An agent retries a tool call after a network timeout, but the first call may already have created the ticket. Which approach best fits?

1. Expose or authorize only the required tool subset for that task.
2. Use stable operation identifiers and idempotent tool handling.
3. Treat tool output as untrusted data and preserve session authorization.
4. Resolve the secret inside trusted execution code using controlled runtime access.