AppFunctions and Android's Emerging AI Ecosystem

Today, if you ask an assistant to "add milk to my shopping list", it either can't or relies on brittle UI automation. AppFunctions lets your app declare a function like addItem(list, item) with structured parameters, so an authorised agent can call it directly, while your app keeps control of the logic.

How it fits together

The shape of the API

You annotate functions in a service class, and a KSP compiler (appfunctions-compiler) generates metadata. In recent alphas, functions are declared in an AppFunctionService marked as an entry point. Illustrative only:

// Dependencies (check versions): androidx.appfunctions:appfunctions,
// appfunctions-service, and ksp("androidx.appfunctions:appfunctions-compiler")

@AppFunctionSerializable
data class ShoppingItem(val id: String, val name: String)

class ShoppingFunctions @Inject constructor(private val repo: ShoppingRepository) {

    /**
     * Adds an item to the user's shopping list.
     * @param name The item name, e.g. "milk".
     * @return The created item.
     */
    @AppFunction
    suspend fun addItem(context: AppFunctionContext, name: String): ShoppingItem {
        require(name.isNotBlank() && name.length <= 100)        // validate model-provided input
        return repo.add(name.trim()).let { ShoppingItem(it.id, it.name) }
    }
}

KDoc descriptions matter: they help the model understand when and how to call your function, as tool descriptions do in function calling.

Designing good app functions

• Expose intents, not UI steps: createNote(title, body), not "tap FAB, type text".
• Small, typed parameters with clear descriptions and validation.
• Idempotency or confirmation for actions with side effects.
• Read functions (search, get status) are lower risk. Start there.
• Reuse your domain layer: functions should call the same use cases as your UI. See Use Cases.

Security and user trust

• Only authorised callers can execute app functions (system-mediated permissions). Don't build custom backdoors.
• Treat parameters as untrusted model output: validate, bound and sanitise.
• Require user confirmation in your app for sensitive actions (payments, deletes, sending messages).
• Respect the user's sign-in state and app-level privacy settings.
• Be mindful of prompt injection: content an agent read elsewhere may try to trigger your functions. See Prompt Injection.

The wider Android AI ecosystem

How to prepare now

1. Structure business logic as clean, testable use cases, which is good architecture anyway.
2. List your app's top user intents that would make sense as voice or agent actions.
3. Prototype with the alpha in a branch, behind a flag, and track release notes.
4. Design confirmation UX for side-effecting actions.

Frequently asked questions

Conclusion

AppFunctions lets apps expose typed capabilities to AI agents, with the system mediating access and your app executing the logic. It's early (alpha), but clean use cases, validated inputs and confirmation for sensitive actions will prepare your app for agent-driven interactions.

Next step: build apps everyone can trust and use with Privacy, Accessibility and Reliability.