---
id: RT-TOOL-9
family: RT-TOOL
level: extended
profiles: [runtime]
posture: normative-target
added: "1.0"
changed: "1.0"
source: https://flowdrop.io/spec/rules/rt-tool/rt-tool-9
specification: FlowDrop Workflow Specification 1.0-draft
licence: CC BY 4.0
---

# RT-TOOL-9 — A tool call executes at most once per run

*RT-TOOL (Part II) · level: extended · profiles: runtime · added in 1.0*

A tool call has side effects. One node can be reached twice in a run (by a fan-in, or by a re-ask after a human approved a gated call), and the same batch of calls arrives with it.

## The rule

> **Normative.** This is the rule.
>
> 1. A run records each tool call it has executed, keyed by the call identifier, and does not invoke a call whose identifier it has already recorded.
>
> 2. The repeat is reported on a `skipped` output, and the stored result of its first execution (the tool-role message and whether it succeeded) is re-emitted among the run's tool messages and results and counted in the batch's outcome.
>
> 3. Re-emitting rather than dropping is required: a batch that paused midway never delivered the already-executed call's message downstream, so dropping the repeat would leave a declared call identifier unanswered and invite the model to retry it under a fresh, unguardable one.
>
> 4. A call is recorded only once it has returned a result, success or a recoverable error, and never before it is invoked, so a call that interrupts the node for human approval is re-asked and executed once approved, rather than looking already-executed and being silently dropped.
>
> 5. A call that carries no identifier cannot be guarded and always runs.

## Related rules

- Names: RT-TOOL-10
- Referenced by: RT-TOOL-10

---

Rule identifiers are permanent and are never renumbered. This specification carries
no implementation status: each implementation publishes its own standing against
these rules. Licensed CC BY 4.0.