PTN—32
Reversibility
Make AI actions cheap to undo, so people can accept output provisionally instead of auditing it exhaustively.
Reversibility is the pressure valve for every other control pattern. When undo is cheap, people can let the AI move fast, accept its work provisionally, and fix mistakes after the fact. When undo is expensive or absent, every action inherits the full anxiety of permanence, and people compensate with heavy up-front review that kills the speed the AI was supposed to provide. The cost of a mistake is the cost of the mistake times the cost of recovering from it.
The mechanics matter more than the promise. “You can always undo” is only true if the system keeps real checkpoints: version history on documents, git-backed snapshots of code changes, soft deletes with a recovery window. AI-generated changes are often large and interleaved with human edits, so undo must be granular — revert this one edit, this one file, this one agent turn — not just a global back button that also destroys the person’s own work.
Reversibility also reshapes what needs a gate. Actions that are trivially undoable can skip approval entirely; actions that cannot be undone deserve the heaviest gates you have. Design the two patterns together: every time you make something reversible, you get to remove a checkpoint, and the whole system gets faster without getting more dangerous.
When to use
- Whenever the AI edits artifacts people care about: documents, code, designs, data.
- When you want to reduce approval friction — reversibility is what earns that reduction.
- When AI changes interleave with human edits and a global undo would destroy both.
- Any bulk or batch operation, where one bad assumption multiplies across items.
Design considerations
- 01Checkpoint before every agent action on user artifacts, automatically — never rely on people to save first.
- 02Make undo granular: revert one edit, one file, or one agent turn without touching the person’s own changes.
- 03Show the restore point in the UI (“Checkpoint created before this edit”) so people know the net exists.
- 04Use soft deletes with a visible recovery window for anything the AI removes.
- 05Keep AI edits attributable — highlighted or diffed — so people can find what to revert.
- 06Label the truly irreversible honestly: a sent email cannot be unsent, so gate it instead of pretending.
Pitfalls
- ✕Undo that lies: a back button that reverts the document but not the side effects — the webhook fired, the email sent — teaches people the safety net has holes.
- ✕All-or-nothing rollback that forces people to choose between keeping an AI mistake and losing an hour of their own edits.
- ✕Checkpoints that exist but are undiscoverable, so people re-do work by hand because they never learned recovery was one click away.
- ✕Treating reversibility as a substitute for judgment on genuinely irreversible actions — payments and sends need gates, not apologies.
In the wild
- Cursor
- Creates checkpoints as the agent works, letting you restore the workspace to the state before any given agent message.
- Claude Code
- Operates on git repositories, so every agent change is diffable and revertible with standard version control; it proposes edits as diffs before applying them.
- Notion AI
- AI edits land inside pages covered by Notion’s page history, so a bad rewrite can be rolled back to a prior version.
- Figma
- AI-assisted generation lands on the canvas under the same undo stack and version history as manual edits — one Cmd+Z removes a bad generation.
- Gmail
- Undo Send holds the message for a configurable window — the canonical proof that even “irreversible” actions can be engineered into reversible ones.