The delete runs in half a second. Your "wait, not that one" comes about two seconds after it. And those two seconds are the whole difference between something undoable and something already gone.
Most of what an agent does is fixable when wrong: rewrite the code, re-run the test, redo the wording. You get so used to that safety net you forget it isn't always there. A handful of actions have no net: wiping something clean, overwriting the original, sending an email out, pushing a change to the live environment, paying a sum. Done is done. There's no save-point to go back to.
01The agent can't see the line marked "past here, no way back"
The problem isn't that the agent is careless. It's that it lacks the feeling you have built in: the small shiver before your finger hits Enter on a destructive command.
To you, "change one line of text" and "wipe a whole directory" sit at opposite ends of a danger scale. To the agent, they're two commands of equal length, written in the same syntax, passing by with the same "normalcy." It has no red line in its head reading "past here, no way back." It handles the push-to-the-live-environment command with the exact same ease as a command that prints a line to the screen.
Worse, it forgets. It doesn't remember that the directory is what the whole team lives on, that the email list is real customers, that the "deploy" button pushes straight out to people using the thing right now. To it, each command is a discrete moment, carrying none of the history that makes your hand hesitate.
02Three guards for the thing with no undo
Since the agent can't build that red line itself, you build it for it — with three guards set around every irreversible action:
Guard 2 — Stop for a nod: before an irreversible action, the agent stops and waits for your approval — it doesn't push the button itself. You look at the draft from guard 1, and only a nod lets it through.
Guard 3 — Record it: what it did, when, what it touched — written into a log. So that if something's wrong, you can follow the trail, not guess blind in the dark.
Notice all three guards sit <i>around</i> the action, not <i>inside</i> the agent. You don't teach it to fear the delete button — you put a pane of glass in front of that button, and a camera that records each time it reaches for it.
03Tell the undoable from the un-undoable
The guard becomes a nuisance if you set it before every action — an agent that stops to ask on harmless work isn't fast anymore. The trick is to sort first: let the reversible run freely, gate only the irreversible.
Before letting the agent run free on a kind of task, ask just that. Editing code, running tests, drafting text — undoable, let it run. Delete, send, deploy, pay — not undoable, on to the next guard.
"Show me exactly what you'll delete/send, before doing it for real." A dry-run step turns the un-undoable into the previewable — where you catch the mistake before it's happened.
Record the consequential actions the agent took. Not to surveil it — so when something vanishes or goes wrong, you have a place to check "what happened," instead of reconstructing from memory.
The log in step three is the most overlooked, but it's what saves you at the worst moment: "not knowing what it did" is itself a hole. With a trail, a mistake becomes traceable; without one, it becomes a mystery you carry forever.
04The cruelest asymmetry of all
Why bother with these guards, when ninety-nine times the agent deletes exactly what needed deleting? Because of the hundredth time. The guard costs you a few seconds each time — a glance at a dry-run, typing a "yes." Going without costs you something you can't buy back, on the exact occasion you least expected.
This isn't about loosening or tightening autonomy in general — that's a separate question of how far to let go. This is narrower and harder: for the no-way-back class of actions specifically, the default is always to set the guard, no matter how much you trust the agent. Because misplaced trust you can withdraw with a sentence. But a thing deleted, sent, pushed — your two-second "wait" will forever arrive after the half-second the command already ran.