{"course":{"slug":"agents-and-automation","title":"Agents and Automation","url":"https://addaly.com/learn/agents-and-automation","level":"intermediate","track":"build"},"lesson":{"slug":"irreversible-actions","title":"Money, messages and deletions","url":"https://addaly.com/learn/agents-and-automation/irreversible-actions","position":45,"of":72,"minutes":8,"answer":"Anything you cannot undo gets a dry run, a hard numeric limit in code, and a way to stop the whole thing inside thirty seconds.","keyIdea":"Anything you cannot undo gets a dry run, a hard numeric limit in code, and a way to stop the whole thing inside thirty seconds."},"body":{"format":"markdown","text":"## Sort every tool into three bins\n\n**Reversible and cheap.** Reads, drafts, records you can edit. Let the agent do these freely; gating them costs more than the mistakes.\n\n**Reversible but public.** A message you can delete after fourteen people have read it. A comment on a customer's issue. Technically undoable, practically not. **Treat these as irreversible.** This is the bin teams get wrong, because \"we can delete the post\" sounds like a plan until you have watched a screenshot travel.\n\n**Irreversible.** Payments, refunds, deletions, sends, publishes, submissions, anything with a legal counterparty.\n\nThe sorting is the design. Do it in a document, out loud, before you write the tools.\n\n## Four controls, cheapest first\n\n**1. Dry run by default.** Every destructive tool takes a `commit` flag defaulting to false, and returns a rendered description of what would happen. The agent's normal mode is therefore *producing a plan*. Execution is a separate, non-model step over that plan.\n\nThis one change removes most of the fear from the rest of the design, and it gives you the diff you will need for approval.\n\n**2. Numeric limits in the harness.** Maximum refund amount. Maximum recipients per run. Maximum rows a single delete may touch. Maximum total spend per day. Numbers in code, not sentences in a prompt: you already know why.\n\nOne worth stealing outright: refuse any bulk operation touching more than a handful of records without approval. Most catastrophes are a single operation with a missing condition on it.\n\n**3. A delay with an undo window.** Queue the send for sixty seconds with a cancel link in the team channel. Far cheaper than an approval step, requires nobody to be at their desk, and catches most of what approval would catch, because the errors people catch are the obvious ones, and sixty seconds is enough to notice an obvious one.\n\n**4. Approval on the specific action**, showing the exact diff.\n\n## Deletion is a status change\n\nIn an automated system, delete means setting a `deleted_at` timestamp, with the real purge done later on a schedule a person controls. Two reasons: an agent's deletion is precisely the operation you are most likely to want back, and a hard delete can orphan everything that referenced it. Give the agent the soft delete and nobody the hard one.\n\n## Roll it out in stages\n\n**Shadow mode first.** The agent produces the action; a person does the work as usual; you compare the two. Two weeks of that gives you a real error rate against real inputs, before anything can go wrong. It is the most underused technique in this whole subject, because it feels like not shipping.\n\nThen five per cent automatic, then fifty, then the rest, with the error rate watched at each stage rather than assumed.\n\n## A kill switch you have tested\n\nOne flag, in one place, that stops all runs without a deploy. A row in a table, an environment variable the runner re-reads each cycle, a feature flag.\n\nThen test it, and time it. If you cannot stop your automation within thirty seconds, at 3am, from a phone, it is not ready to run unattended. That is not a metaphor. Try it once and write the number down."},"check":{"question":"An agent posts replies to public customer reviews. The team argues it is low risk because a wrong reply can be deleted within minutes. What is the strongest counter?","options":[{"text":"Deletion may fail if the review platform's API is down.","correct":false,"tempting":"A real availability concern, but it treats an occasional failure as the risk, rather than the ordinary case where deletion works and is still too late."},{"text":"The agent might delete the wrong reply.","correct":false,"tempting":"Invents a second failure to argue against the first, when the problem is present even if every deletion is perfectly targeted."},{"text":"A public reply is read, and possibly screenshotted, before deletion, so it belongs in the irreversible bin regardless of what the API allows.","correct":true},{"text":"Deletion leaves a visible gap in the thread that customers notice.","correct":false,"tempting":"A cosmetic consequence, and a much smaller problem than the reply having already been read and quoted."}]},"prev":{"slug":"human-in-the-loop","title":"Where the person goes","url":"https://addaly.com/learn/agents-and-automation/human-in-the-loop"},"next":{"slug":"disclosure-and-audit","title":"Telling people, and keeping the receipts","url":"https://addaly.com/learn/agents-and-automation/disclosure-and-audit"},"authorship":"Founder and series editor: Dr Mustafa Mun. Written by AI models to a written standard. Exam keys checked blind by a second model: 3,665 of 3,666 agreed. Academic review invited.","review":{"status":"Draft, open for academic review"},"cite":"Addaly (2026) 'Money, messages and deletions', in Agents and Automation. Edited by M. Mun. Addaly. Available at: https://addaly.com/learn/agents-and-automation/irreversible-actions (Accessed: 13 October 2026).","licence":{"name":"CC BY-NC-SA 4.0","url":"https://creativecommons.org/licenses/by-nc-sa/4.0/"},"reader":{"schema":1,"title":"Money, messages and deletions","courseTitle":"Agents and Automation","module":{"index":5,"slug":"safety-and-blast-radius","title":"Permissions, injection and blast radius"},"answer":null,"keyIdea":"Anything you cannot undo gets a dry run, a hard numeric limit in code, and a way to stop the whole thing inside thirty seconds.","hero":{"kind":"plate","image":null,"alt":null,"caption":null},"blocks":[{"t":"h2","id":"sort-every-tool-into-three-bins","runs":[{"text":"Sort every tool into three bins"}]},{"t":"p","runs":[{"text":"Reversible and cheap.","b":true},{"text":" Reads, drafts, records you can edit. Let the agent do these freely; gating them costs more than the mistakes."