Reliable Execution of Consequential AI Agent Actions Under Retries and Ambiguous Outcomes

AI agents increasingly invoke tools that create externally visible side effects, including payments, refunds, bookings, messages, account changes, deployments, orders, and other mutations. When a tool invocation crosses a network boundary, a timeout or lost acknowledgement can leave the caller unable to determine whether the external effect occurred. A naive retry may therefore transform a recoverable communications failure into a duplicate real-world action.This paper frames that condition as an ambiguous-outcome execution problem and presents a practical execution-safety model based on stable logical operation identity, effect binding, durable outcome state, conservative handling of UNKNOWN outcomes, and authoritative reconciliation where available.It also describes selective protection: read-only and generation-only tools should remain fast, while consequential mutations are routed through a protection boundary and semantically uncertain tools fail closed.Once is presented as a reference implementation of this model, including same-machine durable protection, MCP/tool discovery, framework integrations, and hostile-retry evidence across multiple agent frameworks.The paper does not claim universal exactly-once execution. Instead, it specifies the conditions under which a one-effect invariant can be demonstrated and the cases that remain dependent on downstream provider guarantees and authoritative reconciliation.