The most common misunderstanding can be settled in one sentence straight out of the vendor documentation: the model does not call the tool. It fills in a form and says which one it would like and with which parameters — the actual call is made by your code, which then hands the result back to the model. The model never steps outside the text.
Every practical property that matters follows from that. The cost: a round with a tool call takes at least three times as many tokens as a plain answer, because the request, the result and the final wording each pass through the model separately. The error handling: if the tool fails, it is your code that has to hand that failure back in a readable form.
The security consequence comes from the same place: the tool runs unconditionally once it is called. The limit therefore has to be built into the tool's code, not into the prompt — the model only decides which button to press.
The mechanism and the costs are set out in Tool Use and Function Calling, Explained, a post of its own. Directly related terms: function calling, MCP and AI agent.