}]},{"t":"p","runs":[{"text":"Reversible but public.","b":true},{"text":" A message you can delete after fourteen people have read it. A comment on a customer’s issue. Technically undoable, practically not. "},{"text":"Treat these as irreversible.","b":true},{"text":" This is the bin teams get wrong, because “we can delete the post” sounds like a plan until you have watched a screenshot travel."}]},{"t":"p","runs":[{"text":"Irreversible.","b":true},{"text":" Payments, refunds, deletions, sends, publishes, submissions, anything with a legal counterparty."}]},{"t":"p","runs":[{"text":"The sorting is the design. Do it in a document, out loud, before you write the tools."}]},{"t":"h2","id":"four-controls-cheapest-first","runs":[{"text":"Four controls, cheapest first"}]},{"t":"p","runs":[{"text":"1. Dry run by default.","b":true},{"text":" Every destructive tool takes a "},{"text":"commit","code":true},{"text":" flag defaulting to false, and returns a rendered description of what would happen. The agent’s normal mode is therefore "},{"text":"producing a plan","i":true},{"text":". Execution is a separate, non-model step over that plan."}]},{"t":"p","runs":[{"text":"This one change removes most of the fear from the rest of the design, and it gives you the diff you will need for approval."}]},{"t":"p","runs":[{"text":"2. Numeric limits in the harness.","b":true},{"text":" Maximum refund amount. Maximum recipients per run. Maximum rows a single delete may touch. Maximum total spend per day. Numbers in code, not sentences in a prompt: you already know why."}]},{"t":"p","runs":[{"text":"One worth stealing outright: refuse any bulk operation touching more than a handful of records without approval. Most catastrophes are a single operation with a missing condition on it."}]},{"t":"p","runs":[{"text":"3. A delay with an undo window.","b":true},{"text":" Queue the send for sixty seconds with a cancel link in the team channel. Far cheaper than an approval step, requires nobody to be at their desk, and catches most of what approval would catch, because the errors people catch are the obvious ones, and sixty seconds is enough to notice an obvious one."}]},{"t":"p","runs":[{"text":"4. Approval on the specific action","b":true},{"text":", showing the exact diff."}]},{"t":"h2","id":"deletion-is-a-status-change","runs":[{"text":"Deletion is a status change"}]},{"t":"p","runs":[{"text":"In an automated system, delete means setting a "},{"text":"deleted_at","code":true},{"text":" timestamp, with the real purge done later on a schedule a person controls. Two reasons: an agent’s deletion is precisely the operation you are most likely to want back, and a hard delete can orphan everything that referenced it. Give the agent the soft delete and nobody the hard one."}]},{"t":"h2","id":"roll-it-out-in-stages","runs":[{"text":"Roll it out in stages"}]},{"t":"p","runs":[{"text":"Shadow mode first.","b":true},{"text":" The agent produces the action; a person does the work as usual; you compare the two. Two weeks of that gives you a real error rate against real inputs, before anything can go wrong. It is the most underused technique in this whole subject, because it feels like not shipping."}]},{"t":"p","runs":[{"text":"Then five per cent automatic, then fifty, then the rest, with the error rate watched at each stage rather than assumed."}]},{"t":"h2","id":"a-kill-switch-you-have-tested","runs":[{"text":"A kill switch you have tested"}]},{"t":"p","runs":[{"text":"One flag, in one place, that stops all runs without a deploy. A row in a table, an environment variable the runner re-reads each cycle, a feature flag."}]},{"t":"p","runs":[{"text":"Then test it, and time it. If you cannot stop your automation within thirty seconds, at 3am, from a phone, it is not ready to run unattended. That is not a metaphor. Try it once and write the number down."}]}],"check":{"question":[{"text":"An agent posts replies to public customer reviews. The team argues it is low risk because a wrong reply can be deleted within minutes. What is the strongest counter?"}],"options":[{"text":[{"text":"Deletion may fail if the review platform’s API is down."}],"correct":false,"tempting":[{"text":"A real availability concern, but it treats an occasional failure as the risk, rather than the ordinary case where deletion works and is still too late."}]},{"text":[{"text":"The agent might delete the wrong reply."}],"correct":false,"tempting":[{"text":"Invents a second failure to argue against the first, when the problem is present even if every deletion is perfectly targeted."}]},{"text":[{"text":"A public reply is read, and possibly screenshotted, before deletion, so it belongs in the irreversible bin regardless of what the API allows."}],"correct":true,"tempting":null},{"text":[{"text":"Deletion leaves a visible gap in the thread that customers notice."}],"correct":false,"tempting":[{"text":"A cosmetic consequence, and a much smaller problem than the reply having already been read and quoted."}]}],"order":[1,2,3,0],"why":null},"prev":{"slug":"human-in-the-loop","title":"Where the person goes","minutes":8},"next":{"slug":"disclosure-and-audit","title":"Telling people, and keeping the receipts","minutes":8}}}