Irreversible actions
Redesign irreversible actions so a responsible person owns the final transition.
Purpose
Redesign irreversible actions so a responsible person owns the final transition. The workflow is acceptable only while its evidence, permission, review, and stop boundaries remain true.
Prerequisites
- A list of actions treated as irreversible, such as releasing a payment or permanently deleting records.
- A preparation boundary: the AI workflow has no permission to perform those actions.
- An authorized person who performs the final step in the system of record.
Worked example
Preparation packet for a supplier payment (fictional).
| Field | Value |
|---|---|
| Payee | Northwind Parts Ltd (vendor master V-102) |
| Amount | 186.00, matching invoice INV-20431 |
| Match | Purchase order and goods receipt match the invoice |
| Bank details | Unchanged since vendor onboarding |
| Discrepancies | None found |
| Final step | Authorized approver releases payment in the payment system |
Procedure
- Separate preparation (matching, gathering evidence, listing discrepancies) from execution.
- Assemble a packet that shows the exact consequence: payee, amount, account, and supporting records.
- Run deterministic checks and list every discrepancy at the top of the packet.
- The authorized person reviews the packet and performs the final step themselves, or declines it.
- Record who performed the step and on what evidence.
Deterministic and review checks
- Amount, payee, and references match the source records exactly.
- Changed bank details or payee data stop preparation and follow your organization’s verification procedure.
- The AI workflow’s credentials cannot release, delete, or send.
A case that must fail
If the bank account in the request differs from the vendor master, preparation stops and the packet is flagged. A timeout or missing reply is never treated as approval.
Human boundary
Only the authorized person performs the irreversible step. The workflow prepares and explains; it never executes, schedules, or auto-approves.
Stop and escalation
- Do not infer approval from silence.
- Do not use bounded action when rollback is impossible and consequence is material.