Before an AI agent acts for you, which actions are so hard to undo that it should pause and double-check first?

This explores how to decide where an agent's point of no return sits, meaning which actions should force a check before they run. The corpus doesn't give a checklist of irreversible verbs like 'delete', 'pay' or 'send'. It does say where the gate belongs and why a fixed list would miss cases. SafeFlow's answer is to validate the fully assembled workflow at the boundary just before an irreversible action is committed. That is the one moment when the whole risk picture can be reconstructed, because no single step holds it Where should workflow validation gates be placed for safety?. Here 'irreversible' is defined by function: it is the last point where a mistake can still be caught, and by then all the risky context has piled up.

A fixed list of dangerous action types would fail, because irreversibility often depends on history. Research on agent security finds that sequences of individually permissible actions can collectively break system constraints, so safety attaches to the whole pattern of behavior over time, not to single steps Can step-by-step approval miss harmful behavior patterns?. Stateless checks can't even state a rule that depends on what already happened Can stateless checks ever catch sequence-level constraint violations?. Take an outbound message. It may be harmless on its own and become the point of no return only after the agent has read something sensitive. This example is my illustration, not the papers'. The trigger therefore has to be stateful, asking what would become permanent given everything done so far, not just what tool is being called.

The gate only helps if what it runs is trustworthy, and the notes are sobering on that. In an undefended four-agent pipeline, a validator reading poisoned shared memory approved every unsafe action, because it sat as the final authority while relying on corrupted evidence Can a poisoned validator still approve unsafe actions?. A quorum of validators can follow the protocol, agree, and still endorse a semantically invalid transition Can a quorum of honest validators certify an invalid transition?. Steps can also each pass local checks while the workflow as a whole fails Can individual components pass safety checks if the system still fails?. Marking an action irreversible is only half the job. The check at the gate has to test system-level safety, not just plausibility or protocol compliance.

Two neighboring ideas help keep gates from becoming either everywhere or nowhere. One is uncertainty-based triggering. SAND deliberates only at steps where sampled actions diverge, not at every step When should an agent actually stop and deliberate?. That paper is about compute allocation, not irreversibility, but a gate could plausibly fire when an action is both hard to undo and one the agent is unsure about. The other is what happens when the gate closes. Zero recorded boundary crossings can hide very different behavior: silent stopping, escalation, refusal, or never terminating What behaviors hide behind a zero crossing rate?. So deciding what counts as irreversible also means deciding what the agent must do when it hits that line.

The corpus doesn't offer an empirical taxonomy of irreversible action classes. What it offers is a working rule: gate at the commit point, define 'irreversible' in terms of accumulated context and not just the single action, and design the check so a compromised or merely compliant validator can't wave it through.