Ideally you have a layer before the LLM that filters out stuff the phone can do without an LLM. The LLM probably shouldn't even have the power to call 911, that should be a layer lower. And probably you don't want to send simple queries like "call XYZ" to the cloud, best to just do it locally.