Sort every action an agent can take into four classes by asking three questions: who has to cooperate to undo it, how long the undo window stays open, and what trace remains afterwards. Actions you can undo alone, without trace, can run. Actions that need someone else's cooperation, or cannot be undone at all, wait for a named person.
What is reversibility classification, and who owns it?
Autonomy in a regulated business turns on one question: if the agent is wrong, can you put it right? That is the argument of our guide to autonomy in regulated industries. Classification is how you answer it for each action, in writing, before an agent is allowed near it.
The process owner classifies the actions in their process. Risk reviews the classification and settles disputes. Operations owns the undo procedures that make a "reversible" label true. The result is a register the platform reads when it sets an agent's bounds.
Classify actions, not agents or systems. One system can host actions in every class. A payments platform can draft a payment (fully reversible), schedule one before cut-off (reversible within a window), or release one to an external bank (irreversible on many rails).
Which classes should you use?
- A. Reversible, internal. Nobody outside the team must cooperate and the customer sees no trace. Updating a case note; drafting a letter.
- B. Reversible with cost. You can undo it alone, but the customer has seen it. A fee refunded in error and then re-applied.
- C. Reversible with cooperation. Another party must act: the customer, another bank, a counterparty. A payment that must be recalled from the receiving bank.
- D. Irreversible. It cannot be undone. Data deleted without a backup; a disclosure sent to the wrong person.
Class A can run within bounds. Class B can run within tighter bounds once the agent has certified evidence. Class C and D actions are held for a person, whatever the agent's record.
How do you classify, step by step?
- Person, process owner: list every action in the process. One line each, as a verb on a system: "applies a fee waiver to the account".
- Person, process owner: answers the three questions for each. Who must cooperate to undo it? When does the undo window close? What trace remains, and who sees it? Evidence: answers recorded per action.
- Agent, depth 1: checks the list against the systems. It reads the tools the process uses and flags actions the owner missed, such as a side effect that sends a notification. Evidence: a gap list.
- Person, process owner: assigns a class. Where an action changes class over time, record both: a scheduled payment is class A until cut-off and class C after.
- Person, operations: writes the undo procedure for every class A and B action. If nobody can write one, the action is not reversible. The undo procedure template gives a structure. Evidence: a procedure per action.
- Person, risk owner: reviews and signs off. Particularly any action the owner marked reversible that touches customers or money. Evidence: sign-off with date.
- Platform: reads the register into bounds. Class sets the highest depth the action can ever reach. Evidence: bound versions citing the register.
- Person, operations: tests undo procedures. Run each one at least once. Evidence: test results.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| List actions | Nothing | none | Process owner writes the list |
| Answer the three questions | Nothing | none | Process owner records answers |
| Check for gaps | Reads tools, flags missed side effects | 1 | Owner accepts or rejects each gap |
| Assign class | Nothing | none | Process owner assigns, risk signs off |
| Write and test undo | Nothing | none | Operations writes and tests procedures |
| Apply to bounds | Acts only up to the class ceiling | per class | Reclassification needs sign-off |
Which decisions stay with a named person, and what record results?
The class itself. An agent can propose and check, but a person decides that an action is reversible, because that decision is what lets it run unattended. Disputes go to the risk owner, not to a vote. Reclassifying an action upward, from D to C or C to B, needs the same sign-off as the first classification, with a tested undo procedure behind it.
Some calls are harder than they look. A credit decision might be reversed in the system, but the customer has already been told, acted on it, and perhaps applied elsewhere. That is why whether a credit decision is reversible gets its own answer.
The method leaves a record of four parts:
- A reversibility register: every action, its class, the reasons, the undo window, the owner and the sign-off.
- Undo procedures for class A and B, each with a test result.
- Bound versions that cite the register, so every verdict can be traced to the class that capped it.
- A change history: who reclassified what, when and why.
This sits alongside, not in place of, a risk classification of each agent; how to classify AI agents by risk covers that wider view.
Where does classification usually go wrong?
The system has a reverse button, so it is marked reversible. The button undoes the record. It does not undo the customer's reaction, the email already sent, or the counterparty who acted on it.
Time is ignored. Actions that are reversible for an hour are marked reversible. Record the window and let the bound depend on it.
Side effects are missed. Changing an address triggers a card reissue. Closing a case sends a survey. Classify the whole effect.
Reversible is treated as safe. A reversible action repeated across a thousand customers is a thousand undo procedures. Reversibility lowers the stakes of one error, not the volume; the trade-off is argued in whether a reversible action is always safe for an agent to take.
The register is never reopened. Systems change and an action quietly moves class.
Where Pryme fits
In Pryme, depth follows reversibility: depth 3 covers routine work within bounds, and depth 4 covers moving money and actions that are hard to undo. The customer's classification becomes part of the bounds checked at the moment of action, and some irreversible actions are withheld at the platform floor for every agent.
Questions people ask
How many actions does a typical process have?
More than people expect once side effects are counted. A single customer service process can easily reach dozens of distinct actions. List them all; the long tail is where surprises live.
Should messages to customers count as irreversible?
Usually yes. Once a message is read it cannot be unread, so most outbound communication is class C or D. Internal drafts are class A.
Who should break a tie between operations and risk?
The accountable executive for the process. Record the decision and the reason, since a tie usually means the undo procedure is unclear.