If a deployment or change goes wrong, a rollback plan returns the agent to its previous safe state. It sets out the triggers, who decides, how work moves back to people or the prior version, what happens to actions already taken, and how long it takes. Write one for every deployment stage and significant change.
What does rolling back an agent involve?
A rollback in software means returning to the previous version. With an agent, there are usually three things to roll back, and they move at different speeds. Each stage of train, shadow, certify, widen needs its own version of the plan.
- Configuration: the brief, sources, bounds or model version. This is quick if the prior version was kept.
- Volume: work the agent was handling must go back to people, or to the previous agent version. This needs staff.
- Actions already taken: some can be undone, some only compensated, some not at all.
Most plans cover the first and forget the other two. The template covers all three.
When should you use it?
Write it alongside the AI agent deployment plan, with a section for each stage: shadowing (little to roll back), first widening (some volume and actions), full volume (the most). Write a short version for each significant change logged in change control.
Test it before the stage it covers. A plan that returns all volume to people is only real if those people are available, so check against your capacity plan; how to plan capacity for AI agents and how to plan staffing when an AI agent takes on volume both cover this.
How do you fill in each field?
- Triggers are measurable: held items rejected more often than a set level, complaints mentioning the agent above a threshold, a critical QA failure, a source system fault. Add "any named decision-maker's judgement".
- Decision-maker is a named role, with a deputy. Rollback decisions should take minutes, not meetings.
- Configuration steps reference the exact prior version.
- Volume return names the team, how many people, and how quickly they can take the work. If approvers are away, the approver absence cover plan should already name stand-ins.
- Action review lists actions taken since the change and classifies each: leave, undo, compensate, contact customer.
- Time to safe state is the target time from decision to no further agent actions under the bad configuration.
The template
| No. | Field | What to write |
|---|---|---|
| 1 | Agent, change or stage | What this plan covers |
| 2 | Previous safe state | Version and depth to return to |
| 3 | Triggers | Measurable conditions and judgement |
| 4 | Decision-maker and deputy | Named roles |
| 5 | Configuration rollback steps | Exact steps, prior version reference |
| 6 | Volume return | Team, headcount, time to absorb |
| 7 | Work in flight | Held, drafted, part done |
| 8 | Actions already taken | How identified; leave, undo, compensate |
| 9 | Customer communication | If customers were affected |
| 10 | Time to safe state | Target |
| 11 | Verification | How you confirm the rollback worked |
| 12 | Tested | Date and result |
A filled sample
A hypothetical insurer widening its claims intake agent from drafting acknowledgements (depth 2) to sending them (depth 3).
| No. | Entry |
|---|---|
| 2 | Brief v5, acknowledgements at depth 2 (handler sends) |
| 3 | Any acknowledgement sent with the wrong claim reference; more than 5 complaints in a week about acknowledgements; QA critical fail; head of claims' judgement |
| 4 | Head of home claims; deputy: claims operations manager |
| 5 | Set "send acknowledgement" capability back to depth 2 in agent configuration; confirm brief v5 active |
| 6 | Claims handlers resume sending; expected extra load of 300 per day, absorbed by the team of 12 at 25 each |
| 7 | Drafts not yet sent return to handler queue |
| 8 | Report of acknowledgements sent since widening, checked for errors; any wrong ones followed by a corrected letter and apology |
| 9 | Corrected letter template pre-approved |
| 10 | 15 minutes from decision |
| 11 | Verdict record shows sends held for handlers after rollback time |
| 12 | Tested in pre-production; depth change took effect in under two minutes |
Row 6 is the one to check hardest. Rolling back is only safe if the team can take the work. Here, 300 extra sends a day is manageable. At full intake volume it might not be, and the plan would need more staff on standby.
Questions people ask
Is rollback the same as suspension?
No. Suspension stops an agent or capability. Rollback returns it to a known earlier state, which may still be active. You might suspend first, then roll back and resume.
How long should we keep previous versions?
At least until the new version has run through a full certification period without incident, and in records for as long as decisions made under the old version must be explained.
Who should test the rollback?
Operations, with the agent's technical team, before each stage. Include the people who would take the volume back, so they know what to expect.