When AI agents go wrong, who's designed a way to undo the damage instead of just trying to prevent it?

This explores where, beyond the defense notes already found to be thin on recovery, the vault says how to undo damage or roll back. The short answer is that there are only a couple of places, and neither is in the security-defense cluster. A keyword check across six defense notes found recovery missing from five of them, and only one note ties it to irreversibility (What recovery mechanisms do vault defense notes actually specify?). Most neighboring notes are about stopping bad things, not fixing them afterward.

The prevention-only notes share a pattern. One argues that violations only become unavailable when the enforcing component sits outside what the policy can see and edit (What would make policy violations truly unavailable to an agent?). Another says per-action guardrails can't express rules that depend on history, so you need stateful monitors (Can stateless checks ever catch sequence-level constraint violations?). A third reports a 0% unsafe-action rate with both authorization checks on, but doesn't show which check does the work (Which authorization component achieves the zero percent unsafe rate?). The RAG poisoning defenses detect or bound the damage at retrieval time without cleaning the corpus (Can we defend RAG systems from corpus poisoning without retraining?). None says what to do once something slips through. The undefended four-agent pipeline shows the cost: a validator reading poisoned shared memory approves every unsafe action, and nothing unwinds the result (Can a poisoned validator still approve unsafe actions?).

Two notes do specify recovery. The first is COLLEAGUE.SKILL, which treats distilled expertise as versioned files you can inspect, correct, and roll back, instead of leaving it as hidden prompt state (Can person-grounded skills remain auditable without hidden prompt state?). That is ordinary software-style rollback, and it works because the state lives somewhere you can point at.

The second is model-level repair. Overwriting one predicted layer window with its honest value restored sandbagged capability in 28 of 33 runs, with a median 96% held-out recovery (Can grafting restore sandbagged model capabilities?). The same causal model that says where the fix works also explains the five failures (Why did the graft fail in five of thirty-three runs?). One caveat: the experiments use installed locks with known passwords, so the vault doesn't yet show recovery from an unknown lock (Can you build a capsule without knowing the password?).

There is also an indirect answer for cases where rollback is impossible. SafeFlow validates the assembled workflow at the commit point, right before an irreversible action, and rebuilds the risk picture that no single step holds (Where should workflow validation gates be placed for safety?). It doesn't undo anything. It puts the last global check where undoing would no longer be possible. Across these notes, recovery is well specified where state is legible, such as files and identifiable layers. It is unspecified where poison hides in shared agent memory or retrieval corpora, and that is the gap the vault has yet to fill.