Reversible Action

A reversible action is one whose effect can be undone completely, leaving no trace that matters. It is the most useful axis for deciding how much autonomy to give an automated system, because it separates the mistakes that cost an afternoon from the mistakes that cannot be taken back at all. Three categories are worth keeping apart. Truly reversible actions can be restored to the prior state: a draft edited, a record updated where the previous value was kept, a file written to a location you control. Compensable actions cannot be undone but can be offset by a second action — a refund after a charge, a correction after a wrong invoice — and the compensation is usually visible to somebody. Irreversible actions have no remedy: a message read by a customer, a deletion with no backup, a payment to an external party, anything published where it will be copied. Autonomy should follow that classification directly. Reversible work is where agents earn their keep and where approval queues waste everyone's time — let it run, log it clearly, and make undo cheap and obvious. Compensable work can often run unattended with a tighter limit and a report. Irreversible work is where a human decision belongs, and the number of irreversible actions an agent can take without one is a fair summary of how much risk the design actually carries. The classification is easier to state than to apply, because reversibility leaks. An update is reversible only if the old value was stored. A deletion is reversible only until the backup window closes. A record change looks reversible until a webhook has already carried it to three other systems, each of which has its own copy and its own idea of the truth. The honest test is whether you have restored something in practice, not whether an undo feature is documented. The design move that follows is to arrange for reversibility rather than to argue about it: write to a staging area, keep the previous version, batch outbound messages with a delay before they leave, and prefer proposing a change to making one. That is usually cheaper than the review process you would otherwise need, and it holds up when a run goes wrong at three in the morning with nobody watching.