AI Agents for Business: When Tool Use Goes Wrong

Most of what gets sold as an AI employee is a chat box with a friendly avatar. It reads your FAQ, writes a nice paragraph, and hands the customer to a human anyway. The version worth paying for does something: checks the calendar, holds the slot, writes the deposit to your CRM, fires the confirmation text.

That gap has a name in the vendor documentation. It's called tool use, and it's the fastest way to tell a working agent from a rebranded FAQ widget. If you're evaluating AI agents for business use this year, it's the one concept worth an hour of your time.

What tool use actually is

Anthropic's developer docs put it in one sentence: "Tool use (also called function calling) lets Claude call functions that you define or that Anthropic provides. Claude determines when to call a tool based on the user's request and the tool's description" (Tool use with Claude, accessed September 2026).

The loop is boring, which is a compliment. You give the model a list of tools. Each has a name, a plain description, and a schema for its inputs, something like check_availability(date, service, technician). When the model decides a tool fits the request, it does not run anything. It returns a structured block that says "call check_availability with these arguments." Your software runs the call, hands the result back, and the model writes the customer-facing reply.

The same page splits tools by where the code runs. Client tools, including the ones you write, "run in your application." Server tools such as web search "run on Anthropic's infrastructure." And by default, "Claude determines on each turn whether to call a tool or respond directly."

Read that twice. The model proposes. Your code disposes. Every guardrail worth having lives in that gap, and most disappointing agent projects are disappointing because nobody put anything in it.

Four places it breaks

1. It fills in a blank you left. Anthropic's own docs flag this. If the prompt "doesn't include enough information to fill all the required parameters for a tool," the model "might infer a reasonable value," and the page adds that "this behavior is not guaranteed, especially for more ambiguous prompts and for less capable models" (Anthropic). In a booking flow that isn't academic. A caller who never says which location can end up booked at the wrong one.

2. It succeeds once but not eight times running. The tau-bench paper (Yao, Shinn, Razavi and Narasimhan, arXiv, June 2024) built simulated retail and airline agents with real API tools and policy rules, then measured repeated attempts at the same task. Their finding: "even state-of-the-art function calling agents (like gpt-4o) succeed on <50% of the tasks, and are quite inconsistent (pass^8 <25% in retail)." Two honest caveats. That paper is from 2024 and models have improved considerably since, and it tests gnarly multi-turn scenarios, not "book a haircut." But the shape of the result is the thing to design around: an agent that works in a demo is not the same as an agent that works two hundred times a week.

3. You gave it more power than the job needs. OWASP calls this Excessive Agency, and traces it to three causes: excessive functionality, excessive permissions and excessive autonomy (LLM06:2025 Excessive Agency). The classic version is picking an integration that can read, edit and delete when the agent only ever needed to read.

4. Someone writes instructions into your data. Indirect prompt injection is when the model reads text from an outside source, a web page, an inbound email, a PDF attachment, and treats it as an instruction. OWASP is blunt about the fix: "Given the stochastic influence at the heart of the way models work, it is unclear if there are fool-proof methods of prevention for prompt injection" (LLM01:2025 Prompt Injection). Treat that as permanent, and design so a successful injection still can't do much damage.

The guardrails that matter

None of this is exotic. It's the discipline you'd apply to a new hire with keys to the till.

• Give the agent the narrowest tools that do the job. OWASP's first mitigation is limiting extensions to the minimum necessary functionality.
• Put an approval step in front of anything expensive or irreversible. Microsoft's agent framework docs describe the pattern: a run that needs approval "will complete with a response that indicates what input is required from the user, instead of completing with a final answer," and a tool can be marked with approval_mode="always_require" (Microsoft Learn).
• Enforce permissions downstream, in your booking system or CRM, not in the prompt. OWASP says authorization belongs in downstream systems rather than in the model's judgment.
• Log every tool call with its arguments, and rate limit. Both are on OWASP's damage-limiting list, and the log is what you'll want the first time a customer disputes a charge.
• Make actions reversible or idempotent. A duplicate SMS is embarrassing. A duplicate deposit is a phone call you don't want.
• Start read only. Let the agent draft the reply, propose the slot and prepare the invoice while a person presses send for the first few weeks.

Where this doesn't apply

Plenty of businesses shouldn't buy an agent yet, and it's worth saying so out loud.

Statistics Canada's second-quarter 2026 analysis found 19.2% of Canadian businesses used AI to produce goods or deliver services in the previous 12 months, up from 12.2% a year earlier. Among businesses with 1 to 4 employees, 19.9% reported using AI. But 41.0% of businesses with 5 to 19 employees said AI is simply not relevant to what they do, and the leading barriers cited were cybersecurity or privacy concerns (13.4%) and cost (10.6%) (Statistics Canada). Those are reasonable positions, not laggard ones.

So: if your intake process changes every second week, an agent will faithfully encode last month's version of it. If you take six calls a day, a shared inbox and a better voicemail greeting will beat an agent on cost and on aggravation. And if the work touches health details or anything else sensitive, start with the privacy guidance, not the tooling. Federal, provincial and territorial privacy commissioners jointly published nine principles for generative AI in December 2023, including keeping "sufficient information for that person to be able to understand how a decision was reached, and allowing them the opportunity to request human review" (OPC). A Burnaby clinic collecting intake details has more homework here than a landscaper confirming quotes.

Cost deserves a mention too. Anthropic's docs note that tool names, descriptions and schemas are billed as input tokens on every request, on top of a tool use system prompt. On a chatty, high-volume phone line, a bloated tool list costs you on every single turn.

A sane rollout order

Pick one process. Run it read only for two weeks so you can see in the logs what the agent would have done, and how often that was wrong. Then let it act on the lowest-stakes step only, with approval gates on anything that moves money or sends something a customer can't unsee. Expand when the logs get boring. Most of the small shops we talk to around New Westminster and Burnaby need three or four narrow, well-described tools, not an autonomous do-everything agent.

Sources

• Anthropic. "Tool use with Claude." Claude Platform Docs, accessed September 2026. https://platform.claude.com/docs/en/agents-and-tools/tool-use/overview
• Yao, S., Shinn, N., Razavi, P., and Narasimhan, K. "τ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domains." arXiv:2406.12045, June 2024. https://arxiv.org/abs/2406.12045
• OWASP. "LLM06:2025 Excessive Agency." OWASP Top 10 for Large Language Model Applications, 2025. https://owasp.org/www-project-top-10-for-large-language-model-applications/2_0_vulns/LLM06_ExcessiveAgency.html
• OWASP Gen AI Security Project. "LLM01:2025 Prompt Injection." 2025. https://genai.owasp.org/llmrisk/llm01-prompt-injection/
• Microsoft. "Using function tools with human in the loop approvals." Microsoft Learn, updated August 2026. https://learn.microsoft.com/en-us/agent-framework/agents/tools/tool-approval
• Statistics Canada. "Analysis on artificial intelligence use by businesses in Canada, second quarter of 2026." Catalogue no. 11-621-M, released June 11, 2026. https://www150.statcan.gc.ca/n1/pub/11-621-m/11-621-m2026010-eng.htm
• Office of the Privacy Commissioner of Canada, with provincial and territorial counterparts. "Principles for responsible, trustworthy and privacy-protective generative AI technologies." December 2023. https://www.priv.gc.ca/en/privacy-topics/technology/artificial-intelligence/gd_principles_ai/

If you want a second opinion on whether a process in your shop is ready for this, book a free call with Autana Solutions. We'll map the tools it would actually need, tell you where the approval gates go, and say plainly if the answer is not yet.