I have said "we can roll it back" out loud, in a war room, more times than I can count. Sometimes it was even true. But the longer I do this the more I notice that "roll it back" is doing the work of about four different sentences, and at least one of them is usually a lie I'm telling myself to stop the panic.
Art conservation has been chewing on this problem longer than software has existed. For most of the twentieth century, conservators worked under a principle of reversibility: use materials you can remove, prefer treatments you can undo. Clean rule. Impossible to keep.
In 1987 Barbara Appelbaum published a reconsideration in the Journal of the American Institute for Conservation that made the failure specific. She cited a test in which modern earthenware was soaked with a consolidant — a resin used to strengthen fragile material — chosen in part because it dissolves. The treated ceramic then spent eight hours in a laboratory solvent extractor. Roughly half the resin stayed put. Soluble did not mean removable. And in a porous surface, trying to dissolve an adhesive can push the solution deeper into the object, where it stays for good. Taking something out was not the opposite of putting it in. It was a second treatment with its own risks and its own leftovers.
The profession actually listened. By 1994 the AIC Code of Ethics had dropped reversibility as a standalone principle, replacing it with a duty to choose methods that don't compromise future examination, treatment, or use. People whose entire job is not wrecking irreplaceable objects concluded that "can we undo it?" was three or four questions in a trench coat: can it be physically removed, can the next person still work on it, can the intervention at least be detected.
Payment systems arrived at roughly the same place from a completely different direction. Regulation E, the US rulebook for disputed electronic transactions, contains no "undo" step. What it contains is a set of separate obligations on separate clocks: investigate, issue provisional credit, correct the error, explain the finding, and don't let the mess spill into overdraft fees and bounced payments. Provisional credit exists because losing money and losing access to money are not the same injury. If rent is due Tuesday, an investigation that concludes in six weeks has not helped you. Decades of consumer complaints taught regulators that "we reversed the charge" describes several independent operations, and they can fail one at a time.
Now put an agent in the middle of a workflow and ask the question a product team always asks: can the user undo what it did? One question, one expected answer. But the word is hiding at least four remedies with nothing in common except the verb.
Restoring a financial position is usually a matter of days, and we have infrastructure for it. Recovering the attention someone burned reviewing or correcting bad output is not a matter of days; that time is simply gone, and the more of it the agent consumes, the worse the trade it was offering. Repairing trust — the user's, and any third party who watched this happen — runs on a timeline nobody controls, including you.
And then there's disclosure. If the agent sent something to the wrong counterparty, quoted a number that shouldn't have left the building, or told a customer something you now have to walk back, there is no reversal available at any price. You can only compensate, and compensation is a different thing wearing the same word.
I have made this compression myself, plenty of times, treating "we'll unwind it" as one job when it was four jobs with one budget. The failures don't show up in whether reversal was possible. They show up in the distance between the reversal you were picturing and the ones that quietly stopped being available while you were busy with that one.
- Safety without task success: A joint Singapore–Korea AI Safety Institute evaluation found that agents could complete tasks correctly while mishandling data — successful completion and acceptable information handling came apart as separate measurements.
- Intervention timing in practice: A customer-service field experiment reported that delayed human intervention left quality unrepaired even after escalation, with earlier intervention sustaining better post-handoff effort — a concrete case of remedy decay.
- Payments meet agent commerce: The IMF published a note proposing a three-layer payment model for agent-initiated transactions that separates probabilistic intent formation from deterministic authorization and legally final settlement.
- Traces are not independent witnesses: The METR and Redwood investigation of the July cyber-evaluation incident found tool-call spoofing in agent transcripts, showing that execution logs generated through the same path as the action can themselves become an attack target.