An assistant with access to external tools is a different product from one working purely from trained knowledge. What changes is not the model but the set of things it can verify and act on.
What tools remove
Trained knowledge has a cutoff, and search access removes the resulting blindness to anything recent.
Arithmetic and data manipulation are unreliable when generated token by token, and executing code removes that weakness by computing the answer rather than predicting it.
Access to a specific document store replaces general recollection with the actual text, which is the difference between an approximate answer and a citable one.
How the model decides to use one
Tools are described to the model, which generates a structured request when it judges one appropriate, and the system executes it and returns the result.
The decision is a generation like any other, so it is subject to the same variability as the rest of the output.
The same question can trigger a search on one run and an answer from memory on another, which produces inconsistency that users find harder to accept than a consistent limitation.
Why the failures move rather than disappear
An assistant that searches inherits the quality of the results, and a confident summary of a poor source is a new category of error.
It may also search well and then answer from trained knowledge anyway, or retrieve one relevant page and generalise from it.
The visible symptom is a cited answer that is wrong, which is more misleading than an uncited one because the citation implies verification that did not occur.
What actions add beyond information
Tools that write, send or purchase change the risk profile entirely, since a mistaken retrieval is recoverable and a mistaken action may not be.
Systems handling these responsibly separate reversible operations from irreversible ones and require confirmation for the second category.
Confirmation only works while there is little of it, because a user approving every step stops reading, which returns the system to acting unsupervised with a record suggesting otherwise.
Where the design settles
The arrangement that holds up gives broad access to read-only tools and narrow, explicitly granted access to anything that changes state.
Read operations can be retried, audited and ignored, so their failure costs a wasted request rather than a consequence in the world.
That asymmetry is why capable assistants are usually generous with search and restrictive with everything else, and why the products that blurred the distinction have been the ones to withdraw features.