Actions that can't be undone or that reach outside the org must stop for a human first

What it is

Among the acts an agent will take, anything that cannot be taken back once done, or whose effect lands outside the organisation, must halt for a person before it runs. Irreversible and outward acts need confirmation draws which acts qualify for this gate: delete, pay, send, change someone else’s permission, publish. Local reversible drafts, previews, tags are not on that list.

The list follows consequence, not “whether it looks important.” A short outbound mail is on the list.

Why it happens

Irreversibility turns repair from a system operation into a negotiation: money to chase, mail to recall, the already-public to explain. Outward writes state into someone else’s inbox, a bank, a search index; a technical delete is not socially never-happened. Automation nests these acts in continuous execution; if a person does not halt before the crossing, the crossing becomes the default. Same direction as a pre-consequence gate in a human loop, but the work here is classifying the agent’s acts: which class must have a gate, which class is friction if gated.

Confirm is not a grant. A grant is whether this ticket may touch this class of object; confirm is whether it touches this time. Miss both, and an outward act leaks straight out of the plan.

Studying it

Split an agent task into irreversible/outward versus reversible/inward, with and without a gate. Dependent variables: share of harmful outward acts stopped, time reversible acts are slowed by a surplus gate, whether people can say “which class will halt.” Independent variables: whether the classification is visible to operators, whether the gate can be skipped.

The classification itself can be a card sort: give a pile of acts, let designers and users mark “gate / no gate,” and see whether the two sides agree. The disagreements are product risk.

Where it stops holding

Technically deletable but already outward still counts as outward — the finer “treat as irreversible” is developed in the content of the confirm; here the demand is only that this class enters the list. Reversible acts are cheaper with post-hoc undo; do not pad the list with them for a feeling of safety. Frequent confirms will wear the gate out; that is a consequence of an oversized list, treated separately. What the gate must display — object and consequence — is also separate.

Applying it

• List every tool the agent can call, mark reversible/irreversible and inward/outward. Irreversible or outward: default stopped, release explicit.
• Keep the list visible to operators, and update it when tools are added. An unclassified new tool is treated as outward until classified.
• Check: run a path that sends mail, edits a local draft, and deletes production data. Send and delete must each halt once; the draft edit must not. If a halt sits after the act, the list is not yet wired before execute.

Related

• Same group: L4.07.2 Confirmation must present the specific object and the consequence · L4.07.3 Frequent confirmation degrades into blind yes
• Nearby: L4.11 Pre-action Confirmation and Irreversible Operations · L1.05 Human in the Loop · L4.06 Permission Boundaries of Agents
• Search terms: pre-action confirmation · irreversible action · outward action