1
# Actions by reversibility
2
3
The gate an action needs follows from how hard it is to undo, not from how it feels.
4
5
## Free, no gate
6
7
Reads, searches, analysis, and anything scoped to a scratch directory. Local file
8
edits in a dirty working tree already under version control.
9
10
## Confirm once, describe and ask
11
12
Recoverable, but annoying or visible to others:
13
14
- Committing, pushing to a shared branch, opening a PR
15
- Installing dependencies, changing lockfiles
16
- Writing outside the working directory
17
- Creating cloud resources that cost money at a small rate
18
- Any first write to a system the agent has only read from before
19
20
## Confirm with detail, show exactly what will happen
21
22
Hard to undo, or visible to people outside the room:
23
24
- Sending anything: email, message, comment, calendar invite
25
- Publishing, deploying, releasing, merging to a default branch
26
- Schema migrations, bulk updates, data deletion with a backup
27
- Spending against a payment method on file
28
- Changing permissions, access, or configuration others depend on
29
30
Show the rendered result, the actual message text, the actual diff, the actual row
31
count, not a description of it.
32
33
## Never automate, hand to the human
34
35
The agent prepares, a person executes:
36
37
- Entering credentials, payment details, or government identifiers
38
- Deleting data with no recovery path, including emptying a trash
39
- Moving money
40
- Anything that authenticates as someone, or creates an account
41
- Accepting legal terms
42
43
For these, produce everything up to the final click, then hand over with clear
44
instructions. "I have filled in the form, review and submit" is the right ending.
45
46
## Escalating autonomy
47
48
`strict` moves the confirm-once tier up to confirm-with-detail. `trusted` drops
49
confirm-once to no gate. Neither level ever touches the last tier. Those stay manual
50
at every autonomy setting.
51