Agent incident playbook · practical first

Webhook timeout or duplicate execution?

Respond promptly without accidentally repeating a payment or external action.

Fix it first

1. Verify whether timeout occurs before the webhook acknowledgement or during a downstream operation.
2. Persist the provider's event ID before acknowledging, enqueue the work, and deduplicate every replay using that ID.
3. If a paid operation may have settled, mark delivery UNKNOWN and inspect evidence before attempting any replay. Payment Rescue is advisory only.

Safe starter code

const seen = new Set(); // For production, use a durable shared database.
async function receiveWebhook(event, acknowledge, enqueue) {
  if (!event?.id) throw new Error('Provider event ID required');
  if (seen.has(event.id)) return acknowledge(200);
  // Queue must durably accept the event before acknowledging.
  await enqueue({ id: event.id, payload: event });
  seen.add(event.id);
  return acknowledge(202);
}

Illustrative code. Adapt persistence, request validation, authorization and provider APIs to your production environment. No payments are performed by this example.

Optional HumanMirror service

Safe Preflight — 0.010 USDC per explicitly authorized call on Base. The live HTTP 402 response is authoritative; an independent buyer must authorize each paid request.

Scoped B2B help

Want a human-reviewed fixed-scope report instead of another tool? The Agent Safety Audit is €299, the 14-day Production Pilot €990. Confirm scope and acceptance criteria before purchasing.