AI agent governance now treats reversibility as the guardrail that lets an agent act alone. The label takes a minute to write, and only a drill shows it is true.
Pick one agent in production. Find a tool call its registry marks reversible. Now run its undo in staging, with the downstream systems attached. Skip the code rollback and reverse the thing the agent did, and watch what the ledger and the customer record do when that undo lands.
In September I wrote that reversible actions could take a pre-committed, audited path. I did not ask who had ever run the undo. A registry cell that says reversible is an intention until someone has run it. I trusted the label too.
Apple has raised the reversal with its investors. Its latest annual report says some consequences of what AI agents and similar technologies do "may be difficult or impossible to reverse."
How Reversible AI Agent Actions Became the Gate
Two frameworks published this year gate on reversibility. Singapore's IMDA, in version 1.5 of its agentic AI framework (May 2026), asks for human approval at checkpoints "such as high-stakes or irreversible actions" and for "regularly auditing human oversight." The World Economic Forum and Capgemini, in a May 2026 playbook, say the "distinction between irreversible and reversible actions should warrant a distinction in the agent's authority."
The default design follows from that: approve the irreversible step and let the reversible ones through. The reversible calls never reach a human. WEF does ask for a rehearsal with rollback before launch. Neither framework asks for the share of actions whose undo has been exercised.
An Economist Enterprise survey supported by Rubrik, a vendor that sells agent rollback, asked 804 VP-plus decision makers at large firms and found that "Just 30% have robust, fully tested rollback capabilities." That measures rollback in general. No survey I could find measures the undo per tool call.
The Compensating Action Nobody Has Run
What the label promises is a compensating action, and that idea is old. Garcia-Molina and Salem defined it for sagas in 1987: the compensation "undoes, from a semantic point of view" the earlier step and "does not necessarily return the database to the state that existed" before that step ran. Microsoft's Azure pattern page warns that compensations can fail and tells designers to define points of no return.
The saga pattern has reached agent stacks, and in April 2026 Tian Pan described saga logs that store a pre-computed inverse for every step, and asked for evals of the undo itself. I could not find anyone who had published the results of those drills.
The undo also has a lifetime. Rollback is not undo, and the difference is the window. Rolling back code does not unsend the email. A refund can be reversed until it settles, a soft delete until a downstream system has acted on it, and a disclosure never.
That report, Apple's fiscal 2026 Form 10-K filed 3 November 2026, says the behavior of AI agents and other technologies can be "difficult to anticipate, control, test and audit," and that "errors can compound across multistep workflows." Then: "Some consequences, such as deleting data or completing transactions, may be difficult or impossible to reverse."
Difficult and impossible are different problems. Difficult is a backlog: the compensable tools whose drill has not passed, which you can count and work down. Impossible is not a backlog item but a scope decision, written down and gated by a person. Marking reversible-or-not in one column hides the backlog, because the difficult cases get marked reversible. It records what an action should allow, and nothing about what anyone has reversed.
A Chain of Reversible Steps Has No Tested Reverse
The compounding Apple describes is a third problem. Take five steps, each with its own undo. To undo the outcome, all five compensations have to run, in reverse order, against a world that has moved on, and each one can fail. Tian Pan wrote in March 2026 that when compensations run without a coordinator checking the overall state, cascading partial compensations can leave a system worse off than the original failure.
So the drill is for the run. Run every compensation in reverse against production-like state, with one made to fail, and record where the system is left.
Figure 1. Illustrative: five individually reversible agent steps end in one outcome whose undo depends on all five compensations, and the third fails on the way back.
Agentic AI Guardrails: Report the Tested Reversibility Ratio, Then Widen Autonomy
The tested reversibility ratio of an AI agent is the share of its permitted state-changing tool calls, weighted by how often they run, whose compensating action has been executed successfully in a drill against production-like systems. An agent with forty such calls of similar volume and ten drilled undos has a ratio of 0.25. Its autonomy widens one tool at a time, as each tool's drill passes.
Figure 2. Illustrative: eight tool calls of one hypothetical agent, marked by whether the compensating action is written, drilled, windowed and checked with the affected party.
A compensation counts as tested when it has run against production-like state, consumers attached, or when a production reversal is on record. Either one expires, and Figure 2 sets that at a quarter. Unit tests do not count. Nor does a sandbox with the downstream systems stubbed out.
The name is close to an existing one. A 2026 preprint (arXiv 2604.23283) defines a reversibility ratio for what a tool set allows. The tested ratio counts what has been reversed.
The gate sits on each tool, which earns more autonomy when its compensation passes a drill inside that period. The ratio is the board's roll-up. A tool that has not passed gains nothing. If it already runs unattended, its drill goes first. Actions that can never be undone are listed by name, outside the denominator, each with the person who gates it, and no ratio removes that person.
What counts is whether the compensation restores an acceptable state for the affected party, whatever the ledger says. Dataiku's August 2026 reversibility test asks whether that person would experience the harm as meaningfully corrected.
Report the ratio beside the drill failure rate and the median time to compensate. Expect the first measurement to come in well below what the registry implies, and name the undrilled tools too, because a ratio of 0.95 can hide the one rare call that moves money. When a failed drill demotes a tool, the system is working. Someone has to own that demotion, and the stop authority has to sit outside the agent.
Some undo costs more than the autonomy is worth. Those tools stay human-gated for good, and the registry says so. Start with one agent. Drill its tool calls, then put the ratio and the named list of never-undoable actions in front of the operating committee before you widen what the agent may do.
A reversible action is one you have reversed. Until then, the board is approving a promise.