Give each job an identity
Use a unique identifier and save whether the job is queued, running, succeeded or awaiting review. A crash should not erase the knowledge that an external action may already have happened. Reconcile uncertain outcomes before retrying.
Grant a small set of powers
Separate read-only discovery from changes that affect accounts, money or production data. Use scoped service credentials and resource limits. Keep human approval available for actions whose consequences exceed the worker’s routine authority.
Bound the retries
Use a maximum attempt count, backoff and a dead-letter or review path. Respect provider rate limits. A temporary failure should not become thousands of repeated requests or duplicate messages.
Make the record safe and useful
Log the operation identifier, outcome and relevant timestamps. Redact credentials and unnecessary personal data. Keep a way to pause the queue, revoke a token and recover from a partial action without losing the whole workflow.