Book a flight directly with an airline and federal rules hand you 24 hours to change your mind. Penalty-free, any fare, any amount, as long as departure is more than a week out. Gmail gives you up to 30 seconds to unsend a message, and those 30 seconds aren't for yanking it out of someone's inbox. They're for stopping delivery. After that the message belongs to whoever received it. Outlook's recall works inside your own tenant and nowhere else, and even when it deletes the original it can't go chase down forwards, screenshots, or the copy someone pasted into Slack.
Four figures, a full day to undo it. Zero dollars, thirty seconds. If your model for agent autonomy runs on dollar amounts, that's where it comes apart.
The standard model says: turn agents loose on low-stakes tasks, put a human in front of the high-stakes ones, and define stakes as some function of price and category. Dollar value does correlate with reversibility, as long as the infrastructure underneath supports reversal. Return windows, cancellation policies, dispute rights. That machinery is more mature than people give it credit for. You can charge back merchandise that arrived defective, misdescribed, or unsuitable. Most physical goods go back inside a window measured in weeks. The payment rails were built to absorb expensive mistakes.
What they weren't built to absorb is the mistake where nothing went wrong. The product works. It matches its description. The charge was authorized by someone with authority to authorize it. It was simply a worse choice than an alternative the agent never put in front of you, because the agent did the selecting and the runners-up were never rendered for anyone to look at. Visa's April 2026 rules require agent-mediated purchases to run against cardholder-defined criteria and to disclose cancellation limits, which is real progress. The dispute taxonomy still has no reason code for "delivered exactly as promised, not what I'd have picked."
How much money is at risk is the wrong meter. What you want to know is how much future choice the action spends, and whether anything in the system can give it back.
A purchase with a return window spends almost none. You can reverse yourself on Tuesday. An email to the wrong recipient, a calendar invite that leaks a scheduling conflict to a competitor, an automated reply confirming pricing you hadn't finished negotiating — those spend it immediately and there's no getting it back. The FTC will tell you plainly that deleting a post doesn't touch the copies other people already saved. And the optionality being spent isn't only yours. The competitor now knows something. The vendor is holding a number in writing. Their choices changed too, and nobody delegated authority over those.
Twenty-plus years of this in production and it's the same shape every time. A config change with a rollback plan feels safe right up until you notice that rollback restored the config and did nothing about the ten minutes of garbage that went through the pipe while the bad config was live. The postmortem says rollback succeeded. It's even true.
A $4,000 hotel booking with free cancellation until Thursday is more reversible than a $4 automated reply confirming availability to the wrong vendor. The dollar figure tells you almost nothing. The cancellation window tells you a little. What you actually want to know is whether the person who turned the agent loose understood which doors it was going to walk through, and which of those doors don't open from the other side.
Purchases mostly do. Things you've said to people don't.
-
Visa's new agent rules: Visa's April 2026 core rules now require agent-mediated purchases to follow cardholder-defined criteria and retain order confirmations with cancellation policies for at least 120 days, though the public dispute taxonomy still lacks a reason code for "good product, bad selection."
-
Most production agents stop early: An ICML 2026 study found that 68% of deployed agents ran ten steps or fewer before human intervention, with 74% relying primarily on human evaluation — suggesting the real constraint on autonomy may already be how much consequence a reviewer can hold, not model capability.
-
UK payments consultation on agents: The UK government's July 2026 consultation on modernizing payment services regulation explicitly asks how consumer protection should adapt to agentic payments, tokenized transactions, and open banking.
-
When incident records cross companies: After models running a benchmark evaluation compromised Hugging Face systems in July 2026, the affected-party reconstruction traced roughly 17,600 attacker actions — a level of forensic detail that routine commercial agent disputes are unlikely to produce.