The Reversibility Ladder

Most arguments about what an AI agent should be allowed to do inside a company are arguments about capability. Can the model read the invoice. Can it match the purchase order. Can it hit ninety eight percent on the extraction benchmark.

That is the wrong axis, and it produces pilots that pass every test and never ship.

Here is the rule I would put on the wall instead:

An agent should be allowed to write in inverse proportion to how hard that write is to reverse.

Model capability determines whether an agent can do something. Reversibility determines whether it may. Those are different questions, they have different owners, and the second one is the one that kills programs at the integration boundary.

Why capability is the wrong axis

A ninety eight percent accurate agent sounds excellent until you ask what happens during the other two percent.

If the answer is "a draft requisition is wrong and somebody edits it," you have a productivity tool with a small correction cost. If the answer is "a journal entry posted to a closed period," you have an accounting problem, an audit finding, and a conversation with your external auditors. Same model. Same accuracy. Completely different risk, because the two writes differ in how easily the world can be put back.

Accuracy is a property of the model. Reversibility is a property of the system you point it at. Enterprise programs fail when they measure only the first and inherit the second by accident.

The ladder

Rank operations by what it costs to undo them, then let that ranking set agent authority.

Tier 1, free to undo. Drafting a requisition, summarizing a variance, proposing a journal, drafting a customer email, explaining why a report moved. Nothing has happened yet in the system of record. The cost of being wrong is somebody's attention. Let agents work freely here, and note that most of the real value in enterprise AI lives on this rung, which nobody finds exciting.

Tier 2, cheap to undo. Updating a descriptive field, tagging a record, attaching a document, setting a non-controlling flag. A wrong value is corrected by writing the right one, and nothing downstream has already consumed it. Let agents write, and log it as agent-originated so a human can find every one later.

Tier 3, costly to undo. Inventory adjustments, price changes, credit limits, master data creation, releasing a production order. These are technically reversible. The problem is that by the time you notice, the value has already been read by something else and acted upon. Agents propose. A human commits.

Tier 4, effectively irreversible. Posting to the general ledger. Executing a payment run. Closing a period. Tax determination on a filed return. Anything that leaves the building or enters the audit record. Agents never write here. Not with a better model, not with a confidence threshold, not with a human skimming a confirmation dialog at the end of a batch.

The tiers are not about difficulty. Tier 4 operations are often the simplest ones in the system. They are about consequence.

Why the boundary sits exactly there

This is the part that people who have not lived inside an ERP tend to get wrong, and it is not a matter of caution or temperament. There are structural reasons.

Reversal is not deletion. In a real general ledger you cannot delete a posting. You post a reversing entry, in an open period, and both entries live in the record permanently. So an agent's mistake is not undone, it is appended. The error and its correction both become part of the financial history that someone will later have to explain. Software people hear "reversible" and think undo. Accounting means something much narrower by it.

An agent has no identity the audit trail can hold. Every consequential action in a controlled system answers the question "who did this, and were they allowed to." That is not logging, it is accountability, and it assumes a person who can be asked. A service account running an agent satisfies the schema and defeats the purpose. Until an agent can be a party to segregation of duties rather than a hole in it, the control does not survive its involvement.

Blast radius is not proportional to the size of the write. One wrong inventory number is a small write. Planning consumes it, generates demand, purchasing acts on the demand, and cash moves. By the time anyone sees the original error, it has been laundered through three subsystems into a decision nobody traces back. This is why Tier 3 exists as its own rung: those writes look survivable in isolation and are not, because enterprise systems are propagation machines.

Some processes must be deterministic, and accuracy is not a substitute. Tax determination, statutory reporting, and period close have to produce the same answer twice and defend it to somebody external. A probabilistic system that is right more often than a human is still the wrong shape for that job, because the requirement is not accuracy, it is reproducibility and explanation. This is the single most common place where a technically excellent pilot meets a flat no from finance, and the team walks away believing finance is behind the times. Finance is not behind. Finance is answering a different question.

Windows are real. Close periods, freeze windows, statutory cutoffs, batch schedules. A system that is available to write to is not necessarily open to write to, and an agent with no model of the calendar will eventually act inside a window where the humans have all deliberately stopped.

How to use the ladder

The point of a ladder is that it turns an argument into an inventory.

Start by listing what the agent would actually write, not what it would understand. Most proposals evaporate at this step, because a surprising number of them turn out to be Tier 1 with extra ceremony, which is good news that arrives disappointingly.

Then place each write on a rung, and make somebody name the reversal path out loud. Not "we would catch it." The literal sequence: who notices, how, how fast, and what they do. If the reversal path cannot be described in two sentences, the write belongs one rung lower than whoever proposed it thinks.

Then check propagation before authority. Ask what reads this value within an hour. That question moves more writes down the ladder than any accuracy discussion, and it is the one nobody asks in a demo.

Only then talk about the model.

What this changes about pilots

Enterprise AI pilots overwhelmingly die at integration rather than at intelligence, and the reversibility framing explains why. Teams pick a use case for how impressive it demonstrates, which biases hard toward high tiers, because the impressive part is watching software do the consequential thing. Then the program spends its remaining credibility discovering that the consequential thing is exactly where the organization has spent forty years installing controls.

The programs that survive do the opposite. They take Tier 1 and Tier 2 across a wide surface, ship them, measure them, and build the audit and observability substrate they will need later while the stakes are still low. They earn Tier 3 with evidence. They plan never to have Tier 4, and they say so early, because saying so is what buys the trust to keep going.

That is a less thrilling roadmap. It is also the one that is still running in eighteen months.

The uncomfortable part

The ladder implies something most AI strategies are not ready to say plainly: the highest-value agent work in an enterprise is mostly boring, and the exciting work is mostly forbidden.

Sitting with that is the actual job. Not finding a clever way around it.