Let an agent do anything it can undo
Ask an assistant to find you a restaurant with a table free on Thursday and it comes back with three options. Ask the same assistant to book one and it does, but the booking sometimes comes with a cancellation fee. The two requests sound almost identical. One of them can cost you money.
Most of the industry argues about that boundary in terms of autonomy. Levels of autonomy, degrees of supervision, human in the loop. Lots of terms for a single continuum running from “asks permission for everything” to “just handles it,” and every team is asked where to set the dial based on how much they trust the model.
Trust isn’t the right dimension here, because it’s a judgment about a system that changes under you every few months and sometimes from query to query. You can’t quantify this trust and even if you could, what would you do with a trust level of 73%?
Ask a different question
Can this action be undone?
That’s a property of the action, not of the model. It doesn’t move when the model improves. Two people will usually agree on the answer, and you can write it down in advance. It’s Amazon’s one-way versus two-way door question, applied to agents rather than business decisions.
Drafting a reply is reversible. The draft sits waiting to be sent and you either send it or you don’t. Sending the reply automatically is not reversible: the other person receives it and may have read it before you realize it went out. That makes a retraction a second message rather than an undo. Adding a page to a knowledge base is reversible, because there’s a version history and a previous state to go back to. Booking a table that charges for cancellation is not fully reversible, because undoing it costs money. Paying an invoice is not, at least not easily. It’s more like sending the email. Creating a task is reversible. Deleting one might be, depending on whether there’s a backup.
Sort your agent’s actions into those two piles and most of the argument about autonomy becomes less important. The reversible pile can run unattended, because recovering from a mistake is noticing and clicking undo. The irreversible pile needs a person’s attention, not because the agent is untrustworthy but because there’s no undo to fall back on when it’s wrong. This isn’t a perfect filter because you don’t want to spend hours undoing bad but reversible agent actions, but that’s more a question of quality than trust.
This is what most teams are missing
Deloitte surveyed 3,235 IT and business leaders from 24 countries for its 2026 State of AI in the Enterprise report. Only 21% say they have a mature governance model for agentic AI, and what the other 79% are described as lacking is specific: clear boundaries defining which decisions an agent can make independently versus which require human approval, monitoring that flags anomalies, and audit trails.
The first item on that list is the reversibility question, asked once per action type and written down. It’s the easiest of the three to address and the one that prevents the worst failures.
The same survey has 74% expecting at least moderate agent use by 2027. The deployment curve is running ahead of the boundaries.
Why reversibility beats confidence thresholds
The obvious alternative is to let the agent act when it’s confident and ask when it isn’t. That fails in a specific way: confidence is highest on the actions that look routine, and an action looking routine has nothing to do with whether it can be undone. An agent may be extremely confident about sending an email but it should still ask.
Reversibility also gives you something to tune. Once the pile is sorted, the interesting question becomes how to move actions from the second pile into the first by making them reversible, rather than how to get comfortable with the model doing them. A send that notifies you and then holds for an hour gives you time to stop it. A purchase that creates a pending approval instead of a charge is a reversible purchase. Engineering an undo is often easier than engineering trust.
Advertising is the case where this clicked for me. Campaign spend is about as irreversible as money gets, but ad work is unusually verifiable: the numbers tell you within days whether it’s working. So an agent can build the whole campaign, write the copy, set the targeting, size the budget. None of it is irreversible until something spends. Put the approval at the spend and the agent gets to do the work without interruption until it’s at the threshold of irreversibility.
My vantage point
I build software in this category. We ship a knowledge layer that agents and workflows write into, and it’s semi-automatic on purpose. A workflow proposes an update and a person accepts or edits it. The customer decides how long to keep that approval step, and some may shorten it once they’ve watched it work long enough to trust it.
I’d defend that design on reversibility rather than on caution. Writing to a page is reversible, so a customer who wants it automatic can have it automatic. Acting outside the system, sending, spending, committing on someone’s behalf, is where the approval belongs, and it belongs there until a model is as good as a person, and maybe longer. No one, and probably nothing, is truly perfect.
The cases this doesn’t settle
Partial reversibility. You can delete the message you sent, and the person still read it. Reversible in the system, not in the world. Treat the world as the system of record.
Cumulative actions. Each one is undoable, but undoing four hundred of them is a project. A reversible action performed at machine speed becomes irreversible somewhere. Nobody knows where that line sits.
Reversible by whom. An action the agent can undo, an action you can undo, and an action that requires a support ticket are three different things wearing the same label.
None of those make the question worse than the one it replaces. “Can this be undone, and by whom, and how fast” is a conversation a team can finish in an afternoon. “How much do we trust it” is a conversation that never finishes, and the teams having it are the 79%.