System · Build & Ship
A rollback you cannotfinish in time is nota rollback.
Almost every action gets marked reversible, on the strength of a procedure that exists in a document. Notice in four hours, execute in fifteen minutes, against a one-hour undo window — that is a procedure you will read afterwards. This asks two questions about every action your agent can take, does the arithmetic, and takes the worse answer.
Deterministic and offline. Tests no rollback, enforces no cap.
Grades the actions you describe — never people.
Instant download. Python engine, workbook, two playbooks, worked checkpoint.
01
Axis one: could you take it back?
Three answers, and the first one has two halves that people check separately at their peril.
REVERSIBLE
A true undo exists, and you can finish it inside the window it works in. Both halves matter; almost everyone only checks the first.
COMPENSABLE
You cannot take it back, but you can make the subject whole — a refund, a correction, a credit. Recoverable, at a cost, with a conversation.
IRREVERSIBLE
Neither. The email is read, the record is gone, the payment cleared, the message is public. One subject is enough.
02
Axis two, and why neither rescues the other
How many subjects does one call touch? And why a small number is not the same as a bound.
A-03
A CRM field update with a genuine 24-hour undo window, comfortably within reach. Perfectly REVERSIBLE — and nothing caps how many rows one call touches, so it reads DO NOT AUTOMATE.
A-04
A customer email to exactly one person. Blast radius as NARROW as it gets — and once it is read you cannot unread it, so it also reads DO NOT AUTOMATE.
And a typical call size is not a bound
If nothing enforces a cap, the blast radius reads UNBOUNDED however small a normal call is. Fifty records today is a description, not a promise, and the call that goes wrong is rarely the typical one. Declare and enforce a cap and the same action drops to NARROW — which is usually a cheaper fix than building a rollback, and the runbook says so.
03
Move the detection time and watch a rollback stop counting
A-01 and A-02 are the same refund with the same undo window. Only how long it takes to notice differs.
A-01 has a 60-minute undo window and takes 15 minutes to execute. How long before anyone notices it was wrong?
Portfolio verdict
UNSAFE TO AUTOMATE
1 unattended · 3 with approval · 2 not automatable, of 6. 17% could run unattended — context only. 2 held back by radius alone, 3 by reversibility alone. Fix first: A-04.
A-01 issue_refundPayments
RUN WITH APPROVAL
reversibility: COMPENSABLE (declared REVERSIBLE)
blast radius: NARROW · 1 per call
The undo window closes after 60 minutes and this would take 255.
decided by: reversibility
A-02 issue_refund (monitored)Payments
RUN UNATTENDED
reversibility: REVERSIBLE
blast radius: NARROW · 1 per call
A-03 update_crm_fieldCRM
DO NOT AUTOMATE
reversibility: REVERSIBLE
blast radius: UNBOUNDED · 50 per call
no enforced cap - a typical call size is not a bound
decided by: blast radius
A-04 send_customer_emailMessaging
DO NOT AUTOMATE
reversibility: IRREVERSIBLE
blast radius: NARROW · 1 per call
decided by: reversibility
A-05 apply_account_creditBilling
RUN WITH APPROVAL
reversibility: COMPENSABLE
blast radius: NARROW · 5 per call
decided by: reversibility
A-06 tag_leadCRM
RUN WITH APPROVAL
reversibility: REVERSIBLE
blast radius: WIDE · 200 per call
decided by: blast radius
Same arithmetic as the shipped engine and workbook. It grades the actions you describe, never people, and tests no rollback.
04
What the engine prints
This is the shipped engine’s complete output on the shipped checkpoint.
AGENT SIDE-EFFECT & BLAST-RADIUS CHECKPOINT
==========================================================================
A-01 issue_refund (Payments)
reversibility COMPENSABLE blast radius NARROW RUN WITH APPROVAL
undo window 60 min; notice + execute takes 255 min
1 subject(s) per call; cap enforced: yes
[GATE] declared REVERSIBLE - the undo window closes before you would finish using it
decided by: reversibility
A-02 issue_refund (monitored) (Payments)
reversibility REVERSIBLE blast radius NARROW RUN UNATTENDED
undo window 60 min; notice + execute takes 35 min
1 subject(s) per call; cap enforced: yes
A-03 update_crm_field (CRM)
reversibility REVERSIBLE blast radius UNBOUNDED DO NOT AUTOMATE
undo window 1440 min; notice + execute takes 65 min
50 subject(s) per call; cap enforced: no
[RADIUS] no enforced cap - a typical call size is not a bound
decided by: blast radius
A-04 send_customer_email (Messaging)
reversibility IRREVERSIBLE blast radius NARROW DO NOT AUTOMATE
1 subject(s) per call; cap enforced: yes
decided by: reversibility
A-05 apply_account_credit (Billing)
reversibility COMPENSABLE blast radius NARROW RUN WITH APPROVAL
5 subject(s) per call; cap enforced: yes
decided by: reversibility
A-06 tag_lead (CRM)
reversibility REVERSIBLE blast radius WIDE RUN WITH APPROVAL
undo window 10080 min; notice + execute takes 32 min
200 subject(s) per call; cap enforced: yes
decided by: blast radius
--------------------------------------------------------------------------
PORTFOLIO VERDICT: UNSAFE TO AUTOMATE
1 unattended / 3 with approval / 2 not automatable (of 6 actions)
17% could run unattended -- context only, it decides nothing
1 action(s) declared a rollback that closes too soon; 2 held back by blast radius alone, 3 by reversibility alone
fix first: A-04
Grades the actions you describe. Not legal, security, or compliance advice.A-01 and A-02 are the pair worth reading twice. Same refund, same 60-minute undo window — only the time to notice differs, and that alone moves the verdict from RUN WITH APPROVAL to RUN UNATTENDED. Note also A-03, which is DO NOT AUTOMATE on blast radius alone despite a genuine 24-hour undo window, and A-04, which is DO NOT AUTOMATE on reversibility alone despite the narrowest possible radius. The unattended share is 17% and decides nothing; the portfolio reads UNSAFE TO AUTOMATE because two actions are held back by radius alone and three more by reversibility alone.
