An agent has a charge_customer tool that calls an external payment API. In production, the payment API occasionally processes a charge but the response is lost, so the tool's HTTP call times out. The agent's retry logic then calls the tool again, and some customers are charged twice. The team wants retries and agent autonomy to stay. Which change addresses the root cause?