What security implications arise from at-least-once execution of external side effects in Catalyst's agent runners?

At-least-once execution means external API calls may be retried, potentially causing duplicate charges or data writes. Catalyst's workload identity and MCP authorization policies help control which tools are called, but idempotency is critical for security-sensitive operations like payments. Implement idempotency keys and audit logging to detect and mitigate duplicate side effects.