Required agent tool calls can turn a read request into a write

Forcing a tool call does not make the chosen tool appropriate. An open Agents SDK issue asks for clearer documentation about tool_choice set to required when the model sees a filtered subset of tools. The author reports a read request selecting a state-changing mock tool in tests on an older SDK build. Those trial results should not be treated as a current production rate; the underlying design question remains useful.

Separate read and write capabilities

List tools available for each user intent and mark which ones mutate external state. If the user asks to inspect data, expose only read tools for that step or allow the model to answer without a tool. The SDK agent documentation describes forcing tool use; that setting governs whether a call is required, not whether every available call is safe.

Put approvals at the mutation boundary

The SDK tools documentation describes tool approvals and filtering. Require explicit authorization before a tool that sends, deletes, publishes or changes records executes. Validate tool arguments and resource ownership in code. A model-selected tool name is a request to execute, not authorization to change state.

Test adversarially and by role

Build a matrix of read, ambiguous and write requests against the exact eligible tool set. Record whether the agent chose a tool, the arguments and whether approval blocked mutation. Repeat after model or SDK changes. Avoid citing the issue author’s historical mock frequency as a forecast for your environment.

Adovo’s view

A required action is not a granted authority. The safer system decides what may be called before asking the model to choose. If a read-only request can reach a write tool, the boundary is misplaced.