A very capable person locked in a room
Picture someone extremely well read, quick, tireless, and sealed in a windowless room with no phone. You can slide questions under the door and they will slide brilliant answers back. That is a chatbot. Everything it knows, it knew before you arrived.
Now hand that person a laptop, a filing cabinet key and your email password. Nothing about them has changed. Their reach has changed completely.
That is what tools mean. Not a technical upgrade to the AI itself, but a widening of what it can put its hands on.
What a tool actually is
Strip out the jargon and a tool is one specific thing the agent is allowed to do. Each one is narrow and boring on its own. Together they are the whole story.
SEARCH THE WEB Goes and looks something up, comes back with what it found
READ A FILE Opens a document or spreadsheet you have given it access to
WRITE A FILE Creates or edits a document
SEND AN EMAIL Puts a message in someone else's inbox
READ YOUR CALENDAR Looks at what is already booked
BOOK A MEETING Puts something in a calendar, usually other people's too
UPDATE A RECORD Changes a row in your CRM, ticket system or database
RUN A SEARCH INSIDE Looks through your own files rather than the internet
The AI does not magically acquire these. Somebody connected them, deliberately, and usually you were the one clicking accept. An agent with no tools connected is a chatbot in a costume.
In plain English
- Tool:
- One specific action the agent is allowed to take, like search the web or send an email.
- Integration:
- The plumbing that connects an agent to a system you already use, such as your inbox or your CRM.
- Permission:
- What you have agreed the agent may reach. Usually a checkbox you tick during setup and then forget.
- Read access:
- The agent can look at something but cannot change it. The safe half.
- Write access:
- The agent can create, change, send or delete. The half that needs your attention.
The line that matters most: read versus write
Almost every worry about agents comes down to one distinction, and it is a distinction you already understand from ordinary working life.
Read access is letting someone browse your filing cabinet. Write access is giving them a pen and permission to send post. A colleague who reads the wrong folder is awkward. A colleague who sends the wrong letter to a client is a phone call you have to make on Monday.
READ (recoverable) WRITE (needs a boundary)
search the web send an email or message
open a document post publicly
look at the calendar book or cancel a meeting
list files in a folder edit or overwrite a file
check a customer record update or delete a record
read a report spend money
delete anything at all
Watch for the tools that look like read but are quietly write. Marking an email as read changes what your colleagues see in a shared inbox. Opening a shared document can move it to the top of everyone's recent list. Accepting a calendar invite tells the organiser you are coming. Small things, but they are changes to a shared world.
Checkpoint
Tools are what turn AI from something that talks into something that acts. Sort them into read and write. Read tools are how agents become useful. Write tools are why agents need boundaries.
Give it the smallest key that opens the door
There is one habit worth building early, and it costs nothing. When a tool asks what the agent may access, give it the narrowest slice that lets the job get done. Not the whole drive, one folder. Not the whole inbox, one label. Not every customer record, this quarter's.
โ Weak prompt
Prompt
Sort out my inbox. You have full access to my email, go ahead.
Output
Archived 340 messages, replied to 12, unsubscribed from 7 lists, and set up a filter for newsletters.
Sounds efficient right up until you learn which 340 messages got archived. Full access to a live inbox, with no boundary and no pause, is the single most common way people get burned by their first agent.
โ Good prompt
Prompt
Look only at emails in my Newsletters label from the last 14 days. Tell me which senders I have not opened at all in that time. Do not archive, delete or unsubscribe from anything. Just give me the list.
Output
9 senders in Newsletters with no opens in the last 14 days. List below with sender name and message count.
One label, one time window, read only, no changes. You get the useful part of the work and keep the decision. If the list looks right, you can widen the boundary next time.
What good tool use looks like from the outside
You will rarely watch an agent work step by step, and you should not have to. What you can insist on is a record of what it touched. Any tool worth using will show you this, in ordinary language, after the fact.
TASK Prepare Thursday's supplier update
READ 12 emails in the Suppliers folder
READ delivery-schedule.xlsx
READ 2 pages on the Acme website
WROTE supplier-update-draft.docx (new file)
SENT nothing
SKIPPED 1 email marked confidential
STOPPED Waiting for your review before sending
If a tool cannot tell you that much, it is asking you to trust it on faith. Ask anyway. What did you read, what did you change, what did you send. Those three questions work on agents and, incidentally, on people.
The part nobody enjoys hearing
Because agents can touch real systems, they can be steered by things they read. If an agent reads an email, and that email contains a line of text pretending to be an instruction, a poorly built agent may follow it. It has no reliable way to tell your instructions apart from words it found lying about in a document.
This is not a reason to avoid agents. It is a reason to keep write access narrow, keep sending under your control, and be careful about pointing an agent at content sent to you by strangers.
Before you connect anything, write one sentence: if this agent did the worst possible version of this task, what would I be undoing on Monday morning. If the answer is nothing much, connect it. If the answer involves customers, money or anything permanent, connect it in read only first.
๐ Quiz
Question 1 of 4In plain terms, what is a tool in the context of AI agents?