Validate and Gate Tool Calls

When the model emits a tool call, the evidence stream assesses it before your harness executes it: the raw call is parsed, validated against your tool's JSON schema, every argument is linked back to the conversation context, and your local risk policy is applied. The result is a single decision you can gate execution on.

Declare a local tool policy

Tool policies are local metadata for the gate — they are never rendered into the model prompt.

TypeScript

const events = client.chat.completions.streamWithEvidence({
  messages,
  tools,
  maxTokens: 256,
}, {
  toolPolicies: {
    delete_record: {
      riskLevel: "critical",
      requiresApproval: true,
      sideEffect: "irreversible",
      sensitiveParameters: ["/record_id"],
    },
  },
});

for await (const event of events) {
  if (event.type !== "tool_call_evidence") continue;
  const call = event.evidence;
  switch (call.decision) {
    case "allow":
      await execute(call.name, call.arguments);
      break;
    case "review":
      await askUser(call);
      break;
    case "block":
      console.error(call.schemaIssues);
      break;
  }
}

Python

from invera_sdk import EvidenceOptions, ToolPolicy

options = EvidenceOptions(tool_policies={
    "delete_record": ToolPolicy(
        risk_level="critical",
        requires_approval=True,
        side_effect="irreversible",
        sensitive_parameters=("/record_id",),
    )
})

for event in client.chat.completions.stream_with_evidence(request, options):
    if event.type != "tool_call_evidence":
        continue
    call = event.evidence
    if call.decision == "allow":
        execute(call.name, call.arguments)
    elif call.decision == "review":
        ask_user(call)
    else:  # "block"
        print(call.schema_issues)

How the decision is derived

• block — the call is not schema-valid: the JSON did not parse (invalid_json), no supplied tool definition matches the name (unknown_tool), or the arguments violate the declared schema (missing_required, invalid_type, invalid_enum, additional_property). Each problem is reported as a machine-readable SchemaIssue with a JSON-Pointer-style path.
• review — the call is valid, but your policy demands a human: requires_approval is set, the side effect is irreversible, or the risk level is high or critical. The risk_reasons list explains why.
• allow — schema-valid and no policy requires approval.

What else the assessment carries

• completeness — the share of required arguments that are present (0 when the call could not be parsed or matches no known tool).
• parameters — one entry per argument leaf with the context sources it traces back to and a per-argument grounding score. A low score on a value the user never mentioned is a hallucinated-argument signal.
• intent_grounding — how strongly the tool call as a whole traces back to system, user, and tool messages rather than to the model's own output.

The score composition is documented in Evidence and verdicts. Note that the gate is advisory tooling for your harness: it checks structure, grounding, and your declared policy — it does not sandbox execution.