Every action an AI agent can take belongs in an action reversibility register, with a record of whether it can be undone, how, by whom, within what window, and what traces remain. It is the evidence behind depth decisions: the harder an action is to reverse, the more proof you need before an agent takes it alone.
Why does reversibility decide autonomy?
In a regulated business the question that matters about an autonomous action is not how often the agent is right. It is what happens on the day it is wrong. If the action can be cleanly reversed, a mistake is an inconvenience. If it cannot, the mistake is a harm. The guide to regulated autonomy makes this the organising question.
The register turns that idea into a table someone can check. Depth 3 covers routine work within bounds; depth 4 covers moving money and actions that are hard to undo. Without a register, "hard to undo" is a matter of opinion. With one, it is a recorded classification with an owner.
When should you build the register?
Build it when you first list the actions an agent will take, before any are switched on, and extend it every time a new operation is connected. It sits naturally beside the AI agent inventory register: the inventory says which agents exist, this register says what each of their actions does to the world.
Revisit an entry whenever the downstream process changes. An action that was reversible because a batch ran overnight becomes irreversible if the batch moves to real time.
How do you classify each action?
Classify by effect, not by system. The same database write can be trivial in one place and permanent in another.
- Reversible. The prior state can be restored exactly, with no trace outside your systems.
- Compensable. The action stands, but a second action offsets it: a refund for a charge, a correcting entry for a posting. The idea is explained in what a compensating action is.
- Window-bound. Reversible only until a cut-off, such as a payment file before submission.
- Irreversible. Once done, the effect cannot be withdrawn: a message read, data disclosed, a settled payment on another party's rail.
Communications deserve care. A message sitting unread in an outbox is reversible; a delivered one is not. The argument is set out in whether sending an email is an irreversible action for an AI agent.
Where an action is window-bound or irreversible, ask whether it can be staged: prepared in full, held, and released by a person. A staged action moves the irreversible moment out of the agent's hands.
The action reversibility register template
| Field | Guidance |
|---|---|
| Action ID | Stable reference, such as A-021 |
| Action | Verb and object, as named in the agent's brief |
| System | Where the action takes effect |
| Agents able to take it | Agent names |
| Class | Reversible, compensable, window-bound or irreversible |
| How it is undone | The exact operation or procedure |
| Who may undo it | Role or named team |
| Reversal window | Time limit, if any |
| Traces left after reversal | Notifications, third-party records, audit entries |
| Can it be staged? | Yes or no, and how |
| Maximum depth allowed | The highest depth any agent may hold for this action |
| Owner and review date | Named person; last confirmed |
A worked sample
A hypothetical payments business, five rows:
| Action ID | Action | Class | How undone | Window | Traces left | Staged? | Max depth |
|---|---|---|---|---|---|---|---|
| A-001 | Add note to customer case | Reversible | Mark note void | None | Audit entry | No need | 3 |
| A-007 | Apply fee refund to account | Compensable | Re-apply fee with reason | None | Statement line | No need | 3 |
| A-012 | Add payment to outgoing file | Window-bound | Remove from file | Until file submitted | None if removed in time | Yes | 4 |
| A-015 | Send account email to customer | Irreversible once delivered | Send correction | Until delivery | Customer has read it | Yes, as draft | 2 unless templated |
| A-019 | Reverse a settled payment | Irreversible on settlement | Not by agent | None | Ledger and counterparty records | Not applicable | Withheld |
A-019 shows the link to the platform guardrails register. When the register's answer is "no agent, at any depth", the action becomes a guardrail and every attempt produces a withheld verdict.
A-015 shows how the class can shape depth. A free-text email stays at depth 2, drafted for a person to send. A fixed template, already approved, may go higher because what it says cannot drift.
Questions people ask
Who should own the reversibility register?
Operational risk usually owns it, with each entry confirmed by the owner of the system where the action takes effect. The agent team proposes classifications; it should not be the one to approve them.
Does "compensable" count as reversible for depth decisions?
Not quite. A compensating action fixes the balance but leaves the customer with an experience, and sometimes a record, they did not choose. Treat compensable actions as a step closer to depth 4 than truly reversible ones.
How detailed should "how it is undone" be?
Detailed enough that someone who has never done it could follow it under pressure. If you cannot write it that way, the action is probably less reversible than you think.