A recent builder question described an HVAC call that changes halfway through. The caller starts booking a normal appointment, then mentions an emergency. If the language model controls both the conversation and permission to execute tools, the earlier booking can still complete after the call has moved into the emergency path. A retry can also create the same booking twice. I would separate the system into three parts: 1. The conversation layer collects details and proposes the next action. 2. A deterministic validator checks required fields, explicit confirmation, current state, and business policy. 3. The workflow executes the action with an idempotency key, so the same request cannot create a second side effect if it is retried. When the caller changes intent, increment the state version. Any result tied to the older version becomes stale and must not write to the CRM or calendar. Keep the earlier booking details as a read-only snapshot. If the emergency was misclassified, resume from that snapshot and reconfirm anything time-sensitive. I have not implemented this exact HVAC sequence end to end. This is the architecture pattern I would use for a mutating workflow where interruption and retries can overlap. Where does your current build authorize the final action: inside the prompt, inside n8n, or in an application layer outside both?