Essay: Agent Tool Calls Are Distributed Transactions Needing Idempotency Keys

On November 2, 2026, the AI section of DEV Community published an article titled "An agent's tool calls are distributed transactions — who is responsible for retries?" The piece argues that an agent equipped with write tools is effectively coordinating distributed transactions over an unreliable network, with nothing in place to limit when it decides to try again.

The article walks through a representative failure case. A refund tool commits successfully, but the 200 OK response is lost on the way back to the agent. The model sees only a 504 error and calls the interface again. The API treats the second call as a brand-new request and processes a second refund. No jailbreak and no hallucination are involved — the failure is entirely structural, driven by the loss of a single response.

The author is categorical about what will not fix this. Cautionary language added to the system prompt does not bring idempotency, and neither does MCP's idempotentHint. Real protection requires defining your own idempotency keys and deciding in advance who owns retry logic. Without end-to-end idempotency, the article warns, retrying does not make an agent more resilient. It simply corrupts data faster than any human operator could. The piece closes by noting that such failures need neither exploit nor error to occur, which is precisely what makes them dangerous.

As of this writing, the article remains a standalone technical opinion piece with no follow-up coverage.