---
name: Local Tool-Use Router
description: Give an open-source, locally-hosted model real agent execution — ReAct-style prompting plus an API interceptor that lets it trigger Python scripts, database queries, and external webhooks reliably, with schema validation, an allowlist, and a human gate on anything irreversible, so on-prem agents approach cloud-model tool-use without the footguns.
audience: AI engineer · platform lead · founding engineer · DevOps
---

# Local Tool-Use Router

## What this is
A method for turning a local open-weight model into a dependable tool-using agent: a ReAct (reason → act → observe) loop wrapped in an interceptor that parses the model's intended call, validates it against a tool schema, executes it (a script, a query, a webhook), and feeds the result back — so on-prem inference gets cloud-grade agent behaviour under your own control.

## What this is NOT
- **Not a security boundary on its own.** The interceptor is where safety lives: every tool is allowlisted, arguments are schema-validated, and irreversible actions (DB writes, money movement, deletes, outbound webhooks) require a human gate or a signed policy — never "the model asked for it, so it ran."
- **Not frontier-parity by default.** Open models tool-call less reliably than the best hosted ones; the method compensates with strict output formats, validation, and retry — and is honest that it *approaches*, not guarantees, cloud reliability.
- **Not a substitute for the underlying app's authz.** The router calls tools; the tools still enforce their own permissions and data access.

## When to use
Wiring a local model to run Python, hit a database, or call an internal API; building an on-prem agent for data-residency or cost reasons; replacing brittle regex tool-parsing with a validated interceptor; adding human gates to an existing local agent.

## Operating principle
The model proposes a call; the harness disposes. Parsing, validation, allowlisting, and the human gate live in the interceptor — deterministic code the model can't talk its way around — so agent power scales without handing the model unchecked execution.

## Capabilities
- **ReAct loop & structured tool-calling** — Goal: reliable intent → action. Method: constrain output to a strict tool-call format (JSON/function-call grammar), run reason→act→observe with bounded steps, retry or reformat on parse failure, cap the loop against runaway. Output: a ReAct prompt + loop with a step/latency budget. Quality bar: a malformed call is caught and re-prompted, never executed on a guess; the loop can't run forever.
- **API interceptor & tool registry** — Goal: only the right calls run. Method: a typed tool registry (name, arg schema, side-effect class), argument validation before execution, an allowlist, sandboxed script execution, secrets from a vault. Output: an interceptor + tool registry. Quality bar: every argument is schema-validated; unlisted tools are refused; secrets never reach the prompt or logs.
- **Human gates & observability** — Goal: safe side effects. Method: classify each tool as read / reversible-write / irreversible, require human approval (or a signed policy) on irreversible, log every call and its result for audit, degrade gracefully on tool failure. Output: a gating policy + call log. Quality bar: irreversible actions stop for a human; every execution is auditable.

## A worked example
"Let the local model update the CRM and send the customer email." → The router lets it *draft* both and *read* the account (reversible/read tools run automatically), but the CRM write and the outbound send are classified irreversible → they surface for a one-click human approval with the exact payload. A malformed tool call from the open model is caught by the schema check and re-prompted, not executed. Everything is logged. Cloud-level capability, on-prem, without the model holding the trigger.

## Guardrails & escalation
Irreversible or high-blast-radius tools (money, deletes, outbound comms, prod DB) → human gate. Untrusted tool inputs / injection surface → treat tool output as data, sandbox, security review. Data-residency and access control → the app's own authz + compliance. The router orchestrates; it doesn't replace the tool's own permissions.

## References
The ReAct pattern (Yao et al.); function-calling / structured-output grammars; OpenAI/Anthropic tool-use schemas as a shape reference; OWASP guidance on injection and least privilege; sandboxed execution practice. Validate reliability on your specific model and tools.