How Invoke Controls Agent Actions

When your agent takes a real action through Invoke, whether from the SDK or over MCP, Invoke decides whether it may run, runs it at most once, and records exactly what happened. Nothing reaches the tool until every check has passed.

Invoke doesn’t replace your agent framework. It controls what happens when the agent reaches for a real tool. Keep your LangChain chains, Claude Code tools, OpenAI functions, MCP servers and custom scripts as they are.

The execution loop

The agent names an action

It names the tool, the arguments, who is acting, and an idempotency key that names the action.

await invoke.call({
  tool: "stripe.charge_customer",
  params: { customer_id: "cus_123", amount: 2400, currency: "usd", invoice_id: "inv_881" },
  agentId: "billing-agent",
  idempotencyKey: "invoice:inv_881",
})

Invoke admits it, or refuses it

In order, before anything runs:

Identity. Is the key allowed to act as this agent? An agent key can only ever be its own agent.
Duplicates. Has this exact action already run? If so, it doesn’t run again: the call gets the original receipt.
Permission. Is this tool on the agent’s allowlist?
Policy. Do your workspace policies allow it, block it, or require a human?
Claims. Is the work item, such as an issue, claimed by another agent?
Budget. Can the workspace and the agent afford it? The cost is reserved now, before the action runs.

If any check fails, the tool is never called.

The action runs once

Invoke runs the tool, then settles the reserved cost and seals a receipt. If the answer is lost on the way back, the action is marked unknown rather than failed. A tool that is safe to re-run is reconciled by sending the same action again. Anything else is held until someone checks the real system and settles it, because a blind retry could act twice.

Your agent gets an answer

call() resolves only when the action happened. Otherwise it throws, and the error’s class says whether it happened:

Outcome	Did it happen?
Resolves, `status: "committed"`	Yes, and only once. Here is its receipt.
Resolves, `status: "duplicate"`	Yes, earlier. Nothing ran again. Here is the original receipt.
`DeniedError`	No. A check refused it, and `err.decision` says which.
`ApprovalRequiredError`	Not yet. It’s waiting for a human.
`ToolError`	No. The tool failed and nothing changed.
`OutcomeUnknownError`	Maybe. The answer was lost after the tool got the request.

The receipt

Every committed action gets a receipt, signed when it commits, recording who acted, why, the input, the output, the cost, and any approval:

{
  "receipt_number": "#e59a65d7",
  "who": { "agent_id": "coding-agent" },
  "tool": "linear.update_issue",
  "input": { "issue_id": "DRA-8", "state": "Done" },
  "result": "committed",
  "cost": { "usd": 0.001 },
  "replay_count": 1,
  "alg": "HMAC-SHA256",
  "verified": true,
  "sealed_with": "current"
}

verified means the ledger still matches what was signed. replay_count counts the repeats that were answered with this receipt instead of running again.

One kernel, two doors

Agents that speak MCP, such as Claude Code, connect to your workspace’s MCP endpoint. Code uses the SDK. Both go through the same checks and the same ledger, so an action gets the same governance and the same receipt whichever way it arrives.

Get Started

Core Concepts

Guides

SDK & CLI

Configuration

How Invoke Controls Agent Actions

The execution loop

The receipt

One kernel, two doors

​The execution loop

​The receipt

​One kernel, two doors

The execution loop

The receipt

One kernel, two doors