I’m building several SaaS products with Codex and product-specific MCP/plugin workflows. My current pattern uses scoped OAuth, exact workspace and project authorization, explicit human approval before consequential actions, and read-back verification afterward.
I’d be interested in comparing approaches to idempotency, ambiguous tool results, permission boundaries, and keeping credentials out of agent context. What patterns have worked well for others?
For cross-product MCP actions, I’ve found it useful to treat the tool call as a small command protocol rather than just request/response.
For each mutating call, carry an idempotency key plus any resource precondition/version you can get. Then make the executor return one of three semantic outcomes: `committed`, `rejected`, or `unknown`. `unknown` is important: a timeout does not prove the remote side failed. Reconcile with the provider (read-back, operation lookup, idempotency lookup) before retrying.
I’d keep auth similarly explicit: the model supplies the intended action, but the runtime injects verified principal/workspace context and brokers the credential server-side. The model never gets to choose its own identity or raw secret.
For higher-impact writes, bind human approval to the normalized tool + arguments + target. If any security-relevant argument changes, require a new decision. That keeps retries reliable without turning approval into a reusable blanket grant.
On keeping credentials out of agent context, does any agent-accessible code execution share the environment that holds the credentials? Keeping keys out of the prompt is a weaker boundary if the agent’s shell can still read them.