Agent–Tool Boundary and Effect Reliability

Series · 1 posts

← Back to Paper Reading

  • Tool Call Succeeds, Workflow Fails: External-Effect Anomalies at the Agent–Tool Boundary

    Advanced
    Agent–Tool Boundary and Effect Reliability: Part 1 , Note: Sep 16, 2026 , Paper: 2026 , AI Systems

    A deep reading of the effect-history model behind Agent–Tool Boundary: why a successful tool response cannot guarantee a coherent external world state, and what MCP annotations and transactional contracts still leave unspecified.

    Understand it in 90 seconds
    Problem
    An agent workflow may reserve a table, charge a card, and send a confirmation. Each tool may return success, failure, or a timeout, but the workflow actually cares about which irreversible effects happened in the outside world and which effects still survive. If the runtime only trusts the latest response, retries, speculation, concurrency, and crashes can separate “the call succeeded” from “the work is complete.”
    Core insight
    Separate external-effect history from runtime observation. An attempt can produce an unknown observation even when externalization already happened; conversely, a runtime can observe success without the later commit, abort, or compensation producing the intended world state. Workflow safety is about effect history, not one API response.
    Strongest evidence
    Table 2 in Section 3 maps eight anomalies to the boundary capabilities they require. Section 5 audits the 2026-07-27 MCP registry snapshot: 98,291 tools were observed, 74.0% serialized at least one standard annotation, and 61.7% carried all four, yet Table 4 finds no sufficient transactional capability for A2–A8.
    Main boundary
    This is an effect-history vocabulary, a conjectural coverage analysis, and a runtime-contract argument. It is not a prevalence study showing that all production agents exhibit these eight anomalies. The coverage labels for ACRFence, RAC, Atomix, Cordon, CoAgent, and Shepherd are stated or partial comparisons, not formal proofs.
    Read the full deep dive

For speaking invitations, internal engineering sessions, or architecture exchange, see the topics and public work I can bring into the conversation.

Speaking & contact