Analysis · DiggingBeagle record
An agent must not retry a financial action until it knows the first effect
Synthetic recovery tests, async callback benchmarks and agent trading surveys converge on three controls: durable effect evidence, callback state binding and limits enforced outside the model.
- Published
- Oct 27, 2026
Overview
A failed tool response may hide a completed transfer. An asynchronous callback may arrive after the task has changed. And a trading assistant may produce a plausible order that violates loss constraints no one implemented outside its prompt. These are different mechanisms, but all expose the same mistake: confusing an agent's plan or memory with authoritative state about an external effect.
The uncertain-result problem
Deekshith Marla and colleagues evaluated 336 synthetic recovery histories in LangGraph and Temporal in Permission to Retry. For each host, the retained-effect-ledger policy handled 42 of 42 defined cases; three alternatives passed 30, 36 and 31. The ledger approach distinguished 21 confirmed completions, 15 justified denials and six unresolved outcomes for which reservations were preserved rather than blindly replayed. This is a conformance experiment, not a report about actual bank transfers.
A timeout alone cannot authorize a second effect. The correct decision depends on evidence held by the external system: an idempotency key, provider receipt, settled ledger record or explicit still-pending reservation. An agent's previous "I did it" message is not equivalent.
The callback can describe an older world
Detao Zeng and collaborators tested Async-RBench across 200 executable tasks, eight asynchronous scenarios and nine agents. Mean task success was about 26.0 percent under the tested delayed conditions, against 29.7 percent for a batched comparison. Duplicated callbacks and subagent failures were among the difficult conditions. The result does not establish that asynchronous systems are universally less safe; it exposes failures when execution state is not explicitly reconciled.
The model can approve a loss the platform never bounded
Mengxiao Wang and colleagues surveyed 26 agent-powered options-trading systems. Thirteen had paths to potentially unbounded loss; of 22 systems able to send orders, only ten implemented independent hard limits. This is an architectural code survey, not 13 reports of customer money lost.
| Boundary | Required independent evidence | Unsafe shortcut |
|---|---|---|
| Retry | Provider settlement or durable effect ledger | Reissuing because an LLM saw a timeout |
| Delayed callback | Task version, recipient, ownership and approval still current | Executing a stale callback against live state |
| Trade submission | Independent maximum-loss and position checks | Relying on the prompt to keep risk small |
These observations support a concrete design: retain one effect identifier through attempt, timeout, recovery and reconciliation; bind callbacks to the current authorized task state; and enforce resource and loss limits in code at the actual execution sink. Effect-bound approval should authorize a specified recipient, amount and effect, not a generic permission to keep trying.
None of the three studies measures fraud caused by these flaws in the wild. Their value is identifying which external fact must be checked before autonomous recovery changes money, privileges or persistent state.