Tool calling turns a chatbot into an agent. That's the point, and the risk. A chatbot that gets it wrong gives you a bad answer. An agent that gets it wrong sends money to the wrong person, and there's no undo.

The good news: the model never runs anything itself. It only proposes a call. Your app decides. That's where guardrails belong, not in the prompt, because the right input can talk a model out of any instruction.

In this talk, we'll cover:

- Treating every argument the model sends as untrusted input, and validating it in Dart
- Sorting actions by risk: read-only runs freely, reversible gets an undo, irreversible waits for approval
- Confirmation UI built from the real arguments, so the card can't say $12 when the call says $1,200
- Prompt injection hiding in places you don't expect, like a transaction memo or a task note
- Keeping API keys out of your app, setting limits, and logging every action so you can answer "why did it do that?"