Defining Reversibility in Agent Workflows

The municipal agent sent 4,200 SMS messages at 21:13: 'your property-tax rebate has been approved'. The rebate module had not run. A junior had pointed the agent at the SMS gateway 'to test tone'. By 21:20 the ward offices' phones were busy. There is no undo for a message a citizen has already read. There is only a second message, a counter queue, and a political morning.

Reversibility is a property you write before the tool is registered, not a hope you invent after the SMS. Classify every tool as reversible, reversible-with-clock, or irreversible. Irreversible tools require a human in the system of record. Payment-adjacent and public-assertion tools are irreversible even when a vendor labels them notifications.

Guide for CIOs. 16 August 2026. Not legal advice.

Three buckets, written on the allow-list

If you cannot name the undo, it is irreversible.

Bucket	Examples	Who may fire it
Reversible now	Save a draft, retrieve a circular, create a ticket the desk owns	Agent, logged
Reversible with clock	Hold a file internally for 2 hours; queue an email not yet collected	Agent only if a cancel job exists and is tested
Irreversible	SMS, public portal notice, payment, PO, court filing, deletion of a record, hotel booking	Competent human in the system of record

Email is a trick. If your mail server still holds it, you may have a clock. If it is in the citizen's Gmail, you do not. Design as irreversible unless you have a tested recall that works on the infrastructure you actually run. Most departments do not.

Undo is a workflow, not a button

Write the undo as you would write a correction in a cash book: who may do it, what evidence they need, what the citizen sees, what the log shows, whether a compensating money act is required. Test it once. An untested undo is an irreversible act with optimism.

Deleting the agent's chat bubble does not undo a speaking order. Rolling back a prompt does not unsend an SMS. Restoring a database backup to 'erase' a bad night will destroy other nights. Those are not undos. They are new incidents.

Irreversible means human first

This is the same instinct as the refusal article and the DFPR article. The agent drafts the SMS. The officer who holds the public-communication or financial delegation sends it. The packet sits on the send. If that feels slow, good. Irreversible should feel slow.

Identity-class deletions, child-record updates and anything that would be a Public Records Act question should be treated as irreversible even when a disk can overwrite a bit. The legal state is not the inode.

Two nights

Objections

Product says users expect instant notify. Answer: they expect true notify. Truth can wait for a click.

The vendor has an undo API. Answer: show it working on your gateway, after hours, against a real handset. Then write the clock.

A collector says apologies are enough. Answer: apologies are a second irreversible act. Design so you need fewer of them.

Legal says mark everything irreversible to be safe. Answer: then the agent can only draft. That is a respectable design. Write it. Do not pretend it can notify.

A four-week playbook

• Week 1: list every tool. Force one of the three buckets. No 'depends'.
• Week 2: for reversible-with-clock, write and test the cancel job. Fail closed.
• Week 3: strip irreversible tools from the agent account. Leave them on the human systems.
• Week 4: tabletop the 21:13 SMS and the 19:40 booking. Confirm they cannot happen.

File note you can paste

Subject: Reversibility classification of agent tools.

Every tool an agent may invoke shall be classified as reversible, reversible-with-clock, or irreversible. Irreversible tools — including public messages that assert a legal or money fact, payments, bookings, and record deletions — shall not be invocable by the agent. A competent human shall act in the system of record.

An undo, where claimed, will be a tested workflow with a named post and a clock. Compensating payments are new money acts. This note is not legal advice.

Public assertions are a special irreversible

A portal banner, a tweet from an official handle, a notice PDF, an IVR that says 'approved' — these are not notifications. They are government speech. Citizens act on them. They sell a buffalo, they miss a hearing, they stop chasing a clerk. The undo is never complete. Treat every public assertion as irreversible even when a CMS can take the page down.

Draft the banner in the agent if you must. Publish it from the same desk that already publishes notices, with the same officer and the same log. If that desk is slow, the agent does not get to be the press. Speed is how 4,200 false rebates ship at 21:13.

Write a citizen-facing correction template before you need it: what was said, what is true, what to do, who to call. A correction drafted at 21:30 by a panicked model is a third irreversible act. Keep the template on the register row for every workflow that might ever speak in public.

Internal drafts remain reversible. That is the point of keeping the agent a clerk. The moment a draft can auto-publish, you have reclassified the tool without a meeting. CAB should treat auto-publish as a class upgrade to irreversible and refuse it.

• Separate gateway keys for test and production messages. Never share them.
• Time-box any 'reversible-with-clock' email to infrastructure you have tested after hours.
• If a vendor brochure's cancel window is shorter than your officer's commute, the brochure is a fiction.

Informational field guidance. Confirm DFPR, public-records rules and your messaging infrastructure before you call anything reversible.

How this survives CAG, RTI or the Board

“Defining Reversibility in Agent Workflows” is not a workshop slide. A P1 CIO/CTO will have to reconstruct a decision after the officer who clicked approve has been transferred. Write the artefact that lets a stranger replay the case: the log fields, the approval, the override, the register row.

Reversibility is not a Git reset. It is a statement: this act can be undone in the system of record, by this post, inside this clock, leaving this audit trail. If you cannot write that sentence, the agent does not perform the act. India AI Governance Guidelines (November 2025) are guidelines, not a statute. DPDP still allocates fiduciary duty. Delegation of Financial Powers still allocates who may spend. Do not hide those instruments behind the word governance.

If you cannot show who acted, on which purpose, with which data class, and who could have refused, you do not have accountability. You have a chatbot with a charter PDF.

• Name the owner of “reversible AI actions” inside the department, not the vendor.
• Keep CERT-In-relevant logs in India for the required period.
• Store overrides with a reason an auditor can read.
• Put the workflow on the AI register before it touches a citizen.

Close this loop before the next CAB

Put “Defining Reversibility in Agent Workflows” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P1 CIO/CTO, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “reversible AI actions” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.

What the next noting must contain

“Defining Reversibility in Agent Workflows” belongs in a file, not only in a search result. A P1 CIO/CTO should be able to point at one artefact that proves “reversible AI actions”: a packet capture, a processing schedule, a scored evaluation row, a dated notice, or a refusal rule. If the only evidence is a slide, you have a heading.

Reversibility is not a Git reset. It is a statement: this act can be undone in the system of record, by this post, inside this clock, leaving this audit trail. If you cannot write that sentence, the agent does not perform the act. DPDP 2023 does not define sovereign AI and does not write a blanket localisation rule for every model hop. CERT-In’s 28 April 2022 directions still set specified incident clocks and 180-day log retention in India for in-scope events. The November 2025 AI governance text is guidance, not a statute. A Proprietary Article Certificate, when it is lawful, lives in GFR Rule 166 — not Rule 161.

Write three dated sentences under C6 Governance & Audit: what was decided, which designation owns it after the next posting order, and when it will be re-checked. Unsigned sentences are souvenirs. Dated sentences are controls.

• Name the designation that owns “reversible AI actions”, plus a deputy.
• Attach one artefact a stranger can open next year.
• Name the instrument you are actually using — Act, direction, GFR clause, GeM term, or guideline paragraph.
• Leave unsourced percentages, GMV slides and house forecasts out of the noting.
• Revisit when the model, the SI, the notice, the region or the posting changes.