How to require a person for every irreversible action

Tag every irreversible action an agent can take, then have the platform hold each one at the moment it is attempted until a named person with the right authority approves it. The approver must be a person, not an agent or a shared account, must see why the action cannot be undone, and cannot approve in bulk.

What does the requirement cover, and who owns it?

An irreversible action is one you cannot undo, or can undo only with someone else's cooperation: a payment that has settled at another bank, a message a customer has read, data deleted without a backup, a filing sent to a regulator. The requirement is simple to state and easy to undermine. Agents rarely take an obviously irreversible action unprompted. They take actions whose irreversibility nobody tagged.

The chief risk officer, or whoever owns operational risk, owns the requirement. Each process owner owns the tagging of actions in their process. The platform team owns the enforcement.

How do you put the requirement in place, step by step?

1. Person, process owners: list every action and its side effects. Include notifications, downstream syncs and anything a tool does beyond its name. Evidence: an action list per process.
2. Person, process owners: tag the irreversible ones. Use a fixed test, such as the irreversible action checklist for AI agents. Some cases need thought: whether sending an email is irreversible depends on who reads it, and whether deleting data is irreversible depends on backups and retention. Evidence: tag and reason per action.
3. Person, risk owner: reviews the tags. Disputed or borderline actions default to irreversible. Evidence: sign-off.
4. Platform team: map tags to a risk tier. An action risk tier decides how many approvers and what authority each needs. Evidence: tier per action.
5. Platform: holds every tagged action at the moment of action. Regardless of the agent's depth, certificate or the customer's limits. Evidence: held verdict per attempt.
6. Agent, depth 2: prepares the held item. The full action, the facts behind it with their sources, and a plain statement of why it cannot be undone. Evidence: the held item as presented.
7. Person, approver: decides one item at a time. Approve, edit or refuse. For the highest tier, a second person also approves. Evidence: approver identities and timestamps.
8. Platform: checks the approver. A real person, not the requester, with authority for the action and amount. Evidence: the identity check on the verdict.

Which controls make the requirement safe?

Enforced outside the agent. The hold comes from the platform's bounds, not from the agent's instructions. Evidence: held verdicts naming the irreversibility tag.

Person-only approvers. Agents, service accounts and shared logins cannot approve. Evidence: identity type on every approval.

Authority checked. An approver may only clear actions within their own authority. Evidence: the approver's limit recorded with the decision.

One at a time. No select-all. Evidence: one decision per item, each with its own timestamp.

The irreversibility statement. The approver sees, in a sentence, what cannot be undone and why. Evidence: the statement saved with the held item.

Composite actions caught. Three reversible steps can combine into one irreversible outcome: export a file, attach it, send it. Tag the combination. Evidence: tags on sequences, not only single calls.

What should you measure?

• Held irreversible actions per day, by process. Too many and approvers stop reading.
• Time each approver spends per item. Very short times on complex items are a warning.
• Refusals by approvers. A refusal count near zero over a long period suggests rubber-stamping or an overly cautious agent.
• Irreversible actions with no held verdict. Must be zero; any is an incident.
• Untagged side effects found in reviews or incidents.

What are the signs it is going wrong?

Approvals take seconds. The person is not reading. Reduce volume by moving reversible actions out of the queue.

Approvers approve their own requests. Usually because the queue was set to "anyone in the team".

The agent finds another route. A tool without the tag reaches the same outcome. Gate the outcome, not the tool.

A tagged action is silently retagged to clear a backlog. Retagging needs the same sign-off as tagging.

Irreversibility is judged by the system, not the world. The ledger can reverse an entry, but the customer was already told. Tag by real-world effect.

Where Pryme fits

In Pryme, actions that are hard to undo sit at depth 4 and are checked at the moment of action against the minimum chain of bounds. A customer whose rule is a person for every irreversible action sets its own limits so that each one is held for a named approver, and some actions are withheld at the platform floor for every agent regardless. Every held item and decision is filed in an append-only record. The reasoning sits in our guide to autonomy in regulated industries.