Tool Calls: Validate, Authorize, Then Act