Idempotency key
A unique value that a client sends with a request that must not take effect twice, such as a payment, so the server performs the operation once and returns the stored result when the request is retried with the same key. The server must scope keys to the caller and record them atomically with the result.
Covered in
Bound background jobs and make retries safe
Keep queues, workers and paid dependencies within a defined budget when clients retry, cancel or disappear.
Preserve business invariants under concurrent requests
Make a balance, reservation or approval rule hold when requests overlap, retry and fail halfway through.
Secure design patterns: a catalogue for insecure-design (A06)
A catalogue of reusable secure-design patterns, grouped by concern, each with when to use it, a short example and the failure it prevents: choke-point authorization, capability tokens, parse-don't-validate, safe-by-default APIs, tenant scoping, fail-closed, idempotency, and more.
Authorize agent tools outside the model
Bind each proposed action to the user, resource and approved arguments before allowing a tool to cause a side effect.
Practice: Race condition lab: Repair a balance check that races · Excessive agency lab: Bind an agent’s action to the approved arguments · Business logic lab: Price an order without trusting the client · Local project: Make a checkout transaction atomic