The Four Gates Between a Tool Call and a Business Outcome

Tool, agent-computer-interface and protocol engineering decides whether an AI agent's action actually happened, not just whether its call returned successfully. A tool that parses, executes and reports success can still leave the wrong record in a production system, or none at all, and a retry can duplicate the very effect it was checking for. Executives funding agents that touch payments, claims, tickets or inventory need to know that schema validity, successful invocation and a completed outcome are three separate questions.

What it is

A tool schema describes what an agent can call and what its arguments and results look like. An action contract sits above it: the preconditions that make a call safe, the authority it needs, the side effects it causes, and the postcondition that proves it worked. An agent-computer interface is how the model sees all of this. A protocol standardizes how the exchange travels between a model and a server, or between two agents, and an adapter translates its promises into what a specific backend actually does.

Four principles hold this together. Idempotency is not the same as reliable delivery: a repeatable operation still needs a mechanism that knows whether it was already sent. Cancellation requests termination, it does not undo what already committed. A protocol version string proves nothing about deployed behavior, an adapter has to be tested against what a provider actually implements. Tool results are data the agent reads, not instructions with authority: a result telling the model to grant itself a new permission should never be honored just because it arrived inside a tool response.

The architecture

I call the discipline that closes this gap the four-gate action chain: valid, invoked, authorized, verified. Each gate is a separate question with its own evidence, and a call only counts once it has cleared all four.

Valid asks whether the call parses and its arguments satisfy the schema. Invoked asks whether the call actually reached the backend and executed there, something a client can fail to know if the acknowledgment is lost in transit. Authorized asks whether the principal holds the authority for that specific action, checked outside the model's own text so a tool result can never grant itself a new permission. Verified asks whether backend state changed as intended, confirmed independently rather than inferred from a success flag the tool itself returned.

The gate skipped most often is the fourth. In a funds transfer where the backend commits it but the acknowledgment never reaches the client, the client sees the same timeout it would see had the transfer never happened, so a blind retry can duplicate it. The correct move is to query durable status before retrying anything not provably idempotent. An idempotency key must bind principal, operation, target and payload together, and a request reusing a key with a different payload must be rejected outright.

Two 2026 protocol revisions show this cannot be delegated to the wire format. The Model Context Protocol's July 28, 2026 release made its core stateless and self-describing and moved durable Tasks into an optional extension. The Agent-to-Agent protocol's 1.0 specification, released March 12, 2026 and patched in May, leaves Send Message idempotency optional rather than guaranteed. Both standardize how an exchange travels. Neither guarantees a duplicate-free outcome, so the fourth gate has to live in the application, not the protocol.

The same reasoning covers tool catalogs. A catalog of a thousand tools averaging 120 description tokens each costs about 120,000 tokens before an agent does anything. Discovery narrowing that to eight candidates cuts it to under a thousand tokens, arithmetic that says nothing about the case where the one tool needed was not among the candidates retrieved.

Ownership belongs jointly to whoever owns the product decision an agent may act on and whoever owns the security boundary it crosses, not a platform team alone: both must sign off before a tool goes live. Fund a durable operation-status store, adapter conformance tests against each provider's actual edge cases, and authorization enforcement that lives outside anything the model can read or write. Treat a clean test run with caution: with zero failures across thirty trials, the underlying failure rate could still be roughly 9.5 percent, and it takes closer to three hundred clean trials to bound that risk near 1 percent. Stop granting any tool broad execution authority beyond what the task requires, and stop accepting an optional-idempotency operation, such as A2A's Send Message, into a financially or clinically consequential workflow without a durable status check of your own.

Two calls belong to the executive alone: which capabilities may carry side-effecting authority at all, since that list defines an agent program's blast radius, and the tolerance for unknown outcomes, how long a system may sit unresolved before it escalates to a person rather than whichever engineer wrote the retry logic.

What it is worth

Money, risk and time show up in three places: duplicate side effects from a retried action never confirmed, decisions made on a pass rate never checked against ground truth, and the token cost of a catalog sized for convenience rather than what a task needs. A mid-2026 validity audit had three human experts spend 89 hours checking 496 tool-calling tasks across four benchmarks and found the automated grader disagreed with them 18.5 percent of the time, evidence that an unaudited pass rate is not proof of anything.

Measure before and after against the baselines the research uses: a small tool set on one backend, the full catalog with no discovery layer, and a durable status lookup added to the workflow. Track completion through all four gates separately, since a rising number on one can mask a falling number on another.

The 2026 evidence supports testing failure and recovery at every gate and treating a pass rate as a hypothesis, not a fact. It does not support a claim that any current protocol guarantees exactly-once effects across arbitrary providers, and no such figure, and no return-on-investment number, belongs in this essay.