// Provider-neutral sketch. Adapt the message envelopes to your SDK.
const response = await model.generate({
  messages,
  tools: publicToolDefinitions
});

for (const call of response.toolCalls ?? []) {
  // 1. Resolve only a server-owned handler.
  const tool = toolRegistry.get(call.name);
  if (!tool) throw toolError(call.id, "unknown_tool");

  // 2. Model output is untrusted input.
  const args = tool.schema.parse(call.arguments);

  // 3. The current user and resource decide permission.
  await tool.authorize({user, args});

  // 4. Put a human gate before consequential effects.
  if (tool.requiresConfirmation(args)) {
    await confirmations.require({user, call, args});
  }

  // 5. Execute ordinary application code.
  const result = await tool.execute(args, {
    idempotencyKey: call.id,
    timeoutMs: 8_000
  });

  // 6. Pair evidence with the call that requested it.
  messages.push(response.message, {
    role: "tool",
    toolCallId: call.id,
    content: JSON.stringify(toModelSafeResult(result))
  });
}

// The model gets a new turn with the tool result in context.
const final = await model.generate({messages, tools: publicToolDefinitions});