Study tests whether AI agents can safely retry failed actions

The problem

AI agents that use tools, such as sending a payment or updating a record, can be interrupted halfway. When they restart, they face a hard question: should they try the action again? A new paper, submitted to arXiv on 22 October 2026 by Deekshith Marla and Kushagra Bhatnagar, studies exactly this ^[1].

The authors describe a durable agent that can resume a consequential action while its authority changes and while the action's external outcome remains uncertain. Retrying blindly could repeat a payment. Not retrying could leave a job unfinished. And if the agent's permissions have been withdrawn in the meantime, retrying may not be allowed at all ^[1].

What the researchers did

The paper focuses on execution-time reliability, deliberately separating recovery decisions from the behaviour of the language model itself. It treats four things as distinct obligations: the saved checkpoint state, permission to dispatch an action, evidence that an external effect happened, and permission to reconcile ^[1].

To test this, the authors built a conformance study. Histories of events are scored against a provider effect ledger that the recovering application cannot see. A frozen campaign ran 336 histories on two widely used workflow hosts, LangGraph and Temporal, across 14 schedules, three provider contracts and four matched application policies ^[1].

What they found

All 168 paired host cells produced identical checked outcomes, so the two hosts behaved the same way in this test ^[1].

For the approach that retains a ledger and reconciles against it, all 42 histories per host passed. Of these, 21 were checked completions, 15 were denials and six were unknown outcomes where reservations were retained ^[1]. In other words, where the system could not tell what happened, it kept the record open rather than guessing.

Simpler strategies fared less well. Cached retry passed 30 histories, revalidation before retry passed 36, and stable-key retry passed 31 ^[1]. The paper does not state the totals for those strategies in the abstract, so the comparison is best read as indicating that they pass fewer cases than ledger reconciliation.

A separate 16-case component study examined InfinityOS, an enterprise AI platform developed by the authors' organisation, exercising its authority, worker, recovery and settlement code ^[1]. Because the authors are connected to that platform, readers should treat that part with appropriate caution.

Why it matters

For companies deploying agents that act on real systems, the lesson is that recovery needs its own design. Current permissions, the contract with the external provider and a retained record of what was observed all play separate roles in deciding whether a retry is safe ^[1].

Limits

This is a seven-page preprint with two figures and three tables, and arXiv posts such papers before peer review. The results apply to the declared application profile, with safety, completion and unresolved obligations reported separately ^[1]. They should not be read as proof that any particular product is safe.

Even so, the study gives practical vocabulary for questions buyers should ask: what happens when an agent crashes mid-task, and who checks that it still has permission to continue?

Source: arXiv — Permission to Retry: A Study of Authorization and Recovery in AI Agent Workflows