Ilmu Komputer & AI editorial
When Tool Calls Succeed but Workflows Fail: Anomalies at the Agent-Tool Boundary
The core problem
AI agents increasingly execute long-running workflows that externalize effects through independently supplied tools. Under retries, speculative execution, concurrency, and partial failures, the resulting external state may be inconsistent with the workflow's intended resolution: required effects may be missing or duplicated, aborted effects may survive, and committed effects may depend on provisional state that is later withdrawn.
Advanced transaction models address related failures, but they assume that lower-level operations expose the semantics they depend on: whether an effect occurred, whether it can be compensated, staged, or safely reordered. Shared agent-tool interfaces usually do not. This paper asks what guarantees are possible when tools are invoked as black boxes, and how much of the required semantics can be expressed in a widely used shared tool interface.
The authors contribute an effect-history model that separates events in the external world from the runtime's observations of them, and a catalog of eight recurring external-effect anomalies. From the catalog they derive the boundary capabilities required to exclude each anomaly in general, and four points where b
Innovation
The empirical analysis of 98,291 MCP tools shows that the standard annotation vocabulary is widely emitted. However, the fields provide only coarse call-level hints. None of the required boundary capabilities is fully expressible in the shared interface.
Specifically, the annotations can indicate that a call is read-only or destructive, or that it may interact with the external world, but they cannot express whether a specific effect occurred, whether it can be compensated, staged, or safely reordered. As a result, the runtime cannot in general exclude the eight anomalies using black-box tool invocation alone.
The authors identify four points where black-box invocation cannot provide a general guarantee. These correspond to capabilities that require information beyond call-level hints: effect occurrence, compensability, stageability, and reorderability. The measurement confirms that the shared interface lacks the expressiveness to convey these properties.
These results motivate reusable transactional contracts at the tool boundary. Such contracts would allow tools to declare the semantics that advanced transaction models depend on, enabling the runtime to reason about external e
Why it matters
The paper's central insight is that successful tool calls do not imply a successful workflow. The gap between the runtime's observations and the external world is where anomalies arise. The effect-history model makes this gap explicit by separating events from observations.
The catalog of eight anomalies provides a systematic way to reason about external-effect failures. By deriving the boundary capabilities required to exclude each anomaly, the authors show that the problem is not merely one of better retry logic or stronger transaction models. It is a problem of missing semantics at the interface.
The empirical study of MCP tools demonstrates that current practice does not provide these semantics. The annotation vocabulary is widely used but coarse. This is not a criticism of individual tool authors; it reflects the absence of a standard for expressing transactional properties.
The proposed direction is reusable transactional contracts at the tool boundary. Such contracts would allow tools to declare whether an effect occurred, whether it can be compensated, staged, or safely reordered. With these declarations, the runtime could apply advanced transaction models and exclude the anomalies in general.
The paper leaves open questions about how to design and standardize such contracts, how to verify compliance, and how to handle tools that cannot provide the required guarantees. Nevertheless, it provides a clear diagnosis and a principled path forward for building reliable agent workflows.
Who should read this
Opening member content…