Build a support agent with two tools and a safety limit

[
  {"id": "HB-1001", "customer": "c-17", "status": "shipped", "eta": "2026-11-03", "total": 24.0},
  {"id": "HB-1002", "customer": "c-17", "status": "processing", "eta": "2026-11-06", "total": 61.5},
  {"id": "HB-1003", "customer": "c-42", "status": "delivered", "eta": "2026-10-28", "total": 18.0},
  {"id": "HB-1004", "customer": "c-42", "status": "cancelled", "eta": null, "total": 33.0}
]

RETURNS: Books can be returned within 30 days of delivery if unused.
REFUNDS: Refunds up to 40.00 can be approved by a person. Above 40.00, send to a manager.
PRIVACY: Never show another customer's orders. Only use the logged-in customer id.
SCOPE: Only help with orders and returns. For anything else, say you cannot help and open a ticket.

TOOL 1  lookup_order(order_id)        -> returns the order if it belongs to the current customer
TOOL 2  create_ticket(summary, reason) -> saves a ticket for a person to handle
STEP    request_refund(order_id, amount) -> NEVER runs alone. It creates an approval request.

RULES FOR EVERY TOOL CALL (check in your code, not in the prompt)
- order_id matches the pattern HB- followed by 4 digits
- the order belongs to the current customer
- amount is a number between 0 and the order total
- maximum 6 model steps per question

import json

ORDERS = json.load(open("orders.json"))
CURRENT_CUSTOMER = "c-17"          # pretend this person is logged in
MAX_STEPS = 6

def lookup_order(order_id: str):
    # TODO: validate the id pattern; find the order; return it ONLY if it belongs to CURRENT_CUSTOMER
    ...

def create_ticket(summary: str, reason: str):
    # TODO: append to a list or file; return a ticket number
    ...

def request_refund(order_id: str, amount: float):
    # TODO: validate; do NOT refund. Return {"status": "waiting for approval", ...}
    ...

TOOLS = {"lookup_order": lookup_order, "create_ticket": create_ticket, "request_refund": request_refund}

def run(question: str):
    messages = [{"role": "system", "content": open("policy.txt").read()},
                {"role": "user", "content": question}]
    for step in range(MAX_STEPS):
        reply = call_model(messages, tools=list(TOOLS))     # TODO: your provider call
        if reply.tool_call is None:
            return reply.text
        # TODO: check the tool name is allowed; validate arguments; run it; log it; append the result
    return "I could not finish this. A person will follow up."   # step limit reached