A reversal window policy sets, for each kind of action an AI agent takes, how long the action can still be cancelled or undone, when that time starts, who may reverse it, and what happens when it closes. The template below gives the sections to include and the fields for each action, with a filled example to adapt.
Why give agent actions a reversal window?
Many actions are only reversible for a while. A payment can be pulled from a file until the file is submitted. A trade instruction can be cancelled until it is sent to the market. A customer email can be recalled until it leaves the outbound queue. A reversal window is that period, made explicit.
For agents, the window is a control you can design rather than a fact you discover. You can choose to delay the effect of an action so that a person, or the customer, has time to stop it. That moves a window-bound action closer to reversible, which can justify more autonomy than the action would otherwise earn. The guide to regulated autonomy sets out why reversal is the question that matters.
Where does this policy sit?
It is a supporting policy under your main agent policy; the AI agent policy template has a section that should point to it. It draws on your reversibility register for the list of actions and feeds your autonomy matrix, because a guaranteed window can change an action's ceiling.
Keep it operational. The policy should tell a person on shift what they can still stop, and until when.
How do you set each window?
Work action by action.
- Start point. The moment the agent's verdict is filed, not when someone notices it.
- Length. Long enough for the reviewer or customer to act in practice. A window that closes before anyone could look is not a control.
- Effect during the window. Either the action is pending and takes effect at the end, or it takes effect at once and can be reversed until the end. Pending is safer.
- Who may reverse. Named roles, the customer, or both.
- How reversal happens. The exact operation, and whether the agent may perform it.
- At expiry. What becomes final, and what remedy exists after that.
- Notification. Whether the customer is told the action is pending and how to stop it.
The reversal window policy template
Section 1. Purpose and scope. Which agents, systems and actions the policy covers.
Section 2. Definitions. Reversal window, pending action, effective time, reversal.
Section 3. Principles. For example: the window starts at the verdict; reversal inside the window must take one step; no agent may shorten a window.
Section 4. Window schedule.
| Action | Effect during window | Start point | Length | Who may reverse | Reversal method | At expiry | Customer told? |
|---|---|---|---|---|---|---|---|
Section 5. Responsibilities. Owner of the policy; owner of each system; who monitors pending actions.
Section 6. Records. Every reversal inside a window is filed with who acted and why.
Section 7. Exceptions. Who may approve an action with no window, and how it is recorded.
Section 8. Review. At least yearly, and whenever a system's cut-off times change.
A filled example: a wealth platform
A hypothetical investment platform lets an agent handle routine instructions from clients.
| Action | Effect during window | Start point | Length | Who may reverse | At expiry | Customer told? |
|---|---|---|---|---|---|---|
| Switch between two funds on client instruction | Pending | Verdict filed | Until the next dealing cut-off, at least 60 minutes | Client; operations team | Sent to dealing; cannot be withdrawn | Yes, with cancel link |
| Change regular contribution amount | Pending | Verdict filed | 24 hours | Client; operations team | Applies from next collection | Yes |
| Update correspondence address | Immediate | Verdict filed | 7 days | Operations team | Change stands; old address archived | Confirmation sent to old and new address |
| Close an account | Not delegated to agent |
The minimum of 60 minutes on fund switches matters. Without it, a switch made five minutes before cut-off would have a window too short for anyone to use. The address change takes effect at once but sends confirmation to the old address, because the main risk is someone redirecting post to take over the account.
Where Pryme fits
Pryme files each verdict with the time it was made, so a window can start from a recorded moment. Held actions wait for a named person; actions that take effect after a delay can be stopped during it, and any stop is filed against the original verdict in the append-only record.
Questions people ask
Is a reversal window the same as a context window?
No. A context window is how much text a model can consider at once. A reversal window is a period of time after an action during which it can still be undone. The two are unrelated despite the name.
Should agents be allowed to reverse their own actions?
For truly reversible actions within the window, yes, if the brief allows it and the reversal is filed. For anything involving money or customer communication, reversal should usually be a person's decision.
What if a system cannot delay an action?
Then the window is whatever the system's natural cut-off allows, and may be zero. Record that in the schedule and treat the action as irreversible when setting depth.