Once.
MICROSOFT AGENT FRAMEWORK / SAFE TOOL EXECUTION

Make consequential Microsoft Agent Framework tools safe to retry.

Agent tools can trigger refunds, payments, bookings, orders and other external writes. If an action succeeds but its response is lost, blindly invoking the tool again can repeat the real-world side effect.

Short answer: Give the logical operation a stable identity and route supported consequential execution through durable state and provider reconciliation instead of treating every tool call as a new action.

The retry failure

  1. An Agent Framework agent invokes a consequential tool.
  2. The external provider performs the action.
  3. The response is lost, times out or becomes ambiguous.
  4. The agent cannot prove whether the action happened.
  5. The tool is invoked again.
  6. A blind retry can duplicate the side effect.

The Once pattern

operation_id = Once.id("refund", order_id)

result = once.execute(
    operation_id=operation_id,
    provider=provider,
    action={
        "type": "refund",
        "order_id": order_id,
    },
)

The same logical refund receives the same operation ID on every retry. Another agent tool invocation is therefore not automatically treated as permission to perform a new external action.

Microsoft Agent Framework example

The Once repository includes a working Python example using Microsoft Agent Framework tools with the public once-agent-sdk package.

View the Once + Microsoft Agent Framework example on GitHub

Claim boundary: Once does not claim universal exactly-once execution. Safety depends on stable operation identity, durable Once state, the provider integration and sufficiently authoritative provider truth. When the outcome cannot be established safely, Once can preserve uncertainty instead of blindly repeating the action.

Add execution safety to Agent Framework tools

pip install once-agent-sdk

Try the Once tester · Python SDK · Microsoft Agent Framework example