# When Tool Calls Succeed but Workflows Fail: Anomalies at the Agent-Tool Boundary

arXiv: https://arxiv.org/abs/2609.15397 · HTML: https://mlsanity.com/paper/2609.15397/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 11 of its 23 references that are in the map.
- First posted on arXiv 14 Sep 2026.

## Builds on (most cited first, 11 of 11)

- [SagaLLM: Context Management, Validation, and Transaction Guarantees for Multi-Agent LLM Planning](https://mlsanity.com/paper/2503.11951/) (2025)
- [Atomix: Timely, Transactional Tool Use for Reliable Agentic Workflows](https://mlsanity.com/paper/2602.14849/) (2026)
- [Cordon: Semantic Transactions for Tool-Using LLM Agents](https://mlsanity.com/paper/2606.17573/) (2026)
- [Shepherd: Enabling Programmable Meta-Agents via Reversible Agentic Execution Traces](https://mlsanity.com/paper/2605.10913/) (2026)
- [ACRFence: Preventing Semantic Rollback Attacks in Agent Checkpoint-Restore](https://mlsanity.com/paper/2603.20625/) (2026)
- [S-Bus: Automatic Read-Set Reconstruction for Multi-Agent LLM State Coordination](https://mlsanity.com/paper/2605.17076/) (2026)
- [Verified Detection and Prevention of Concurrency Anomalies in Multi-Agent Large Language Model Systems](https://mlsanity.com/paper/2606.17182/) (2026)
- [Revisable by Design: A Theory of Streaming LLM Agent Execution](https://mlsanity.com/paper/2604.23283/) (2026)
- [Robust Agent Compensation (RAC): Teaching AI Agents to Compensate](https://mlsanity.com/paper/2605.03409/) (2026)
- [A Large-Scale Dataset of MCP Implementations on GitHub](https://mlsanity.com/paper/2607.10123/) (2026)
- [Agentic Transaction: Towards ACID-Compliant Agent Systems](https://mlsanity.com/paper/2608.13900/) (2026)

## Abstract (arXiv)

AI agents increasingly execute long-running workflows that externalize effects through independently supplied tools. Under retries, speculative execution, concurrency, and partial failures, the resulting external state may be inconsistent with the workflow's intended resolution: required effects may be missing or duplicated, aborted effects may survive, and committed effects may depend on provisional state that is later withdrawn. Advanced transaction models address related failures, but assume that lower-level operations expose the semantics they depend on: whether an effect occurred, whether it can be compensated, staged, or safely reordered. Shared agent-tool interfaces usually do not. We contribute an effect-history model that separates events in the external world from the runtime's observations of them, and a catalog of eight recurring external-effect anomalies. From the catalog we derive the boundary capabilities required to exclude each anomaly in general, and four points where black-box tool invocation alone cannot provide a general guarantee. We then ask how much of this is expressible in a widely used shared tool interface, measuring the use of the standard annotation vocabulary across 98,291 tools exposed by registered Model Context Protocol (MCP) servers. The fields are widely emitted but provide only coarse call-level hints, and none of the required capabilities is fully expressible. These results motivate reusable transactional contracts at the tool boundary.