An onboarding agent sends a batch of 20 invitations. The API returns HTTP 200. Its body contains 17 successes, two rate limits and one permission error. The tool adapter collapses the response to {ok: true}, so the agent tells the operator everyone has access. The server accepted the batch envelope, but three requested outcomes did not happen.

This is a real class of API contract. Microsoft Graph's JSON batching documentation says an outer 200 does not imply individual operations succeeded and individual responses can arrive in a different order from requests. Our invitation workflow is hypothetical. The key mistake is converting a transport-level acknowledgement into business-level completion before preserving item outcomes.

I would make the tool return a typed result per invite with stable request ID, target identity, status, external operation ID and error class. Verify that every requested ID appears exactly once in the response or mark the result incomplete. Match by ID, not array index. The agent can truthfully report “17 invited, two waiting on rate limits, one denied” and point to the affected users without leaking unrelated details. Its workflow state should track each target independently, so a failed item does not erase 17 successful writes.

What should retries do? Retry only outcomes classified as retryable, respecting per-item retry-after or service policy and a bounded budget. Use a stable idempotency key or reconcile by target and operation ID before repeating an invite, because a timeout after an accepted write may leave the outcome unknown. A permission failure needs a grant or human intervention, not blind retries. If the outer request fails before individual statuses arrive, do not assume all failed. Query or reconcile the downstream state first when duplicates matter.

If the interviewer says the user wanted an atomic “all 20 or none,” then this batch API cannot provide that guarantee by itself. Either choose a service with a true atomic operation or design an explicit saga, with a documented compensation and its limits. You cannot unsend an invitation email merely by deleting a grant. Decide the product contract before the agent claims completion. A tool returns 202. Has the agent completed the action? asks whether an async 202 means one action is finished. Here the batch wrapper returns 200 while several item-level actions fail. The answer must preserve the item boundary all the way into the agent's response.