Abstract
AI agents increasingly invoke tools that create externally visible side effects, including payments, refunds, bookings, messages, account changes, deployments, orders, and other mutations. When a tool invocation crosses a network boundary, a timeout or lost acknowledgement can leave the caller unable to determine whether the external effect occurred. A naive retry may therefore transform a recoverable communications failure into a duplicate real-world action.
This paper frames that condition as an ambiguous-outcome execution problem and presents a practical execution-safety model based on stable logical operation identity, effect binding, durable outcome state, conservative handling of UNKNOWN outcomes, and authoritative reconciliation where available.
It also describes selective protection: read-only and generation-only tools can remain direct, while consequential mutations are routed through a protection boundary and semantically uncertain tools fail closed.
Once is presented as a reference implementation of this model, including same-machine durable protection, MCP/tool discovery, framework integrations, and hostile-retry evidence across multiple agent frameworks.
The paper does not claim universal exactly-once execution. Instead, it specifies the conditions under which a one-effect invariant can be demonstrated and the cases that remain dependent on downstream provider guarantees and authoritative reconciliation.