Sometimes, depending on what kind of action it was. Changes inside your own systems can usually be rolled back if the prior state was recorded. Payments and refunds can only be offset by a compensating action. Messages that were read, data that was disclosed and filings that were made cannot be undone, so a person should approve them first.
What are the three kinds of agent action?
Every action an agent takes falls into one of three groups, and the group decides what "undo" means.
Reversible. The action changed something inside your own systems and nobody outside has relied on it yet. Updating a field, moving a ticket, tagging a document. If you kept the prior value, you can restore it.
Compensable. The action cannot be reversed, but a second action can offset it. A refund paid in error cannot be pulled back from the customer's bank; you can only ask for it, or adjust a later payment. A journal posted to the wrong account is not deleted; it is reversed with a new entry. The original stays in the record.
Irreversible. The action left your control. An email was read, a report was filed, personal data was sent to the wrong person, a contract was signed. You can apologise, correct and notify, but you cannot restore the state before.
The case for basing autonomy on these groups is set out in why autonomy in regulated industries is a question about reversal.
What do you need before you can undo anything?
Undo is not a button. It is a procedure, and it only works if you prepared for it before the agent acted. You need:
- A record of exactly what the agent did. Which system, which record, which fields, which values, at what time and under which permission.
- The prior state. The value before the change, kept with the change itself.
- The scope of the mistake. Not just this action, but every action taken under the same faulty instruction, source or rule.
- A defined compensating action for anything that cannot be rolled back.
- A named person who approves the undo, because undoing at scale is itself an action with consequences.
Point three is where most teams struggle. Finding every affected case needs a record of what the agent checked, including checks that found nothing; the argument is made in why compliance agents must record what they did not find. For how to read the record itself, see how to audit what an AI agent did.
A worked example of an undo
Take a lender's servicing team. An agent updates customers' correspondence addresses from a batch of change requests. A fault in the source file shifts the columns for 60 rows, so 60 customers receive each other's addresses.
The team lead stops the capability at once, and it drops to read-only. The record shows every update made from that file, with the old value beside each new one. Restoring the 60 addresses takes minutes.
But two statements were posted to wrong addresses before the fault was caught. Those cannot be undone. They are a disclosure of personal data, handled under the data breach procedure, with notifications assessed by the privacy team. The rollback fixed the data; it did not fix what happened while the data was wrong.
Who decides to undo, and who does it?
A person decides. The agent may carry out the rollback, because restoring recorded prior values is a routine, bounded action. Compensating actions, such as reversing payments or sending correction letters, are drafted by the agent and approved by a person, just as the originals should have been.
Write the steps down in advance. The undo procedure template for agent actions gives a structure: trigger, scope, rollback, compensation, notification and sign-off.
What should you do about actions you can't undo?
Put a person in front of them. If an action cannot be reversed or compensated, the only control that works is approval before it happens. External messages with free text, data disclosures, filings and payments to new recipients belong here.
For everything else, design for undo: keep prior values, make actions idempotent so a retry does not double them, and make sure the record ties every action to the instruction, source and permission that produced it.
Where Pryme fits
In Pryme, every verdict is filed in an append-only record with the source, bound and person behind it, which gives an undo its scope. Some actions are withheld outright, such as reversing a settled payment on our own rail, because a reversal there is itself an action that cannot be taken back.
Questions people ask
Can the agent undo its own mistakes?
It can carry out a rollback that a person has approved. It should not decide on its own that it made a mistake and start reversing actions, because a confused agent undoing work can do as much damage as the original error.
How long should prior values be kept?
At least as long as it takes to detect most errors in that process, and in line with your retention rules. For data subject to retention limits, keep the change record but not more personal data than you need.
Does undoing an action remove it from the audit record?
No. The original action, the undo and the reason for it all stay in the record. An audit trail that loses entries when actions are reversed cannot be trusted.