TL;DR: Place each AI action on two axes: risk (harm if wrong) and reversibility (how easily it can be undone). Low-risk, reversible actions can run automatically with undo. High-risk, reversible ones need checks or sampled review. Low-risk, irreversible ones need confirmation in bulk. High-risk, irreversible actions need explicit approval, policy checks in code and an audit trail. Then redesign actions to be more reversible: holds before purchases, drafts before sends, soft deletes.
The matrix
| Reversible | Irreversible | |
|---|---|---|
| Low risk | Run automatically, offer undo. Archive an email, tag a ticket, reorder a list | Confirm when in bulk or unusual. Send a routine internal notification |
| High risk | Run with checks and sampled review, undo window. Change a deal stage, update many records | Explicit approval with specifics, policy checks in code, audit trail. Pay an invoice, send a client email, delete data, change permissions |
Assessing risk
Consider who is affected and how: money lost, harm to people, legal or regulatory exposure, damage to relationships, data exposure. Third parties matter: an email to a customer affects someone outside the system. Scale matters: one record changed is different from a thousand.
Assessing reversibility
Ask whether the action can be undone, by whom, at what cost, and how quickly. Some actions look reversible but are not in practice: a message can be recalled in some systems but has often been read; a refund can be clawed back but at the cost of the customer relationship; a deleted record may be recoverable from backup only after days.
Making actions more reversible
Design often moves an action from the irreversible column to the reversible one.
| Irreversible version | More reversible design |
|---|---|
| Purchase a non-refundable fare | Hold the fare, confirm before purchase |
| Send an email | Draft, or schedule send with a cancel window |
| Delete records | Soft delete with recovery period |
| Pay an invoice | Queue payment for scheduled release with review |
| Change permissions | Time-limited grant that expires unless confirmed |
| Bulk update | Preview, then apply with batch undo |
Each change lets more actions run at higher autonomy safely.
Controls by quadrant
- Undo must reverse every effect, including notifications sent to others, and handle conflicts with later edits.
- Confirmations must be rendered by the application, specific (recipient, amount, items), and rare enough that people read them.
- Policy checks in code enforce limits the model cannot override: refund caps, recipient allow-lists, approval thresholds.
- Audit trails record what was proposed, checked, approved and executed, by whom.
- Sampled review catches errors in high-risk reversible actions without reviewing everything.
Bulk and anomaly rules
Scale changes risk. An action that is safe once can be dangerous a thousand times. Apply thresholds: any action affecting more than a set number of records, or with unusual values (a deal amount dropping by 90%), moves to a higher-control quadrant automatically.
In the interview
The matrix gives a quick, defensible structure for any agent or assistant that takes actions. Strong answers place each action, assign controls per quadrant, and then show product creativity by making actions more reversible (holds, drafts, soft deletes, scheduled sends). Mentioning bulk thresholds and app-rendered confirmations signals hands-on experience.