05
What is inside
Six files, all editable, none requiring an account.
Checkpoint engine
Zero-dependency Python. Computes both axes separately, composes them, and says which one decided. No network access of any kind.
Workbook that reproduces it
Four tabs and 76 live formulas, with the two axes in their own columns so you can see which is holding an action back. No macros.
Blast-Radius Workshop Playbook
How to get honest detection times out of a room, and how to find the actions nobody listed because they did not feel like actions.
Automation Runbook
What each verdict means, the four ways to move an action up a band, and why the cheapest fix is usually a cap rather than a rollback.
Worked 6-action checkpoint
Including the timing twin and both mirror cases: reversible-but-unbounded, and irreversible-but-tiny.
Editable settings
Where the NARROW and WIDE bands sit, in a tab you can change without touching a formula.
06
Who it is for, and what it will not do
It is for whoever decides which actions get to run at 3am with nobody watching.
Built for
- Teams turning a supervised agent loose, one action at a time, and needing a defensible order to do it in.
- Anyone who has been asked “can we just let it run?” and wants a better answer than instinct.
- Reviewers who need a reason to hold an action back that survives being argued with.
It will not
- Test your rollback. It does the arithmetic on the numbers you give it; running the drill is yours, and the runbook says how.
- Check that a declared cap is actually enforced in code. You answer yes or no; it takes you at your word.
- Measure your real detection time. Most teams guess low the first time and find out on the second run.
- Decide anything for you. DO NOT AUTOMATE is a finding, not a policy — automating anyway is a choice you can make with your eyes open.
This System grades the actions you describe. It is a working aid, not legal, security, or compliance advice, and it is not an audit or a certification. It never scores, ranks, or assesses people. It tests no rollback and enforces no cap — RUN UNATTENDED means both questions came back clean on what you entered, not that the action is safe.
07
What sits either side of it
Three neighbours that touch the same agent from different angles.
AI Agent Go-Live Readiness Gate
$79
Asks whether a tested rollback path exists, as one control among five. This asks whether it finishes before the window closes.
AI Agent & Connector Access Auditor
$99
What an agent is permitted to reach at all. Worth doing first — an action it cannot take needs no verdict here.
Agent Reliability Harness
$149
Whether the agent behaves consistently across runs. This is about what one wrong run costs you.
08
Questions people actually ask
Short answers first, with the caveat after it rather than in front of it.
Every action your agent can take that changes something, on two axes. Reversibility asks whether you could take it back — REVERSIBLE, COMPENSABLE, or IRREVERSIBLE. Blast radius asks how many subjects one call touches — NARROW, WIDE, or UNBOUNDED. The verdict is the worse of the two: RUN UNATTENDED, RUN WITH APPROVAL, or DO NOT AUTOMATE.
Because neither axis rescues the other. A perfectly reversible action that can hit an unbounded number of records still means undoing at scale under time pressure, which is not the same as being safe. The shipped sample has exactly that case: a CRM update with a 24-hour undo window that reads DO NOT AUTOMATE purely because nothing caps how many rows one call touches. The mirror case is there too — an irreversible email to exactly one person, also blocked.
Because almost everyone marks their actions reversible on the strength of a rollback procedure that exists in a document. A rollback is only real if you can finish it inside the window it works in. Enter how long it takes to notice and how long it takes to execute, and if the total exceeds the undo window the action is demoted to COMPENSABLE. The shipped sample has two identical refunds separated only by how long detection takes: 255 minutes against a 60-minute window versus 35 minutes.
Because a typical number is a description, not a bound. If nothing enforces a cap, the blast radius reads UNBOUNDED however small a normal call is — fifty records today is not a promise about tomorrow, and the call that goes wrong is rarely the typical one. Declare and enforce a cap and the same action drops to NARROW.
A go-live check asks whether a tested rollback path exists, as one control among several, answered yes or no. This assumes it exists and asks whether it finishes in time — and pairs that with what a single call can reach. Two actions can both tick the go-live box and land on opposite sides of this one.
No. It means the two questions came back clean on what you entered. It does not test your rollback, measure your real detection time, or check that a declared cap is actually enforced in code — those are things you verify, and the runbook says how. It grades actions, never people, and is a working aid rather than legal, security, or compliance advice.
Find out which actions can run at 3am.
Two axes, neither rescuing the other, and the arithmetic that turns a rollback on paper into a rollback in time. Deterministic, offline, and clear that a clean verdict is not a safety guarantee.
This System grades the actions you describe. A working aid, not legal, security, or compliance advice. It tests no rollback, and it never scores or ranks people.
Sold by RedHub AI LLC · Secured by Stripe · redhub.ai