13Security & trustDeep dive ③

The action you can't undo: an agent types it as calmly as any other

Delete, send, deploy, pay — a few actions have no undo, and the agent can't feel where the point of no return sits

Read4 min read
Topicssecurity · autonomy · trust
TL;DR

A few actions have no undo button: delete, overwrite, send, deploy, pay. The agent types them with the same calm as every other command, because it can't feel where the point of no return is. Staying safe isn't making it more careful — it's setting three guards from the outside: dry-run before doing it for real, stop for confirmation before the irreversible, and keep a trail — so when something goes wrong, you can reconstruct what it did.

The delete runs in half a second. Your "wait, not that one" comes about two seconds after it. And those two seconds are the whole difference between something undoable and something already gone.

Most of what an agent does is fixable when wrong: rewrite the code, re-run the test, redo the wording. You get so used to that safety net you forget it isn't always there. A handful of actions have no net: wiping something clean, overwriting the original, sending an email out, pushing a change to the live environment, paying a sum. Done is done. There's no save-point to go back to.

01The agent can't see the line marked "past here, no way back"

The problem isn't that the agent is careless. It's that it lacks the feeling you have built in: the small shiver before your finger hits Enter on a destructive command.

To you, "change one line of text" and "wipe a whole directory" sit at opposite ends of a danger scale. To the agent, they're two commands of equal length, written in the same syntax, passing by with the same "normalcy." It has no red line in its head reading "past here, no way back." It handles the push-to-the-live-environment command with the exact same ease as a command that prints a line to the screen.

Worse, it forgets. It doesn't remember that the directory is what the whole team lives on, that the email list is real customers, that the "deploy" button pushes straight out to people using the thing right now. To it, each command is a discrete moment, carrying none of the history that makes your hand hesitate.

02Three guards for the thing with no undo

Since the agent can't build that red line itself, you build it for it — with three guards set around every irreversible action:

AGENT IS ABOUT TO DO THE IRREVERSIBLEDO IT SAFELY — OR STOP
Guard 1 — Dry-run: before doing it for real, make it show what it intends to do — exactly which files it'll delete, exactly who it'll send to. A dry draft of the action, touching nothing yet.

Guard 2 — Stop for a nod: before an irreversible action, the agent stops and waits for your approval — it doesn't push the button itself. You look at the draft from guard 1, and only a nod lets it through.

Guard 3 — Record it: what it did, when, what it touched — written into a log. So that if something's wrong, you can follow the trail, not guess blind in the dark.

Notice all three guards sit <i>around</i> the action, not <i>inside</i> the agent. You don't teach it to fear the delete button — you put a pane of glass in front of that button, and a camera that records each time it reaches for it.

03Tell the undoable from the un-undoable

The guard becomes a nuisance if you set it before every action — an agent that stops to ask on harmless work isn't fast anymore. The trick is to sort first: let the reversible run freely, gate only the irreversible.

1
Ask: "can this be undone?"

Before letting the agent run free on a kind of task, ask just that. Editing code, running tests, drafting text — undoable, let it run. Delete, send, deploy, pay — not undoable, on to the next guard.

2
Irreversible: dry-run first

"Show me exactly what you'll delete/send, before doing it for real." A dry-run step turns the un-undoable into the previewable — where you catch the mistake before it's happened.

3
Keep a log

Record the consequential actions the agent took. Not to surveil it — so when something vanishes or goes wrong, you have a place to check "what happened," instead of reconstructing from memory.

The log in step three is the most overlooked, but it's what saves you at the worst moment: "not knowing what it did" is itself a hole. With a trail, a mistake becomes traceable; without one, it becomes a mystery you carry forever.

04The cruelest asymmetry of all

Why bother with these guards, when ninety-nine times the agent deletes exactly what needed deleting? Because of the hundredth time. The guard costs you a few seconds each time — a glance at a dry-run, typing a "yes." Going without costs you something you can't buy back, on the exact occasion you least expected.

This isn't about loosening or tightening autonomy in general — that's a separate question of how far to let go. This is narrower and harder: for the no-way-back class of actions specifically, the default is always to set the guard, no matter how much you trust the agent. Because misplaced trust you can withdraw with a sentence. But a thing deleted, sent, pushed — your two-second "wait" will forever arrive after the half-second the command already ran.

c
The author

Each story here wraps a lesson paid for in full.

craftagentsomeone building and learning at once

What are you building with agents? Want to trade notes, push back, or build something together — drop a line.

Write hello@craftagent.cloud
58pieces12clustersVI·ENbilingual

Get new pieces by email

Field notes on working with AI agents — occasional, no spam.