A calendar is a shared, mutable resource, and an AI agent is a client that writes to it without seeing the whole picture. Double bookings rarely come from carelessness. Three structural causes dominate: separate calendars that cannot see each other, proposed times that sit unprotected while a reply is pending, and a booking interface that cannot see real availability Chronock's analysis. When an agent books on behalf of a caller, it inherits all three.
Anthropic's review-mode pattern is worth copying here. In that design, a receptionist agent drafts the booking but waits for staff confirmation before writing to the system of record, then graduates to auto-sync once its judgment has been watched against real traffic Elva's handoff guide. The same principle applies to calendars: watch what the agent wants to write before you let it write alone, and keep a sweep running after you do.
There is also an ordering problem. Two agents can read the same empty slot at the same instant, both conclude it is free, and both write. The fix is idempotency plus a conflict check inside the write path, a pattern Stripe documents for its own API where a repeated request carries the same key and produces one result rather than two Stripe's idempotent requests reference. Treat a calendar insert as a transaction with a re-read and an overlap test in the same unit of work.
Anthropic's warning that models may soon act across devices and systems on their own makes this more urgent, not less. The more autonomous the writer, the more the guardrail has to live in the data layer.



