Ask before no-undo

Think of it when the next step deletes, sends, pays or publishes something.

In everyday life

Like a carpenter’s rule: measure twice, cut once. Measuring is free to repeat and the cut is not, so all the care goes in before the saw.

One case

An AI coding agent is asked to test a library’s new overdue-notice template by sending one email to the developer. It runs the real send script, which points at the member list. In 90 seconds the script emails a draft with wrong fines to 48,000 members. No command can call those emails back.

One test email was meant; 48,000 went out
The case, cell by cell1 cell = 15 seconds
Emails meant to go out
111111
Emails sent
80001600024000320004000048000
Members emailed
48,000
Emails you can call back
0
The script sent about 8,000 emails every 15 seconds.

Every case

Most work can be undone: code goes back one commit, a setting goes back to its old value. A few actions cannot: a sent email, a deleted table with no backup, a payment, a public post. In a terminal they look like any other command, so they get no special care unless you give it to them on purpose. Most of the cost of your mistakes comes from these few. So decide the reversible things quickly, and put a stop in front of the irreversible ones: a confirm step, a dry runA run of a command that reports what it would do, without doing it., or a second person.

The word

Engineers call this

irreversible actionsAn action you cannot undo: delete data, send a message, move money, publish. Spend your caution on these, and move fast on the rest.

Before any step you cannot undo, stop and confirm. For steps you can undo, decide and move on.

Where this idea leads

Skills that encode it

  • principle-never-block-on-the-human pstackReversible work goes ahead without asking. Irreversible actions, such as deleting production data or sending messages, still need confirmation.
  • full-send tstackEven with full autonomy, ask the user before a step outside the grant: deleting data or touching production.
  • full-stop tstackDoes all the work but stops before the merge, and leaves that last step to the user.