The safest automation is not the smartest. It is the one you can undo. If you cannot write down the rollback step, the action is not ready to run unattended.
In his 2015 letter to Amazon shareholders, Jeff Bezos described two kinds of decisions. Type 1 decisions are consequential and irreversible or nearly irreversible — one-way doors. They deserve to be made slowly, carefully, with deliberation. Type 2 decisions are reversible — two-way doors. If you walk through and do not like what you find, you walk back. Those, he argued, should be made quickly by individuals or small groups with good judgement.
The warning in that letter was that large organisations tend to treat every decision as a one-way door, which makes them slow. But the framework cuts both ways, and for automation the other direction is the dangerous one: treating a one-way door as a two-way door, and letting a machine walk through it alone.
Reversibility beats intelligence
It is tempting to think the safest automation is the most intelligent one. It is not. A confident system that cannot be reversed is more dangerous than a cautious one that can, for a simple reason: the confident one fails quietly. It does not hesitate or ask. It keeps acting, and the cost compounds while someone hunts for the off switch.
A system that is less clever but fully reversible has a ceiling on how much damage it can do. You notice, you reverse, you fix the rule. The mistake costs you a morning rather than a quarter.
Sorting the doors in marketing and sales
Two-way doors — reversible, and generally safe to automate inside limits:
- Pausing or resuming an ad group
- Adjusting a bid within a defined band
- Shifting budget one step between campaigns
- Adding a negative keyword
- Tagging, scoring or routing a record internally
- Creating an internal task or alert
One-way doors — irreversible or effectively irreversible, and needing a human:
- Sending a message to a prospect or customer. There is no unsend. This is the classic one-way door in go-to-market work, and it is why unattended sends are ruled out entirely.
- Deleting or merging records you cannot restore
- Publishing anything publicly
- Changing a price or offer a customer has already seen
- Large, fast budget increases that spend real money before anyone can look
The rollback rule
The operational form of this principle is a rule worth stealing outright: if you cannot write down the rollback step, the action is not ready to be automated. It drops back to being a recommendation that a human executes.
Writing the rollback step is a surprisingly effective test. For pausing an ad group, it is trivial: resume the ad group. For sending an email, there is nothing to write. The test sorts actions into the right bucket without any debate about how clever the system is.
The mechanism that makes rollback possible is before-state capture. Before an automated action changes anything, it records what the setting was. Without that record, “reversible” is a hope rather than a property. With it, reversing is one click.
This is not an argument for automating less
It would be easy to read this as caution for its own sake. It is the opposite. Bezos’s point was that most decisions are two-way doors and should be made fast. The same is true here: most of the day-to-day adjustments in a well-run account are reversible, and they can and should be automated aggressively once the guardrails are in place.
The principle simply draws a clear line. Automate the two-way doors hard. Keep a person at the one-way doors. And never let a system decide for itself which is which.
Where to go next
The three action tiers turns this principle into a working model for what an agent may do unattended. Bounded autonomy explains why reversibility has to sit alongside limits and visibility. Trigger, action, impact describes the record that makes every action auditable after the fact.