and can re-read the order.
Each check answers a different question
Ownership check, Business invariants and Schema check each matter for a different call. Set Function call from the model to Change to another customer’s order: O-33 belongs to bob, and only the ownership check stops it. Choose Change to an order that has shipped: only the invariant check, shipped orders are locked, stops it. Choose Arguments missing postal_code: the schema check rejects it, and clearing that check saves an incomplete address.
Some checks cannot be switched off
Choose Order id the model invented. O-999 does not exist, and the existence check rejects it in every configuration because the tool cannot load a missing order. Models invent identifiers; a failed lookup must come back to the model as a clear error, not be turned into a new record.
Checks must not block the legitimate change
Choose Legitimate change with every check on: the call carries the current version 4, alice owns the order, it is still processing and all fields are present, so the address is written once: APPLIED CORRECTLY. A gateway that rejects valid calls teaches developers to bypass it, so each check must be precise about what it refuses.
Reading the run and its limits
Play, Next event, Restart, Speed and Inspection time step through the call, every check in order and the write across sixty seconds; the table shows which checks ran and which rejected the call. This is a decision model with three fictional orders. A real tool gateway also authenticates the caller, applies idempotency keys and records every rejected call for review.