Irreversible action checklist for AI agents

An irreversible action checklist runs each action an AI agent might take through a short set of tests: does it leave your systems, can someone else act on it, does it destroy or disclose data, does it commit you legally? Any "yes" marks the action as irreversible and lists the controls required before an agent touches it.

What makes an action irreversible?

An irreversible action is one whose effect cannot be withdrawn once it has happened. The tricky part is that irreversibility usually lives outside the system where the agent clicks. A database row can be restored; the customer who already read the email it triggered cannot un-read it. A ledger entry can be offset; the counterparty who already received the funds may not send them back.

That is why the checklist asks about consequences, not about the operation. In a regulated business, irreversibility is the main thing that should decide how much autonomy an agent gets; the guide to regulated autonomy explains why.

When do you run the checklist?

Run it on every new action before it is connected to an agent, and again when a downstream process changes. It takes minutes per action. The output feeds your reversibility register and your autonomy decisions.

Run it with someone who knows what happens after the action, not only the person who knows the system. Operations staff often know the irreversible step that the engineers never see.

How do you complete each item?

Answer each test yes, no or unclear. Treat unclear as yes until someone proves otherwise. For each yes, write one line saying why. Then move to the controls section and confirm each required control exists, with its evidence.

Two tests catch teams out most often. The disclosure test: any outbound message containing personal data is irreversible once delivered, whatever the channel. See whether sending an email is an irreversible action for an AI agent. And the destruction test: deleting data is irreversible unless a tested restore exists and the deletion was not done to meet a legal duty, which the piece on whether deleting data is an irreversible action unpacks.

The irreversible action checklist

Part 1: tests

1. Does the action send anything outside your organisation (message, file, payment, filing)?
2. Can a third party act on the result before you could recall it?
3. Does the action destroy or overwrite data without a tested restore?
4. Does it disclose personal or confidential information to anyone?
5. Does it make a binding commitment: an offer, a contract term, a waiver?
6. Does it change a record a regulator, court or counterparty relies on?
7. Would undoing it need someone else's consent?
8. Does reversal stop being possible after a cut-off time?
9. Could the customer be harmed in a way money does not fix?

Part 2: required controls if any test is yes

10. The action is held for a named person, not a shared queue.
11. The person sees the exact output that will be sent or applied, not a summary.
12. The action can be staged: fully prepared, then released by a person.
13. Where test 8 is yes, the cut-off is shown to the approver.
14. A compensating action is defined, if one exists.
15. The verdict and the approver's name are filed in the record.
16. The highest depth any agent may hold for this action is written down.

The mechanics of item 10 are covered in how to require a person for every irreversible action.

A filled example: closing a dormant account

A hypothetical bank wants an agent to close accounts that have been dormant and empty for a long period.

The surprise was item 9. A dormant account looked harmless, but a forgotten payment mandate meant real harm for a few customers. Item 3 also went to the systems team to test restoration before anyone discussed raising depth.